xka0085-byte/mcpreflight
Developer tools이 페이지는 AI로 자동 번역되었습니다. 기술적인 세부 사항은 원문을 확인하세요. 원문 보기
Read-only MCP security scanner and schema checker, plus x402 HTTP 402 endpoint inspector for AI-agent developers and GitHub Actions.
개요
Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before an agent client or buyer depends on an endpoint. Check an MCP server without calling any tools: Requires Node.js 18+. No API key or wallet is needed. Example schema run against a live endpoint: The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it. Exit codes are stable for automation: 0 PASS, 1 FAIL, 2 UNKNOWN/network error, 3 usage error. mcpreflight is a protocol- and schema-level preflight, not a security audit. It does not: - Detect malicious code, prompt injection, or supply-chain risk in the server's implementation - Call tools, so it cannot prove runtime behavior, data handling, or permission scope - Bypass, test, or evaluate authentication and authorization - Verify payment settlement or delivery for x402 endpoints - Certify compliance with any spec beyond the response shapes it inspects
README
원문 README의 일부입니다. 원문 보기.
mcpreflight
Point it at any MCP or x402 endpoint and get a verdict in one command. Read-only: no API key, no wallet, no tool calls.
npx -y @eidonze/mcpreflight schema https://your-mcp-server.example/mcp
Status: PASS | FAIL | UNKNOWN exit 0 | 1 | 2, so CI can gate on it
Reach for it when an agent client, a buyer, or a CI job is about to depend on an endpoint whose source you cannot read, including endpoints you do not own. It reads only what the endpoint already sends to any anonymous caller: the initialize handshake, tools/list, and the HTTP 402 / x402 payment document.
| Form | Run it | Use it for |
|---|---|---|
| CLI | npx -y @eidonze/mcpreflight ... |
one-off checks and scripts |
| Homebrew | brew install xka0085-byte/mcpreflight/mcpreflight |
a machine-wide mcpreflight on PATH, macOS or Linux |
| GitHub Action | uses: xka0085-byte/mcpreflight@v1 |
fail a PR when a handshake, a tool schema or an x402 challenge drifts |
| stdio MCP server | npx -y -p @eidonze/mcpreflight mcpreflight-mcp |
let an agent check an endpoint before it connects |
No install to try it: run the check in the browser, free and without signup: check-your-mcp-endpoint
Listed in the official MCP Registry as io.github.xka0085-byte/mcpreflight (browse) and on the GitHub Marketplace.
What it is
Read-only MCP and x402 preflight: it reads initialize + tools/list and x402 payment documents. No API key, no wallet, no payment, no tool calls.
This is an endpoint preflight, not a source audit. Tools that read your repository or fuzz a server you launch need a checkout and a start command; this one needs only a URL, so it can check the deployment an agent is about to connect to, including one you do not own.
Same name, different job
Search “MCP preflight” and you also meet kenimo49/mcp-preflight, now published as mcp-scorecard. Both check an MCP server before something depends on it; the input and the findings differ.
This repo (mcpreflight) |
mcp-scorecard (kenimo49) |
|
|---|---|---|
| Input | a deployment URL, including one you do not own | a local checkout, a localhost URL, or a pypi: package |
설치
npx -y -p @eidonze/mcpreflight mcpreflight-mcp설정
{
"mcpServers": {
"mcpreflight": {
"command": "npx",
"args": ["-y", "-p", "@eidonze/mcpreflight", "mcpreflight-mcp"]
}
}
}