.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/clipboard-mcp-server</h1> <p><b>Read, write, and inspect the system clipboard across macOS, Linux (X11/Wayland), and Windows via MCP. STDIO or Streamable HTTP.</b> <div>3 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
3 tools for reading, writing, and inspecting the system clipboard:
| Tool | Description |
|---|---|
clipboard_read | Read clipboard contents in a specified format (text, HTML, RTF, image, or auto-select richest) |
clipboard_write | Write plain text or HTML to the clipboard, replacing current contents |
clipboard_inspect | List available clipboard formats and byte sizes without reading full content |
clipboard_readRead the current clipboard contents in a requested format.
auto mode returns the richest format explicitly present — priority: image > html > rtf > textimage returns base64-encoded PNG data with pixel dimensionshtml returns raw HTML source as copied from a browserrtf returns raw RTF markuptext returns plain textformat_unavailable error when the requested format is not on the clipboard — use clipboard_inspect first to check availabilityclipboard_writeWrite content to the clipboard, replacing current contents.
text writes plain texthtml writes HTML with an auto-generated plain-text fallback (tag-stripped), so paste targets that only accept plain text still receive something usefuldestructiveHint: true — replaces whatever is currently on the clipboardclipboard_inspectList the formats and byte sizes of what is currently on the clipboard without reading the full content.
primaryFormat — the richest format present (image > html > rtf > text), or emptyavailableFormats — all semantic formats present, for deciding which format to pass to clipboard_readrawTypes — all raw platform type identifiers with byte sizes (UTIs on macOS, TARGETS on X11/Wayland, format names on Windows)clipboard_read to avoid format_unavailable errors and to check content size before readingBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauth)Clipboard-specific:
text, html, rtf, image across all backendsContentTooLargeError with byte/limit metadata before content returnsAdd the following to your MCP client configuration file.
{
"mcpServers": {
"clipboard-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/clipboard-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"clipboard-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/clipboard-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"clipboard-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/clipboard-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpmacOS: No additional tools required — pbcopy, pbpaste, and osascript are built in.
Linux X11: xclip must be installed.
apt install xclip # Debian/Ubuntu
pacman -S xclip # ArchLinux Wayland: wl-clipboard must be installed.
apt install wl-clipboard # Debian/Ubuntu
pacman -S wl-clipboard # ArchWindows: PowerShell 5.1+ (built-in on Windows 10 and later).
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_HTTP_HOST | Hostname for HTTP server. | 127.0.0.1 |
MCP_HTTP_ENDPOINT_PATH | Endpoint path for the HTTP server. | /mcp |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, notice, warning, error). | info |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:httpbun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suitedocker build -t clipboard-mcp-server .
docker run -p 3010:3010 clipboard-mcp-server| Path | Purpose |
|---|---|
src/index.ts | Entry point — registers tools via createApp() |
src/mcp-server/tools/definitions/ | Tool definitions: clipboard_read, clipboard_write, clipboard_inspect |
src/services/clipboard/ | Platform backends (macOS, Linux X11, Wayland, Windows) and service facade |
tests/ | Vitest tests for tools and backends |
skills/ | Agent workflow skills (add-tool, field-test, polish-docs-meta, etc.) |
See CLAUDE.md for the full developer protocol — tool patterns, service patterns, error handling, logging conventions, and the checklist for shipping changes.
Issues and pull requests welcome at github.com/cyanheads/clipboard-mcp-server.
Apache 2.0 — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.