mcp2cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp2cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn any MCP server or OpenAPI spec into a CLI at runtime. No codegen.
# Run directly (no install needed)
uvx mcp2cli --help
# Or install
pip install mcp2cli--list<command> --help# MCP over HTTP
mcp2cli --mcp https://mcp.example.com/sse --list
mcp2cli --mcp https://mcp.example.com/sse create-task --help
mcp2cli --mcp https://mcp.example.com/sse create-task --title "Fix bug"
# MCP over stdio
mcp2cli --mcp-stdio "npx @modelcontextprotocol/server-filesystem /tmp" --list
mcp2cli --mcp-stdio "npx @modelcontextprotocol/server-filesystem /tmp" read-file --path /tmp/hello.txt
# OpenAPI spec (remote or local, JSON or YAML)
mcp2cli --spec https://petstore3.swagger.io/api/v3/openapi.json --list
mcp2cli --spec ./openapi.json --base-url https://api.example.com list-pets --status availablemcp2cli [global options] <subcommand> [command options]
Source (mutually exclusive, one required):
--spec URL|FILE OpenAPI spec (JSON or YAML, local or remote)
--mcp URL MCP server URL (HTTP/SSE)
--mcp-stdio CMD MCP server command (stdio transport)
Options:
--auth-header K:V HTTP header (repeatable, value supports env:/file: prefixes)
--base-url URL Override base URL from spec
--transport TYPE MCP HTTP transport: auto|sse|streamable (default: auto)
--env KEY=VALUE Env var for stdio server process (repeatable)
--oauth Enable OAuth (authorization code + PKCE flow)
--oauth-client-id ID OAuth client ID (supports env:/file: prefixes)
--oauth-client-secret S OAuth client secret (supports env:/file: prefixes)
--oauth-scope SCOPE OAuth scope(s) to request
--cache-key KEY Custom cache key
--cache-ttl SECONDS Cache TTL (default: 3600)
--refresh Bypass cache
--list List available subcommands
--pretty Pretty-print JSON output
--raw Print raw response body
--toon Encode output as TOON (token-efficient for LLMs)
--version Show versionSubcommands and flags are generated dynamically from the source.
# API key header (literal value)
mcp2cli --spec ./spec.json --auth-header "Authorization:Bearer tok_..." list-items
# Secret from environment variable (avoids exposing in process list)
mcp2cli --mcp https://mcp.example.com/sse \
--auth-header "Authorization:env:API_TOKEN" \
search --query "test"
# Secret from file
mcp2cli --mcp https://mcp.example.com/sse \
--auth-header "x-api-key:file:/run/secrets/api_key" \
search --query "test"# Authorization code + PKCE (opens browser)
mcp2cli --mcp https://mcp.example.com/sse --oauth --list
# Client credentials (machine-to-machine)
mcp2cli --mcp https://mcp.example.com/sse \
--oauth-client-id "my-id" --oauth-client-secret "my-secret" \
search --query "test"
# With scopes
mcp2cli --mcp https://mcp.example.com/sse --oauth --oauth-scope "read write" --listTokens are cached in ~/.cache/mcp2cli/oauth/ and refreshed automatically.
# Default: tries streamable HTTP, falls back to SSE
mcp2cli --mcp https://mcp.example.com/sse --list
# Force SSE transport (skip streamable HTTP attempt)
mcp2cli --mcp https://mcp.example.com/sse --transport sse --list
# Force streamable HTTP (no SSE fallback)
mcp2cli --mcp https://mcp.example.com/sse --transport streamable --listecho '{"name": "Fido", "tag": "dog"}' | mcp2cli --spec ./spec.json create-pet --stdinmcp2cli --mcp-stdio "node server.js" --env API_KEY=sk-... --env DEBUG=1 search --query "test"Specs and MCP tool lists are cached in ~/.cache/mcp2cli/ (1h TTL). Local files are never cached.
mcp2cli --spec https://api.example.com/spec.json --refresh --list # Force refresh
mcp2cli --spec https://api.example.com/spec.json --cache-ttl 86400 --list # 24h TTLmcp2cli --mcp https://mcp.example.com/sse --toon list-tagsBest for large uniform arrays — 40-60% fewer tokens than JSON.
When the user asks to create a skill from an MCP server or OpenAPI spec, follow this workflow:
uvx mcp2cli --mcp https://target.example.com/sse --list uvx mcp2cli --mcp https://target.example.com/sse <command> --help uvx mcp2cli --mcp https://target.example.com/sse <command> --param value--mcp, --mcp-stdio, or --spec) and URL--list and --help discovery pattern for commands not coveredThe generated skill should use mcp2cli as its execution layer — the agent runs uvx mcp2cli ... commands rather than making raw HTTP/MCP calls.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.