Kitsune MCP

Name: Kitsune MCP
Author: kaiser-data

by kaiser-dataversion 0.22.7i★ –iRuns on your computer

Registry nameio.github.kaiser-data/kitsune-mcp

Install

Overview

Description from the maker (original English)

Hot-reload for MCP servers + mount any community server mid-session, Docker optional. No restarts.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Developer tools
You need to fill in: SMITHERY_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: SMITHERY_API_KEY

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "kitsune": {
      "command": "npx",
      "args": [
        "-y",
        "kitsune-mcp"
      ],
      "env": {
        "SMITHERY_API_KEY": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add kitsune --env SMITHERY_API_KEY=your-value -- npx -y kitsune-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "kitsune": {
      "command": "npx",
      "args": [
        "-y",
        "kitsune-mcp"
      ],
      "env": {
        "SMITHERY_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "kitsune": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "kitsune-mcp"
      ],
      "env": {
        "SMITHERY_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

SMITHERY_API_KEY secret env
Smithery API key for accessing 3,000+ verified MCP servers. Get yours at smithery.ai/account/api-keys

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account kaiser-data, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Developer toolsi

More stars than 0% of the other 1394 servers in this category
Published to the registry more recently than 86% of the other 1394 servers in this category
Basic checks equal to or better than 100% of the other 1394 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Kitsune MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: SMITHERY_API_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.22.7) reached the registry 6 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js, Python (uv) on your computer.

What can I use instead?

In the same category: GitHub, Desktop Commander, Cloudflare MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

GitHub

by github

GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.

Computer or cloud★ 34,245MITUpdated 3 days ago

Install

Desktop Commander

by wonderwhy-er

MCP server for terminal commands, file operations, and process management

Runs on your computer★ 10,225MITUpdated 16 days ago

Install

Cloudflare MCP

by cloudflare

Cloudflare MCP servers

Runs in the cloud★ 4,446Apache-2.0Updated 14 months ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

🦊 Kitsune MCP Let your agent test the MCP server it's building.

Edit a tool, reload("dev") , call it again. No client restart. ⭐ Saved you a restart? Star it on GitHub so others find it. 📖 Documentation · Hot-reload tutorial · Tools reference

AI agents installing this server (Cline, Claude Code, Cursor, …): follow llms-install.md. No clone or build needed. Add the uvx kitsune-mcp entry to your MCP settings.

One prompt: Claude finds the bug, fixes it, reloads, checks again. Real recording, 31 s.

Why

Your agent edits an MCP tool, but the client still runs the old process. Someone has to restart it before the agent can test the fix.

With Kitsune, connect, call and reload are tools. The agent runs the whole loop itself:

connect("uv run my-mcp-server", name="dev")  # start your server

shapeshift("dev") # its tools appear in the client call("summarize", arguments={"url": "https://example.com"})

… the agent (or you) edits the tool …

reload("dev") # restart on fresh code, remount call("summarize", arguments={"url": "https://example.com"}) # new code, same session

No Docker needed: connect() runs your own server as a plain local process, so the loop stays fast.

It also mounts any of 130,000+ servers from 7 registries mid-session. If Docker is installed, community packages run caged.

Try it: hot-reload tutorial · examples/demo-hot-reload/

Install

Claude Code

claude mcp add -s user kitsune -- uvx kitsune-mcp

Any other client (Claude Desktop, Cursor, Windsurf, Cline, Zed, …):

"mcpServers": { "kitsune": { "command": "uvx", "args": ["kitsune-mcp"] } } }

Also on PyPI (pip install kitsune-mcp, then "command": "kitsune-mcp") and npm (npx kitsune-mcp, delegates to uvx).

Requirements: Python 3.12+ · uv · node/npx for npm-based servers · Docker optional: not used for hot-reload, only to cage community servers when installed.

Three things it does

	Loop	What you get
MCP REPL	`connect` → `shapeshift` → edit → `reload` → `call`	Iterate on your own server without restarting the client
Long-tail reach	`search` → `shapeshift` → `call` → `shapeshift()`	Use a server once without adding it to your config forever
Try before you trust	`confirm=True` + Docker cage + version pins	Run community npm/PyPI code contained, not as your user

Borrow a server you never configured

search("web scraping")

shapeshift("firecrawl", tools=["scrape_url"]) # mount one tool, not the whole server call("scrape_url", arguments={"url": "https://example.com"}) shapeshift() # drop it, session stays up

Try a community package, caged

search("pdf", registry="glama")

shapeshift("mcp-pdf-tools", confirm=True) # npm/PyPI run in hardened Docker when available call("extract_text", arguments={"path": "report.pdf"}) shapeshift()

Add credentials mid-session

auth("BRAVE_API_KEY", "sk-...")  # saved to ~/.kitsune/.env, no restart

shapeshift("brave", tools=["brave_web_search"])

Full live walkthrough: docs/demo-realtime.md.

