mcplexer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcplexer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCPlexer is a stdio MCP proxy. It connects to ONE upstream MCP server, lists its tools, rewrites each tool's name and description, and forwards tools/call requests to the original upstream tool after stripping the prefix.
The point: MCP clients key tools by name. If you run the same server twice (two Google accounts, two GitHub orgs), both expose get-calendar-events and the client can't tell them apart. MCPlexer gives each instance a distinct prefix:
get-calendar-eventspersonal:get-calendar-events and work:get-calendar-eventsNote: this is one of multiple instances of this MCP, labeled "Personal".The call personal:get-calendar-events is forwarded to the upstream's plain get-calendar-events. The upstream server never knows it was wrapped.
Reach for MCPlexer when the user wants two or more live instances of the same MCP server. Common phrasings: "add my work Google account too", "I want both personal and work GitHub", "run the Slack MCP for two workspaces", "the tools clash when I add the second one".
Do NOT use it for running two different servers — distinct servers already have distinct tool names, so prefixing adds noise for no benefit. It's specifically a collision-avoidance and labeling tool.
MCPlexer must be runnable as a command. Two options — pick based on the user's setup:
.mcp.json that reference the mcplexer command): npm install --global @oztamir/mcplexer
# or: pnpm add --global @oztamir/mcplexernpx directly in the config (see the npx variant below). Good when the user can't or won't install globally.Confirm with mcplexer --help (global) before editing configs that depend on the global command.
MCPlexer wraps either a local upstream (a command it launches over stdio) or a remote upstream (an HTTP/SSE URL). The shape of the args differs:
| Upstream kind | How MCPlexer reaches it |
|---|---|
| Local command (stdio) | Put the full upstream command after -- |
| Remote endpoint | Pass --url <endpoint>; auth via --header / --header-env |
--prefix <name> is always required. --label <label> is optional and defaults to the prefix; it's the human-readable text in the description note, so set it when you want something nicer than the raw prefix (e.g. label Work for prefix work).
Use this when the user already has one instance working (or none yet) and wants to add another copy of the same server under its own label.
the server, plus any per-instance env (account selector, API key, etc.).
Local upstream — the original command goes after --. The wrapper passes its environment through to the upstream, so per-instance env still works:
{
"mcpServers": {
"google-personal": {
"command": "mcplexer",
"args": [
"--prefix", "personal",
"--label", "Personal",
"--",
"npx", "-y", "@example/google-workspace-mcp"
],
"env": { "GOOGLE_ACCOUNT": "personal" }
},
"google-work": {
"command": "mcplexer",
"args": [
"--prefix", "work",
"--label", "Work",
"--",
"npx", "-y", "@example/google-workspace-mcp"
],
"env": { "GOOGLE_ACCOUNT": "work" }
}
}
}No global install (npx variant) — command is npx, and MCPlexer's own args come after the package name. The upstream command still goes after --:
{
"mcpServers": {
"google-personal": {
"command": "npx",
"args": [
"-y", "@oztamir/mcplexer",
"--prefix", "personal",
"--label", "Personal",
"--",
"npx", "-y", "@example/google-workspace-mcp"
]
}
}
}Remote upstream — use --url. By default MCPlexer tries Streamable HTTP then falls back to SSE. Read header values from env so secrets stay out of the args:
{
"mcpServers": {
"calendar-work-remote": {
"command": "mcplexer",
"args": [
"--prefix", "work",
"--label", "Work",
"--url", "https://mcp.example.com/mcp",
"--header-env", "Authorization=WORK_MCP_AUTH"
],
"env": { "WORK_MCP_AUTH": "Bearer replace-me" }
}
}
}Use this when the user already has a working single entry for a server and wants to bring it under MCPlexer (usually because they're about to add a second copy).
The transformation is mechanical. For a local entry, MCPlexer slots in front of the existing command, and the old command + args move to after --. The env stays at the top level — the wrapper passes it through unchanged.
Before:
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": { "GITHUB_TOKEN": "ghp_personal" }
}
}
}After (prefix personal, label Personal):
{
"mcpServers": {
"github-personal": {
"command": "mcplexer",
"args": [
"--prefix", "personal",
"--label", "Personal",
"--",
"npx", "-y", "@modelcontextprotocol/server-github"
],
"env": { "GITHUB_TOKEN": "ghp_personal" }
}
}
}For a remote entry (one that used a url/type: http style server), drop the URL into --url and translate any auth headers into --header-env (preferred, keeps the secret in env) or --header for non-secret literals.
Migration checklist:
-- (local), or move the URL to--url (remote). Don't alter the upstream invocation itself.
entry to a prefix (rather than leaving it bare) keeps the two symmetric and makes tool names predictable — personal:* and work:*, not * and work:*.
(get-issue → personal:get-issue). Any saved prompts, slash commands, or automations that reference the old names must be updated. Call this out — it's the one thing that silently breaks.
github → github-personal) so the configreads clearly, though only the prefix affects tool names.
_, or - (it becomes part ofevery tool name). Keep it short and lowercase: personal, work, acme.
the prefix; set it for nicer casing (Personal, Acme Corp).
: (personal:get-issue). Override with--separator only if a client mangles colons; __ is a safe alternative.
After editing the config, have the user restart their MCP client and confirm:
personal:…, work:…).If a tool call fails with a prefix/separator error, the call name didn't start with <prefix><separator> — check the client is using the rewritten names, not the upstream ones.
For the complete option list (--note, --transport, repeatable headers, edge cases) see references/cli-reference.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.