minidoracat/mcp-feedback-enhanced

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

3755 stars 353 forks 质量 82 趋势 47NOASSERTION

Repository Install

增强型MCP服务器，支持交互式用户反馈和AI辅助开发中的命令执行，具备双界面支持（Web界面和桌面应用）及智能环境......

概览

法比奥·费雷拉 |原始项目 ⭐ Minidoracat sanshao85/mcp-feedback-collector 这是一个MCP服务器，提供双界面选项，完美适应本地、和。通过引导AI与用户确认而非进行投机操作，它可以将多个工具调用整合为一个反馈导向的请求，显著降低平台成本并提升开发效率。 - 🖥️ ：原生跨平台桌面体验，支持 Windows、macOS、Linux - 🌐 ：无需图形界面依赖，适合远程和 WSL 环境 - 🔧 ：根据环境需求选择最合适的界面模式 - 📦 ：两种界面提供完全相同的功能体验 2.5.0版本引入了基于Tauri框架的跨平台桌面应用支持，支持Windows、macOS和Linux平台，并具备原生桌面体验。 1. →MCP反馈增强工具 2.

概述（AI 翻译）

** 🌐 语言 / 语言切换：** 英语 |繁體中文 |简体中文

原作者： 法比奥·费雷拉 |原始项目 ⭐ 增强型叉： 迷你多拉猫 ** UI 设计参考：** sanshao85/mcp-feedback-collector

📢 维护状态（2026-08）

项目正在维护。请升级到v2.6.1 — 它修复了一个命令执行漏洞：

v2.6.1 发生了什么变化： 🔒- 命令执行移除 — 修复 #219（未认证的 WebSocket 可能执行任意程序）。旧的块表只捕获壳元字符，但由于使用 shell=False 执行时元字符从未成为风险——cat、curl、wget、python 直接通过，自动命令默认启用**。该功能永久消失。详见 SECURITY.md。

🔒 跨站WebSocket劫持已修复（私下报告为GHSA-cmr5-gpm3-79vf、GHSA-2wx7-r4rh-f663）：浏览器在打开WebSocket时不受同源策略限制，因此恶意页面可能导致浏览器连接到本地/ws。Origin现在在accept()之前已被验证，跨源尝试被403拒绝。

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

MCP Feedback Enhanced

🌐 Language / 語言切換: English | 繁體中文 | 简体中文

Original Author: Fábio Ferreira | Original Project ⭐ Enhanced Fork: Minidoracat UI Design Reference: sanshao85/mcp-feedback-collector

📢 Maintenance Status (2026-08)

The project is maintained again. Please upgrade to v2.6.1 — it fixes a command execution vulnerability:
uvx mcp-feedback-enhanced@latest
What changed in v2.6.1:

🔒 Command execution removed — fixes #219 (unauthenticated WebSocket could execute arbitrary programs). The old blocklist only caught shell metacharacters, but since execution used shell=False metacharacters were never the risk — cat, curl, wget, python passed straight through, and auto-command was enabled by default. The feature is gone for good. See SECURITY.md.

🔒 Cross-Site WebSocket Hijacking fixed (reported privately as GHSA-cmr5-gpm3-79vf, GHSA-2wx7-r4rh-f663): browsers are not restricted by the same-origin policy when opening a WebSocket, so a malicious page could make your browser connect to the local /ws. Origin is now validated before accept(), and cross-origin attempts are rejected with 403.

🐛 Fixed the Starlette breaking change that made the Web UI return 500 (#213, #217, #221, #228).

🐛 Fixed image serialization (#154 and related) by switching to standard mcp.types.ImageContent.

Current maintenance scope: security issues, and compatibility breaks that make installs unusable (dependency updates, upstream breaking changes). Anything beyond that will be decided from community feedback — see the pinned discussion.

One thing worth stating plainly: the original selling point was “consolidate multiple round-trips into a single Cursor request to save quota”. Cursor moved to token-based usage pricing in June 2025, so that premise no longer holds (see #115, #200). The positioning is now “insert human checkpoints into long-running tasks” — not a quota-saving tool.

Also note MCP and its clients now natively support Elicitation (server-initiated requests for user input) and MCP Apps (tools returning interactive UI). If native capabilities cover

在 GitHub 查看完整 README

安装

uvx mcp-feedback-enhanced@latest

新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "mcp-feedback-enhanced": {
      "command": "uvx",
      "args": ["mcp-feedback-enhanced@latest"],
      "timeout": 600,
      "autoApprove": ["interactive_feedback"]
    }
  }
}