Iris — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Iris (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Know whether your AI agents are actually good enough to ship. Iris is an open-source MCP server that scores output quality, catches safety failures, and enforces cost budgets across all your agents. Any MCP-compatible agent discovers and uses it automatically — no SDK, no code changes.

Your agents are running in production. Infrastructure monitoring sees 200 OK and moves on. It has no idea the agent just:
Iris evaluates all of it.
| Trace Logging | Hierarchical span trees with per-tool-call latency, token usage, and cost in USD. Stored in SQLite, queryable instantly. |
| Output Evaluation | 13 built-in rules across 4 categories: completeness, relevance, safety, cost. PII detection (10 patterns: SSN, credit card, phone, email, IBAN, DOB, MRN, IP, API key, passport), prompt injection (13 patterns), stub-output detection, hallucination markers (17 hedging phrases + fabricated-citation heuristic). Add custom rules with Zod schemas. |
| Cost Visibility | Aggregate cost across all agents over any time window. Set budget thresholds. Get flagged when agents overspend. |
| Web Dashboard | Real-time dark-mode UI with trace visualization, eval results, and cost breakdowns. |
Requires Node.js 20 or later. Check with node --version.
Add Iris to your MCP config. Works with Claude Desktop, Cursor, Windsurf, and any MCP-compatible agent.
{
"mcpServers": {
"iris-eval": {
"command": "npx",
"args": ["@iris-eval/mcp-server"]
}
}
}That's it. Your agent discovers Iris and starts logging traces automatically.
Iris ships with a real-time web dashboard showing traces, eval results, cost breakdowns, and rule pass-rates. It's off by default so the MCP server stays lightweight — flip it on with a flag.
{
"mcpServers": {
"iris-eval": {
"command": "npx",
"args": ["@iris-eval/mcp-server", "--dashboard"]
}
}
}Then open http://localhost:6920 after your agent runs a trace. The same dashboard is available via CLI:
npx @iris-eval/mcp-server --dashboard<details> <summary><strong>Setup by tool</strong></summary>
#### Claude Desktop
Edit your MCP config file:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonAdd the JSON config above, then restart Claude Desktop.
#### Claude Code
claude mcp add --transport stdio iris-eval -- npx @iris-eval/mcp-serverThen restart the session (/clear or relaunch) for tools to load.
Windows note: Do not usecmd /cwrapper — it causes path parsing issues. Thenpxcommand works directly.
#### Cursor / Windsurf
Add to your workspace .cursor/mcp.json or global MCP settings using the JSON config above.
</details>
# Global install (recommended for persistent data and faster startup)
npm install -g @iris-eval/mcp-server
iris-mcp --dashboard
# Docker
docker run -p 3000:3000 -v iris-data:/data ghcr.io/iris-eval/mcp-serverTip: Global install (npm install -g) stores traces persistently at~/.iris/iris.db. Withnpx, traces persist in the same location, but startup is slower due to package resolution.
Iris registers nine tools that any MCP-compatible agent can invoke — full rule + trace lifecycle + LLM-as-judge + semantic citation verification:
evaluate_output of that categoryIRIS_ANTHROPIC_API_KEY or IRIS_OPENAI_API_KEY) — Iris doesn't proxy or relay LLM calls.evaluate_with_llm_judge.When IRIS_OTEL_ENDPOINT is configured, log_trace calls also emit a best-effort OTLP/HTTP JSON export to any OpenTelemetry collector (Jaeger, Grafana Tempo, Datadog OTLP, Honeycomb, etc). See docs/otel-integration.md.
Full tool schemas and configuration: iris-eval.com
Self-hosted Iris runs on your machine with SQLite. As your team's eval needs grow, the cloud tier adds PostgreSQL, team dashboards, alerting on quality regressions, and managed infrastructure.
Join the waitlist to get early access.
<details> <summary><strong>Configuration & Security</strong></summary>
| Flag | Default | Description |
|---|---|---|
--transport | stdio | Transport type: stdio or http |
--port | 3000 | HTTP transport port |
--db-path | ~/.iris/iris.db | SQLite database path |
--config | ~/.iris/config.json | Config file path |
--api-key | — | API key for HTTP authentication |
--dashboard | false | Enable web dashboard |
--dashboard-port | 6920 | Dashboard port |
| Variable | Description |
|---|---|
IRIS_TRANSPORT | Transport type (stdio or http) |
IRIS_PORT | HTTP transport port |
IRIS_HOST | HTTP transport host (default 127.0.0.1) |
IRIS_DB_PATH | SQLite database path |
IRIS_LOG_LEVEL | Log level: debug, info, warn, error |
IRIS_DASHBOARD | Enable web dashboard (true/false) |
IRIS_DASHBOARD_PORT | Dashboard port (default 6920) |
IRIS_API_KEY | API key for HTTP authentication |
IRIS_ALLOWED_ORIGINS | Comma-separated allowed CORS origins |
CLI flags take precedence over environment variables when both are set.
When using HTTP transport, Iris includes:
# Production deployment
iris-mcp --transport http --port 3000 --api-key "$(openssl rand -hex 32)" --dashboard</details>
<details> <summary><strong>Troubleshooting</strong></summary>
ERR_MODULE_NOT_FOUNDYou may have a cached older version. Clear the npx cache and retry:
npx --yes @iris-eval/mcp-server@latestOr install globally to avoid cache issues entirely:
npm install -g @iris-eval/mcp-server@latestMCP tools only load at session start. After adding iris-eval, restart the session with /clear or relaunch the terminal.
Verify which version is running:
npx @iris-eval/mcp-server --help
# Shows "Iris — MCP-Native Agent Eval Server vX.Y.Z"# If using npx (clears cache and fetches latest)
npx --yes @iris-eval/mcp-server@latest
# If installed globally
npm update -g @iris-eval/mcp-serverIris requires Node.js 20 or later. Node 18 reached EOL in April 2025 and is not supported.
node --version # Must be v20.x or v22.x+cmd /c not neededClaude Code's /doctor may suggest wrapping npx with cmd /c. This is not needed and causes path parsing issues. Use npx directly:
# Correct
claude mcp add --transport stdio iris-eval -- npx @iris-eval/mcp-server
# Wrong (causes /c to be parsed as a path)
claude mcp add --transport stdio iris-eval -- cmd /c "npx @iris-eval/mcp-server"</details>
If Iris is useful to you, consider starring the repo — it helps others find it.
MIT Licensed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.