When to use it, when not to

Use Kitsune when…	Skip it when…
You're building an MCP server and want an edit/reload loop	You only use 1–3 trusted servers (configure them natively)
A task needs a server that isn't in your config	Every turn hits the same server (keep it always-on)
You want to evaluate community MCP code without installing it for good	You want lower token use: the base cost is ~1,774 tokens/turn, and modern clients already defer tool schemas
Your MCP config is crowded (GATEWAY)	You need a sub-second first call (cold mount takes ~1–15 s)

How it works

shapeshift(server_id) picks a transport (stdio, HTTP+SSE, WebSocket, Docker), connects, reads tools/list, and registers each tool as a native tool with the server's real schema. The client receives notifications/tools/list_changed and sees first-class tools, with no wrapper in between. shapeshift() with no argument removes them and closes the connection.

search() covers the official servers repo, the MCP Registry, Glama, npm, PyPI, GitHub (github:owner/repo) and Smithery (hosted servers, free API key).

Tools

Default profile: 9 tools, ~1,774 tokens/turn (measured with python examples/benchmark.py).

Tool	Role
`connect(command, name)`	Start a persistent local server, e.g. the one you're developing
`reload(name)`	Release, restart on fresh code, remount, in one call
`release(name)`	Stop a persistent server
`search(query, registry?)`	Search 7 registries
`shapeshift(server_id?, tools=[…])`	Mount a server's tools (all or a subset); no argument drops them
`call(tool_name, arguments)`	Call a tool; the server is inferred when mounted
`auth(var_or_server, value?)`	Set an env key or run an OAuth 2.1 browser flow
`auto(task, server_hint=)`	Search, mount and call in one step
`status()`	Current form, connection pool, session stats

KITSUNE_TOOLS=all (or the kitsune-forge command) adds developer tools: inspect (schemas, credential check, token cost), test (quality score 0–100), bench (p50/p95 latency), compare, prewarm, craft, setup, and more. See docs/tools.md. Companion skills for Claude Code: kitsune-dev, kitsune-improve.

Safety, in short

Community sources need consent. npm, PyPI and GitHub servers require confirm=True. The model can set that flag itself, so real approval belongs in your client's tool-approval UI.
`connect()` runs the command it is given, as your user, with no consent gate and no cage. It is meant for your own code. Approve connect calls in your client before the agent runs them.
Community packages run in a Docker cage by default when Docker is installed: no host filesystem, --cap-drop ALL, read-only root, memory and PID limits. Credentials are passed by name, never in argv.
Version pins (TOFU). A later malicious publish doesn't silently replace a version you already ran.
Opt-in action guard. A ~/.kitsune/policy.json checks every downstream call against allow/ask/deny rules, path roots and a host allowlist. ask goes to you through MCP elicitation.
Install commands are validated and launched without a shell. fetch() blocks private hosts and re-checks every redirect.

Don't run it unattended with production admin, billing or security credentials. The full model, including what it does not protect against: docs/safety.md.

Configuration: env and .env lookup, tool profiles, sandbox and trust settings, Smithery, GATEWAY, mount patterns
Performance: cold/warm latency and token cost compared with always-on servers
Transports · Compatibility · Agent patterns · Worked scenarios

Why "Kitsune"?

In Japanese folklore the kitsune (狐) is known for what it can *become*: it borrows a form, uses that power, casts it off and returns to itself. That is the product loop.

*I am not Japanese, and I use this name with the highest respect for the mythology and culture it comes from. The parallel felt too precise to ignore.*

Contributing

make dev     # install with dev dependencies

make test # pytest make lint # ruff

Issues and PRs welcome: github.com/kaiser-data/kitsune-mcp · CHANGELOG.md

*MIT License · Python 3.12+ · Built on FastMCP*

Kitsune MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Developer toolsi

Common questions

Alternatives

GitHub

Desktop Commander

Cloudflare MCP

README from the maker

Why

… the agent (or you) edits the tool …

Install

Three things it does

Borrow a server you never configured

Try a community package, caged

Add credentials mid-session

When to use it, when not to

How it works

Tools

Safety, in short

More

Why "Kitsune"?

Contributing