mcp-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up MCP servers in the current workspace for testing with Claude Code.
Determine what the user has provided:
/home/user/my-mcp-server, ./my-server)https://github.com/user/mcp-server, github.com/user/mcp-server)@modelcontextprotocol/server-filesystem)For local paths:
package.json (Node.js) or Python entry pointFor GitHub repos:
/home/claude/mcp-servers/ or a specific path)"npm install, pip install -r requirements.txt, etc.)For npm packages:
Inspect the server to determine how to run it:
| Server Type | Command | Args Example |
|---|---|---|
| Node.js (npm package) | npx | ["-y", "@package/name"] |
| Node.js (local) | node | ["path/to/server.js"] |
| TypeScript (local) | npx | ["tsx", "path/to/server.ts"] |
| Python | python or python3 | ["path/to/server.py"] |
| Binary/Executable | Direct path | ["--flag", "value"] |
Check for:
package.json → look for "main", "bin", or scripts*.py entry point → usually server.py, main.py, or __main__.py.env.example, README, or code)Create or update .mcp.json in the project root (current working directory):
{
"mcpServers": {
"server-name": {
"command": "node",
"args": ["/absolute/path/to/server.js"],
"env": {
"API_KEY": "${API_KEY}",
"DEBUG": "true"
}
}
}
}Configuration rules:
command: The executable to runargs: Array of command-line argumentsenv: Environment variables (supports ${VAR} and ${VAR:-default} expansion)my-api-server, github-tools)If .mcp.json already exists:
mcpServers objectAfter setup, always inform the user:
Important: Claude Code must be restarted for the MCP server to load. Please restart your Claude Code session (close and reopen, or use the restart command) to activate the new MCP server. After restarting, you can verify the server is loaded by using /mcp command.{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["/home/user/my-mcp-server/dist/index.js"],
"env": {}
}
}
}{
"mcpServers": {
"my-ts-server": {
"command": "npx",
"args": ["tsx", "/home/user/my-mcp-server/src/index.ts"],
"env": {}
}
}
}{
"mcpServers": {
"python-server": {
"command": "python3",
"args": ["/home/user/mcp-server/server.py"],
"env": {
"PYTHONPATH": "/home/user/mcp-server"
}
}
}
}{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/allowed/path"],
"env": {}
}
}
}If the user reports issues after restart:
npm install or pip install in server directorySuggest running /mcp after restart to check server status.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.