Sublime Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Sublime Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCPServer is a Sublime Text package that exposes MCP tools over local HTTP from inside Sublime's Python runtime.
Today it ships with MCP tools for unsaved buffers:
list_open_buffersread_bufferclose_bufferclose_buffer.The architecture is fully in-process. By default it starts:
127.0.0.1:6123127.0.0.1:6124/mcpNo separate Node or TypeScript MCP server is required.
4171 or newersublime_mcp_server/: bridge logic and in-process MCP HTTP serversublime_mcp_server_plugin.py: Sublime Text plugin entrypointmessages.json and messages/*.txt: Package Control install and upgrade messagespython_tests/: pytest coverage for bridge and MCP behaviorFor normal usage, install the packaged artifact into Sublime's Installed Packages folder.
On macOS:
mkdir -p "$HOME/Library/Application Support/Sublime Text/Installed Packages"
cp dist/MCPServer.sublime-package \
"$HOME/Library/Application Support/Sublime Text/Installed Packages/MCPServer.sublime-package"If you previously installed an unpacked development copy, remove it first so Sublime does not load the package twice:
rm -rf "$HOME/Library/Application Support/Sublime Text/Packages/MCPServer"Restart Sublime Text after copying the files.
The packaged release includes the repository's tracked .python-version file at the package root so Sublime can select the correct Python runtime when loading the archive.
For local development, you can still use an unpacked checkout under Packages/MCPServer, but that is now a development-only workflow instead of the recommended installation method.
The package reads its host and port configuration from MCPServer.sublime-settings.
Default values:
{
"bridge_host": "127.0.0.1",
"bridge_port": 6123,
"mcp_host": "127.0.0.1",
"mcp_port": 6124
}To override them in Sublime Text:
Preferences: MCPServer Settings.Example:
{
"bridge_port": 7001,
"mcp_port": 7002
}The bridge and MCP ports must be different when using the same host.
There are two common release paths for Sublime Text packages:
0.2.5, and submit the repository to Package Control once. After approval, future semver tags are how users receive updates..sublime-package archive and host your own packages.json channel if you do not want to use Package Control's default channel.This repo now includes release-facing metadata:
0.2.5 in messages/0.2.5.txtSuggested release checklist:
messages/..sublime-package artifact from the repo root:python3 scripts/build_release.pypytest and python3 -m py_compile sublime_mcp_server_plugin.py sublime_mcp_server/*.py.0.2.5.For manual installs, use the generated dist/MCPServer.sublime-package file. The stable filename keeps the package name clean in Sublime, and the builder injects package-metadata.json so the description and version are visible in package UIs.
Once Sublime restarts, the plugin should start two localhost services:
GET http://127.0.0.1:6123/buffersPOST http://127.0.0.1:6124/mcpCheck the bridge:
curl -sf http://127.0.0.1:6123/buffers | python3 -m json.toolCheck the MCP endpoint:
curl -sf \
-X POST http://127.0.0.1:6124/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"1.0.0"}}}' \
| python3 -m json.toolYou should see serverInfo.name set to sublime_mcp_server.
If you changed the ports in settings, use those values instead of 6123 and 6124.
This project serves MCP over HTTP from inside Sublime, so your MCP client only needs to connect to the plugin's endpoint.
Recommended MCP client configuration:
{
"mcpServers": {
"sublime_mcp_server": {
"type": "http",
"url": "http://127.0.0.1:6124/mcp"
}
}
}list_open_buffersLists unsaved open Sublime buffers. Each buffer descriptor includes:
buffer_idtitlewindow_idis_dirtysyntaxpreviewread_bufferReads the current live text and metadata for one unsaved Sublime buffer.
Input:
{
"buffer_id": "38"
}close_bufferForce-closes an unsaved Sublime buffer and discards its current contents.
Input:
{
"buffer_id": "38"
}curl -sf http://127.0.0.1:6123/buffers | python3 -m json.toolDirect JSON-RPC example:
curl -sf \
-X POST http://127.0.0.1:6124/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' \
| python3 -m json.toolcurl -sf \
-X POST http://127.0.0.1:6124/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"read_buffer","arguments":{"buffer_id":"38"}}}' \
| python3 -m json.toolcurl -sf \
-X POST http://127.0.0.1:6124/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"close_buffer","arguments":{"buffer_id":"38"}}}' \
| python3 -m json.toolRun tests:
pytestCheck syntax:
python3 -m py_compile sublime_mcp_server_plugin.py sublime_mcp_server/*.py~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.