Mcpgo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcpgo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Manage your Claude Code MCPs by talking to Claude — list, restart, wrap, and more.
Works everywhere Claude Code works, including Remote Control where /mcp isn't available.
npm install -g @exfil/mcpgo
claude mcp add mcpgo --scope user -- mcpgoRequirements: Node.js ≥ 18
Claude Code's Remote Control mode has no access to /mcp. That means you can't list, restart, or manage MCP servers remotely — unless you have mcpgo.
Because mcpgo is itself an MCP server, it's available everywhere Claude Code is:
"list my mcps"
"restart github"
"check postgres health"No /mcp UI needed.
Claude Code connects to stdio MCP servers via pipes it creates at launch. If a server crashes or you want to restart it, Claude Code marks it as failed with no auto-recovery.
mcpgo solves this with a wrapper: a long-lived process that sits between Claude Code and your MCP. Claude Code talks to the wrapper (which stays alive), and the wrapper spawns the real server as a child — auto-respawning it whenever it's killed.
Wrapping is optional — you can use mcpgo just for listing, adding, or removing MCPs without wrapping anything. Wrapping is only needed if you want reliable restarts without touching /mcp.
One-time setup per MCP:
wrap_mcp_stdio — wraps the target MCP in config/mcp)restart_mcp_process anytimeAfter setup:
"restart github" → instant, wrapper auto-respawns the child, Claude Code stays connected
"restart postgres" → sameIf you ever want to undo wrapping, use unwrap_mcp_stdio to restore the original config.
#### wrap_mcp_stdio Wrap a Claude Code stdio MCP for reliable restarts.
"wrap github"
"wrap postgres"#### unwrap_mcp_stdio Restore a wrapped MCP to its original config.
"unwrap github"
"unwrap postgres"#### restart_mcp_process Restart a wrapped MCP's child process — wrapper auto-respawns it, Claude Code stays connected.
"restart github"
"restart postgres"#### check_mcp_health Check if an MCP is configured, wrapped, and its process is running.
"check github health"
"is postgres running?"#### wrap_codex_mcp_stdio Wrap a Codex CLI MCP from ~/.codex/config.toml.
"wrap my codex mcp called postgres"#### restart_codex_mcp_process Restart a wrapped Codex CLI MCP.
"restart the codex postgres"#### list_all_mcps List all configured MCP servers.
"list my mcps"
"what mcps do I have?"#### add_mcp Add a new MCP server to ~/.claude.json.
"add an mcp called my-tool that runs python server.py"#### remove_mcp Remove an MCP server.
"remove the my-tool mcp"#### configure_mcp Update an existing MCP server's config fields.
"change github's command to python3"#### get_mcp_details Get full config details for a specific MCP.
"show me the github config"
"get details for postgres"When you call wrap_mcp_stdio "github", the config entry changes from:
{ "command": "python", "args": ["server.py"] }to:
{
"command": "node",
"args": [
"/path/to/wrapper.js",
"--name", "github",
"--pidfile", "...",
"--env-allowlist", "PATH,Path,PATHEXT,HOME,USERPROFILE,SystemRoot,...",
"--",
"python", "server.py"
]
}The wrapper:
env keys) instead of inheriting Claude Code's full environmentrestart_mcp_process reads the pidfile and kills the child. The wrapper respawns it — Claude Code never sees a disconnect.
unwrap_mcp_stdio reverses this — it restores the original command from the args after -- and removes the pidfile.
When you wrap an MCP, mcpgo copies wrapper.js to a stable user-data location and writes that path into ~/.claude.json. This means the config survives npx cache clears and mcpgo version upgrades — the wrapper won't disappear from under you.
%LOCALAPPDATA%\mcpgo\wrapper.js~/.mcpgo/wrapper.jsRe-running wrap_mcp_stdio on an already-wrapped MCP refreshes the wrapper copy in place.
%LOCALAPPDATA%\mcpgo\pids\<name>.pid$TMPDIR/mcpgo/pids/<name>.pid/mcp disconnect + reconnect) to take effect — Claude Code caches config in memoryrestart_mcp_process works best on wrapped MCPs; for unwrapped ones it kills the process but you'll need to reconnect manually via /mcpenv keys) rather than the full Claude Code environment. Re-run wrap_mcp_stdio on previously-wrapped MCPs to pick up this defaultlist_all_mcps and get_mcp_details redact env values by default so the tools can't be used to exfiltrate secrets stored in MCP configs — pass show_env_values: true when you actually need to see them~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.