Docstar Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Docstar Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Remote MCP server (Streamable HTTP) that lets AI clients work with a DocStar workspace. It runs as a Cloudflare Worker and is a thin layer over the DocStar API (hitman-api); it never touches the database. Users sign in with OAuth 2.0, so no API token is needed, and the user's existing DocStar permissions apply to everything the server does.
| Tool | What it does |
|---|---|
list_collections | Collections the signed-in user can access |
list_pages | Flat page list of a collection (use parentId for the tree) |
get_page | A page with its content as Markdown |
search_docs | Semantic search in a collection |
create_page | New draft page from Markdown |
update_page | Change name and/or content (Markdown); page goes back to draft |
publish_page | Publish a page (its parent must already be published) |
The server uses OAuth 2.0. The first time a client connects, it opens a browser window where you sign in to DocStar and approve access. There are no API keys to create or paste, and no credentials are stored in this repository.
claude mcp add --transport http docstar-workspace https://mcp.docstar.io/mcpThen run /mcp inside Claude Code and choose docstar-workspace to complete the browser sign-in.
Open MCP Servers → Configure MCP Servers and add this to cline_mcp_settings.json:
{
"mcpServers": {
"docstar": {
"type": "streamableHttp",
"url": "https://mcp.docstar.io/mcp",
"disabled": false,
"autoApprove": []
}
}
}type must be streamableHttp (the server has no SSE endpoint). Cline opens the DocStar sign-in in your browser on first connect. Agent-driven install steps are in llms-install.md.
npm install
DOCSTAR_API_URL=http://localhost:2000 npm run dev # http://localhost:3100/mcpThe local server also needs the organization: send an X-Docstar-Org-Id header or set DOCSTAR_ORG_ID.
The server is listed in the official MCP Registry as io.github.swayammaheshwari/docstar-mcp; server.json is the listing. The logo shown there comes from icons in server.json (an HTTPS URL; the server also reports it in its MCP serverInfo). To publish a change, bump version in server.json, then:
mcp-publisher login github
mcp-publisher publishcreate_collection, resources (docstar://page/{id}), prompts, higher-level workflow toolsMIT - see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.