Mcpreflight

Name: Mcpreflight
Author: xka0085-byte

by xka0085-byteversion 0.6.0i★ –iRuns on your computer

Registry nameio.github.xka0085-byte/mcpreflight

Install

Overview

Description from the maker (original English)

Read-only preflight for any MCP or x402 endpoint: handshake, tool schemas, 402 drift.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "mcpreflight": {
      "command": "npx",
      "args": [
        "-y",
        "@eidonze/mcpreflight",
        "mcpreflight-mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add mcpreflight -- npx -y @eidonze/mcpreflight mcpreflight-mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "mcpreflight": {
      "command": "npx",
      "args": [
        "-y",
        "@eidonze/mcpreflight",
        "mcpreflight-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "mcpreflight": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@eidonze/mcpreflight",
        "mcpreflight-mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account xka0085-byte, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32683 servers in this category
Published to the registry more recently than 89% of the other 32683 servers in this category
Basic checks equal to or better than 100% of the other 32683 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Mcpreflight safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.6.0) reached the registry 4 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, MCP Server Autocad Lisp Helper

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

MCP Server Autocad Lisp Helper

by radwanalmsora

High-precision static analysis and debug server for AutoCAD AutoLISP (.lsp) files.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

mcpreflight

Point it at any MCP or x402 endpoint and get a verdict in one command. Read-only: no API key, no wallet, no tool calls.

npx -y @eidonze/mcpreflight schema https://your-mcp-server.example/mcp

Status: PASS | FAIL | UNKNOWN   exit 0 | 1 | 2, so CI can gate on it

Reach for it when an agent client, a buyer, or a CI job is about to depend on an endpoint whose source you cannot read, including endpoints you do not own. It reads only what the endpoint already sends to any anonymous caller: the initialize handshake, tools/list, and the HTTP 402 / x402 payment document.

Form	Run it	Use it for
CLI	`npx -y @eidonze/mcpreflight ...`	one-off checks and scripts
Homebrew	`brew install xka0085-byte/mcpreflight/mcpreflight`	a machine-wide `mcpreflight` on PATH, macOS or Linux
GitHub Action	`uses: xka0085-byte/mcpreflight@v1`	fail a PR when a handshake, a tool schema or an x402 challenge drifts
stdio MCP server	`npx -y -p @eidonze/mcpreflight mcpreflight-mcp`	let an agent check an endpoint before it connects

No install to try it: run the check in the browser, free and without signup: check-your-mcp-endpoint

Listed in the official MCP Registry as io.github.xka0085-byte/mcpreflight (browse) and on the GitHub Marketplace.

What it is

Read-only MCP and x402 preflight: it reads initialize + tools/list and x402 payment documents. No API key, no wallet, no payment, no tool calls.

This is an endpoint preflight, not a source audit. Tools that read your repository or fuzz a server you launch need a checkout and a start command; this one needs only a URL, so it can check the deployment an agent is about to connect to, including one you do not own.

Same name, different job

Search "MCP preflight" and you also meet kenimo49/mcp-preflight, now published as mcp-scorecard. Both check an MCP server before something depends on it; the input and the findings differ.

	This repo (`mcpreflight`)	`mcp-scorecard` (kenimo49)
Input	a deployment URL, including one you do not own	a local checkout, a `localhost` URL, or a `pypi:` package
Reads	`initialize`, `tools/list`, and the HTTP 402 / x402 payment document, anonymously	per-turn token footprint, use-case scoping of each tool, security rules, name safety
Answers	will this deployed endpoint answer an agent, and does its payment challenge still hold?	is this server cheap and clear enough for an LLM to use, before you publish it?

One grades the source you have; the other checks the endpoint you are about to depend on.

Check an endpoint you do not own

The same read-only check runs weekly against every remote endpoint listed in the official MCP Registry, and the results are published as pages and as JSON:

Trust Directory — 35,325 endpoints, one report each: status, protocol version, tool count, findings, and whether credentials are required.
JSON API — /trust/api/{slug}.json per endpoint, plus batch indexes and a JSON Schema. No key, no signup, no rate limit.
x402 census dataset — the payment slice of the same sweep: 1,583 of 35,327 endpoints advertise x402 or HTTP-402, with a weekly series, a status distribution against the registry-wide baseline, and downloadable CSV/JSON.

Read the vocabulary before quoting any number: in the 2026-11-02 scan, 20,701 endpoints answered anonymously (PASS), 10,236 refused with 401 because they require credentials by design (AUTH_GATED), 167 were reachable but invalid (FAIL), and 4,223 gave no anonymous handshake (UNKNOWN, usually an auth wall we cannot see past). A "dead MCP servers" count taken from this data would be wrong — 41% of the registry cannot be checked without credentials at all.

