Procm Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Procm Mcp (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for process management.
Using these features, LLMs start processes like development servers, docker-compose, or test watchers and check their outputs to fix bugs automatically.
npm i -D procm-mcp.mcp.json
{
"mcpServers": {
"procm-mcp": {
"command": "node",
"args": ["./node_modules/procm-mcp/build/index.js"],
"env": {}
}
}
}You can permit LLMs to use start-process tool without confirmation, because procm-mcp only allow whitelisted process creations.
LLMs will ask you to use allow-start-process tool to add specific process creation to the whitelist.
Once you allow a process creation, you don't have to confirming it anymore as long as the command and the working directory are the same.
I call it "allow-x pattern", which can balances security and usability in MCP.
Warning: Do not permit LLMs to use `allow-start-process` without confirmation.That means "Do anything you want to".
allow-start-process Allow specific processes to be createdscript (required): The script/command to allowargs (optional): Array of argumentscwd (optional): Working directorystart-process Start a new process with specified script and argumentsscript (required): The script/command to executename (optional): A friendly name for the processargs (optional): Array of arguments to pass to the scriptcwd (required): Working directory for the processenvs (optional): Environment variables to set for the processdelete-process Stop and remove a process by ID.The default signal is SIGTERM, but SIGKILL(force killing) will be sent after 10 seconds unless the process exits.id (required): The process IDrestart-process Restart an existing process by IDid (required): The process IDget-process-info Get detailed information about a processid (required): The process IDlist-processes List all currently managed processesget-process-stdout Retrieve stdout logs from a processid (required): The process IDchunkCount (optional): Number of recent log entries to retrieve (default: 10)get-process-stderr Retrieve stderr logs from a processid (required): The process IDchunkCount (optional): Number of recent log entries to retrieve (default: 10)MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.