Modusop Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Modusop Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Stdio→HTTP proxy for [Modus Brain](https://brain.modusop.app) — gives any MCP-aware AI client (Claude Desktop, Cursor, Cline, Continue.dev, etc.) access to your ModusOp organisation's knowledge base.
This package is a thin proxy. It speaks the MCP stdio transport on one end and forwards every JSON-RPC request to Modus Brain's HTTP MCP endpoint on the other.
All tool implementations live in Modus Brain itself — when ModusOp ships a new Brain tool, every install of this package picks it up automatically on the next request. No re-publish, no version bump, no user action needed.
If your AI client speaks remote HTTP MCP natively, you don't need this package at all — point it directly at https://brain.modusop.app/mcp. This package exists for clients that only speak stdio.
Sign in at brain.modusop.app, generate a token labelled for the device or person who'll use it, copy the plaintext value (you only see it once).
Claude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"modusop-brain": {
"command": "npx",
"args": ["-y", "@modusop/mcp-server"],
"env": {
"MODUSOP_API_TOKEN": "mo_brain_..."
}
}
}
}Cursor / Cline / Continue.dev — .cursor/mcp.json (or the equivalent):
{
"mcpServers": {
"modusop-brain": {
"command": "npx",
"args": ["-y", "@modusop/mcp-server"],
"env": {
"MODUSOP_API_TOKEN": "mo_brain_..."
}
}
}
}Quit and reopen. The Modus Brain tools should appear in the MCP indicator within a few seconds.
| Variable | Required | Default | Notes |
|---|---|---|---|
MODUSOP_API_TOKEN | yes | — | Brain token from brain.modusop.app |
MODUSOP_BRAIN_URL | no | https://brain.modusop.app/mcp | Override only for local Brain development |
Whatever Brain exposes — tools/list reflects the current set. As of v1.0.0:
whoami — identify the user + org this token is scoped tosearch_knowledge — semantic search over the org KBget_chunk — deep-dive on a specific search resultlist_recent — recently indexed KB itemsget_client_brief — synthesised client one-pageradd_observation — append a noteadd_decision — record context + decision + rationalelink_observation — typed link between two chunksrequest_delete — admin-gated removalVersions 0.x of this package implemented tools in-package and talked to ModusOp's older /api/mcp endpoint with an MO API token from /settings/api-tokens. v1.0.0 retires that path:
MODUSOP_API_TOKEN with the new tokencommand, same args, same env var nameOld tools (search_projects, search_clients, get_client_context, start_timer, etc.) are no longer present in this package's catalogue. They've been retired in favour of Brain's tools, which cover the same surface plus knowledge-base search and append-writes. If you need the old tool set, pin to @modusop/[email protected] — it still works but won't receive updates.
git clone https://github.com/jwwd-repos/modusop-mcp.git
cd modusop-mcp
npm install
MODUSOP_API_TOKEN=... npm run devThe proxy reads JSON-RPC on stdin and writes responses on stdout, so test it manually with:
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami"}}' \
| MODUSOP_API_TOKEN=... npm run devSee LICENSE.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.