xka0085-byte/mcpreflight

Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал

0 stars 0 forks Качество 70 Тренд 20MIT

Read-only MCP security scanner and schema checker, plus x402 HTTP 402 endpoint inspector for AI-agent developers and GitHub Actions.

Обзор

Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before an agent client or buyer depends on an endpoint. Check an MCP server without calling any tools: Requires Node.js 18+. No API key or wallet is needed. Example schema run against a live endpoint: The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it. Exit codes are stable for automation: 0 PASS, 1 FAIL, 2 UNKNOWN/network error, 3 usage error. mcpreflight is a protocol- and schema-level preflight, not a security audit. It does not: - Detect malicious code, prompt injection, or supply-chain risk in the server's implementation - Call tools, so it cannot prove runtime behavior, data handling, or permission scope - Bypass, test, or evaluate authentication and authorization - Verify payment settlement or delivery for x402 endpoints - Certify compliance with any spec beyond the response shapes it inspects

README

Показан фрагмент оригинального README. Открыть оригинал.

mcpreflight

Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before an agent client or buyer depends on an endpoint.

What it is

Read-only MCP and x402 preflight: it reads initialize + tools/list and x402 payment documents. No API key, no wallet, no payment, no tool calls.

Start here

npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json

Exit codes are stable for CI: 0 PASS, 1 FAIL, 2 UNKNOWN/network, 3 usage. Requires Node.js 18+.

Gate a pull request:

- uses: xka0085-byte/mcpreflight@v1
  with:
    endpoint: https://your-mcp-server.example/mcp

Check your endpoint in the browser, free and without signup: check-your-mcp-endpoint

Find the right guide

Run it now

Check an MCP server without calling any tools:

npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json

Check an x402 endpoint without paying:

npx @eidonze/mcpreflight inspect https://your-api.example/paid --method=POST --json

Requires Node.js 18+. No API key or wallet is needed.

Example schema run against a live endpoint:

$ npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp

MCP Tool Schema Report
- Status: FAIL
- Endpoint: https://your-mcp-server.example/mcp
- Protocol: 2025-06-18
- Tools: 12

- FAIL REQUIRED_PROPERTY_UNDEFINED: tools[3] requires undeclared property query
- WARN PROPERTY_DESCRIPTION_MISSING: tools[7].limit has no description

The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it.

Which command?

Command	Checks	Does not do
`schema`	MCP `initialize`, `tools/list`, tool names, descriptions, and JSON schemas	Does not call tools or prove runtime behavior
`inspect`	HTTP 402, x402 v1/v2 payment document, `accepts[]`, discovery manifests, latency and response digest	Does not sign, pay, settle, retry, or verify delivery