Schematic Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Schematic Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that connects AI assistants to Schematic -- the platform for managing billing, plans, features, and entitlements.
Use this server to let Claude, Cursor, or any MCP-compatible client look up companies, manage plan entitlements, set overrides, create features, and more -- all through natural language.
#### Option 1: Using Claude CLI (Recommended)
npm i @schematichq/schematic-mcp claude mcp add --transport stdio --scope project schematic --env SCHEMATIC_API_KEY=your-secret-api-key-here -- npx @schematichq/schematic-mcpReplace your-secret-api-key-here with your actual Schematic API key.
#### Option 2: Manual Configuration
##### Claude Desktop / Claude Code
Add to your Claude config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"schematic": {
"command": "npx",
"args": ["-y", "@schematichq/schematic-mcp"],
"env": {
"SCHEMATIC_API_KEY": "your-secret-api-key-here"
}
}
}
}Add to your Cursor MCP config (Settings > MCP Servers, or edit the file directly):
~/.cursor/mcp.json~/.cursor/mcp.json%USERPROFILE%\.cursor\mcp.json{
"mcpServers": {
"schematic": {
"command": "npx",
"args": ["-y", "@schematichq/schematic-mcp"],
"env": {
"SCHEMATIC_API_KEY": "your-secret-api-key-here"
}
}
}
}After adding the config, restart Cursor for the server to be picked up.
The server needs a Schematic secret API key (not the publishable key). It checks two sources in order:
SCHEMATIC_API_KEY~/.schematic-mcp/config.json{
"apiKey": "your-secret-api-key-here"
}You can find your secret API key in the Schematic dashboard.
| Tool | Description |
|---|---|
get_company | Look up a company by ID, name, Stripe customer ID, or custom key. Returns details, plan, trial status, and links. |
get_company_plan | Get the plan a company is currently on. |
get_company_trial_info | Check if a company is on a trial and when it ends. |
count_companies_on_plan | Count how many companies are on a specific plan. |
link_stripe_to_schematic | Find the Schematic company for a Stripe customer ID, or vice versa. |
| Tool | Description |
|---|---|
list_company_overrides | List overrides by company or by feature. |
set_company_override | Set or update an override for a company on a specific feature. Supports boolean (on/off), numeric, and unlimited values. |
remove_company_override | Remove an override so the company falls back to plan entitlements. |
| Tool | Description |
|---|---|
list_plans | List all plans. |
create_plan | Create a new plan. |
add_entitlements_to_plan | Add feature entitlements to a plan. Auto-detects feature type and sets appropriate value types. |
| Tool | Description |
|---|---|
list_features | List all features. |
create_feature | Create a new feature flag. Supports boolean (on/off), event-based (metered), and trait-based types. Automatically creates an associated flag. |
Once configured, try asking your AI assistant:
# Install dependencies
yarn install
# Build
yarn build
# Run in development mode (auto-recompile on changes)
yarn dev
# Run tests
yarn testMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.