Mockzilla Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mockzilla Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Mockzilla - an open-source API mock server for OpenAPI specifications. Let Claude Code, Claude Desktop, Cursor, or Gemini CLI install Mockzilla, inspect OpenAPI specs, and spin up realistic local mock APIs in seconds. No account required for local use.
Source: github.com/mockzilla/mockzilla-mcp
@mockzilla/mcp exposes two planes of tools to your MCP client.
Works entirely on your machine. Nothing leaves the user's box.
From an agent you can:
MOCKZILLA_TOKEN)When MOCKZILLA_TOKEN is set, the bridge forwards extra tools to mockzilla.org's MCP endpoint.
Agents can then:
Without a token, only the local plane is exposed. Agents can still help users explore Mockzilla and run local mocks before they sign up.
You can use these directly from Claude Code, Claude Desktop, Cursor, or Gemini CLI once mockzilla is configured as an MCP server.
https://example.com/openapi.yaml expose?"POST /checkout to return a 402 response."MOCKZILLA_TOKEN)stripe-test and give me the live URL."One-liner, no config file editing:
claude mcp add -s user mockzilla -- npx -y @mockzilla/mcp@latest-s user installs for your user account (available in every project).-s user to scope to the current project only.Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"mockzilla": {
"command": "npx",
"args": ["-y", "@mockzilla/mcp@latest"]
}
}
}Restart Claude Desktop after editing.
Easiest: Settings -> MCP Servers -> Add new MCP server and fill in:
mockzillanpx-y @mockzilla/mcp@latestOr edit ~/.cursor/mcp.json directly:
{
"mcpServers": {
"mockzilla": {
"command": "npx",
"args": ["-y", "@mockzilla/mcp@latest"]
}
}
}Restart Cursor after editing.
One-liner, no manual JSON editing:
gemini mcp add -s user mockzilla npx -y @mockzilla/mcp@latest-s user writes to ~/.gemini/settings.json (available in every project).-s user (or use -s project) to scope to the current directory's .gemini/settings.json.Or edit the settings file directly:
{
"mcpServers": {
"mockzilla": {
"command": "npx",
"args": ["-y", "@mockzilla/mcp@latest"]
}
}
}Restart the Gemini CLI after editing.
@latest?Without @latest, npx caches the first resolved version and won't pick up new publishes. Pinning to @latest makes npx re-check the registry on every spawn, so a Claude / Cursor / Gemini restart is enough to upgrade. Trade-off: ~200 ms extra startup time.
These tools are always available and never leave the user's machine.
Resolve Mockzilla on this machine: system PATH -> bridge cache -> go run invocation. Returns install options if nothing matches.
Install Mockzilla into ~/.cache/mockzilla-mcp/. Methods: download (prebuilt from GitHub releases, default), go-install, go-run. Never touches system PATH.
Report the bridge's version, check npm for newer publishes, and surface upgrade steps.
Summarise an OpenAPI spec without serving it: {title, version, openapi_version, endpoint_count, paths}.
List available Mockzilla doc topics.
Return the full markdown for one topic.
Keyword search across all docs; returns top sections with snippets.
Start a portable mock server on a free port. Accepts a spec file, directory, or public https URL. Returns {url, port, pid, services}.
Stop a server started by serve_locally.
Quickly mock a single HTTP endpoint without an OpenAPI spec. Writes a static response into the managed mocks dir and (re)starts the shared server.
List all endpoints currently mocked, plus the running server's URL and the Mockzilla UI URL.
Wipe all mocks and stop the managed server.
When MOCKZILLA_TOKEN is set, @mockzilla/mcp forwards hosted tools to mockzilla.org's MCP endpoint.
At the time of writing, the hosted surface includes:
get_contextlist_simslist_catalog_productsdeploy_mock_from_catalogdeploy_mock_from_specdeploy_mock_from_urlwait_for_deployRefer to the hosted server's docs or the MCP registry entry for the live tool list.
| Env var | Default | Purpose |
|---|---|---|
MOCKZILLA_TOKEN | unset | Bearer token (mz_oauth_* or mz_*). Hosted tools are hidden when unset. |
MOCKZILLA_MCP_URL | https://platform.mockzilla.org/mcp/ | Override the hosted endpoint (staging, self-hosted). |
MOCKZILLA_BIN_VERSION | matches bridge version | Pin a specific Mockzilla CLI version for install_cli to fetch. |
MOCKZILLA_MANAGED_PORT | 2200 | Preferred port for the mock_endpoint server. Falls back to a kernel-picked port if busy. Avoid 3000 (Next.js/React), 5173 (Vite), 8080. Try 2400 or 4444 if 2200 is unavailable. |
MOCKZILLA_DOCS_DIR | unset | Read docs from this local directory instead of GitHub (useful when editing docs). |
MOCKZILLA_DOCS_REPO | mockzilla/mockzilla | Override the GitHub repo to fetch docs from. |
MOCKZILLA_DOCS_BRANCH | main | Override the branch to fetch docs from. |
The bridge keeps everything under ~/.cache/mockzilla-mcp/:
~/.cache/mockzilla-mcp/
├── bin/mockzilla # downloaded or go-installed binary
├── config.json # { method, version, invocation? }
└── mocks/ # mock_endpoint persists static endpoints here
└── static/
└── <service>/<path>/<method>/index.<ext>rm -rf ~/.cache/mockzilla-mcp fully resets the bridge (binary + all mocked endpoints).rm -rf ~/.cache/mockzilla-mcp/mocks.PATH is never touched, so reset doesn't affect a separate brew install of Mockzilla.Recommended way to stay current:
@mockzilla/mcp@latest in your MCP client config so npx re-checks the registry on every spawn.bridge_status and tell me if @mockzilla/mcp is up to date."If it's stale, run:
npx clear-npx-cache @mockzilla/mcpand restart your MCP client.
The Mockzilla CLI version is pinned by the bridge (via MOCKZILLA_VERSION in lib/install.js). Updating the bridge updates the pin; the next install_cli call brings the CLI itself up to date.
See CLAUDE.md for project conventions and a walkthrough of adding a new tool.
The bridge has two registries to keep in sync: npm (@mockzilla/mcp) and the MCP registry (server.json). Skipping the second one leaves discovery clients pinned to the previous tarball.
version in package.json. make publish-allThis will:
npm publish the new tarball.server.json.mcp-publisher publish against the MCP registry.server.json bump.If you only want one side:
make publish for npm only.make publish-mcp for the MCP registry only (server.json is always re-synced from package.json first).mcp-publisher must be on PATH (brew install mcp-publisher or follow the installation docs).
Copyright © 2026-present
Licensed under the MIT License
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.