Security linter for Model Context Protocol (MCP) configuration files.
michaelko/mcp-config-lintMITAug 2, 2026
Score41
How is this score calculated?
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Persistent code-knowledge memory for AI chats. An MCP server that caches a codebase's structure and summaries in a local SQLite "brain" so sessions query it instead of re-reading files — token-cheap, 100% local.
A Model Context Protocol (MCP) server that provides context optimization tools for AI coding assistants including GitHub Copilot, Cursor AI, Claude Desktop, and other MCP-compatible assistants enabling them to extract targeted information rather than processing large terminal outputs and files wasting their context.
MCP Server implemented in JavaScript using Node.js that demonstrates how to build an MCP server with a custom prompt and custom tools, including one that loads an environment variable from a configuration file, to integrate seamlessly with AI-assisted environments like Cursor IDE.
WinReach — give your AI agent its own Windows machine. Remote PowerShell, file transfer, screenshots, and full desktop control (computer use) over HTTP, secured with per-user keys, roles, command policies, mTLS, and an audit log. A Model Context Protocol (MCP) server for Windows.
Instant Generative UI MCP Server for AI Agents. Turn static AI chats into live, hot-reloading browser experiences with local file access. Tailwind, Alpine.js, and WASM-powered data parsers.
AI Coding Assistant powered by MCP server : it reads your code locally to provide truly context-aware help, explanations, and suggestions directly related to your files. Code smarter, locally or using external API..
- A Vibe Coded Project - Connect Claude Code to local LLMs through LM Studio APIs via MCP bridge. Multi-model support, hot reload, dynamic MCP discovery. Access filesystem, database, web, git, and more. Zero API costs, full privacy, test coverage. Inspired by infinitimeless/LMStudio-MCP.
Your AI-powered coding companion for Claude Desktop. MCP server with 23+ dev tools for file operations, git integration, code analysis, and more. Works with any project on your system.
Local-first codebase knowledge-graph MCP server for AI agents (Claude Code, Cursor, Codex). Symbol graph over MCP so agents stop wasting tokens re-scanning files. Watch-first · 21 languages · faster, leaner & more accurate than the incumbent.
MCP-Powered Agent Ecosystem — Multiple MCP servers (Filesystem, Memory, Jira, Slack, GitHub) orchestrated by an Agent Gateway. Built with FastMCP, LangGraph, and Docker. Production-grade, modular, and extensible.
High-performance MCP server for log analysis. Give Claude the ability to analyze massive log files with SIMD-accelerated parsing. 5-50x faster than awk for aggregations.
Omnex is not a search tool. It is the memory substrate for the agentic era — the data layer that sits beneath AI agents, AI operating systems, and human-AI interaction. What exists today (file systems, folder hierarchies, manual search) is legacy. Omnex is the foundation of what comes next.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
How is this score calculated?
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
How is this score calculated?
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.
Review the upstream source before running this command.
Weighted across six dimensions, scored 0-100.
Provenance (25): listed in an official or curated registry.
Installability (25): a runnable install command beats a declared transport, which beats a source checkout.
Maintenance (20): recency of the last push; archived entries score zero here.
Adoption (20): repository stars on a log curve.
Documentation (10) and description quality (10): parsed manifest or SKILL.md frontmatter, and a real description rather than a placeholder.
Dimensions a source cannot supply — registries publish no stars or license — are excluded from the entry's own average instead of counted as zero, so entries stay comparable across sources.
Security signals subtract up to 20. Scores are recomputed on every daily ingest.