Use it as an MCP server

The stdio entry point is bin/mcpreflight-mcp.mjs, published as the mcpreflight-mcp bin in the same npm package. It implements the MCP lifecycle a client expects: initialize returns serverInfo mcpreflight with the package version, notifications/initialized is accepted, and tools/list returns two tools.

Tool	What it does
`schema_check`	Runs the read-only preflight against a server URL: `initialize` handshake, `tools/list`, then tool input schema validation. Returns PASS/FAIL/UNKNOWN with findings. Never calls a tool, never reads data.
`x402_inspect`	Reads an HTTP 402 challenge without paying: validates the payment document shape, the `accepts[]` entries and discovery manifests. Never signs or settles.

Add it to an MCP client:

"mcpServers": { "mcpreflight": { "command": "npx", "args": ["-y", "-p", "@eidonze/mcpreflight", "mcpreflight-mcp"] } } }

Both tools do the same work as the CLI and return the same findings, so an agent can check an endpoint before it connects to it. Read-only by construction: the transport issues only GET and POST to the URL you pass, holds no key and has no wallet.

Seen in use

joxo serves an MCP endpoint that is auth-gated by design. Their maintainer read the 0.2.0 source to confirm the check was two plain POSTs with no dependencies, then ran npx @eidonze/mcpreflight@0.2.0 schema https://joxo.ai/api/mcp and got UNKNOWN: MCP initialize returned HTTP 401 against a deliberate OAuth 2.1 gate (#50). That report is the reason 0.3.0 classifies an OAuth challenge as AUTH_GATED, with the RFC 9728 resource metadata verified, instead of reading as a dead endpoint. They re-checked on 2026-11-01 and closed it: "The endpoint is sign-in only, so no anonymous handshake is expected. Thanks for the AUTH_GATED handling; closing." (#50).
A maintainer of cueframe-mcp reran the scan after a fix and reported the result back: @eidonze/mcpdoctor@0.1.8 (the earlier npm name) now exits 0 on their endpoint, with the anonymous tools/list payload down from 1,399,189 to 550,377 bytes — under the scanner's 1 MiB limit (#11).
Listed in awesome-mcp-lists under MCP Toolkits / Testing Tools (#226).

These are examples of the check being run, not endorsements or a claim that a PASS makes a server safe.

Start here

Exit codes are stable for CI: 0 PASS, 1 FAIL, 2 UNKNOWN/network, 3 usage. Requires Node.js 18+.

mode is schema (MCP handshake plus tool schemas), inspect (one-off x402 preflight), baseline (record the current 402 challenge shape) or drift (fail the job when that shape moves away from the committed baseline). The report is also appended to the job summary, and steps. .outputs.status carries the exit code so later steps can branch on it without parsing logs.

Find the right guide

Public documentation site
MCP schema checker
x402 endpoint inspector
x402 payments in the MCP Registry: census dataset
MCP security CI
Troubleshooting
OAuth scope and current limits

Run it now

Check an MCP server without calling any tools:

npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json

Check an x402 endpoint without paying:

npx @eidonze/mcpreflight inspect https://your-api.example/paid --method=POST --json

npx @eidonze/mcpreflight inspect https://your-api.example/paid --x402 # payment layer only, one request

Requires Node.js 18+. No API key or wallet is needed.

Example schema run against a live endpoint:

$ npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp

MCP Tool Schema Report

Status: FAIL
Endpoint: https://your-mcp-server.example/mcp
Protocol: 2025-06-18
Tools: 12

FAIL REQUIRED_PROPERTY_UNDEFINED: tools[3] requires undeclared property query
WARN PROPERTY_DESCRIPTION_MISSING: tools[7].limit has no description

The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it.

Which command?

Command	Checks	Does not do
`schema`	MCP `initialize`, `tools/list`, tool names, descriptions, and JSON schemas	Does not call tools or prove runtime behavior
`inspect`	HTTP 402, x402 v1/v2 payment document, `accepts[]`, discovery manifests, latency and response digest	Does not sign, pay, settle, retry, or verify delivery
`inspect --x402`	The payment layer only: one request, the 402 challenge and its `accepts[]` entries, no MCP handshake or discovery probes	Same limits, and it says nothing about the MCP endpoint behind the payment

Exit codes are stable for automation: 0 PASS, 1 FAIL, 2 UNKNOWN/network error, 3 usage error.

What it does NOT check

mcpreflight is a protocol- and schema-level preflight, not a security audit. It does not:

Detect malicious code, prompt injection, or supply-chain risk in the server's implementation
Call tools, so it cannot prove runtime behavior, data handling, or permission scope
Bypass, test, or evaluate authentication and authorization
Verify payment settlement or delivery for x402 endpoints
Certify compliance with any spec beyond the response shapes it inspects

A PASS means the observed handshake and schemas were well-formed at scan time. Nothing more.

GitHub Actions

Add a read-only check to pull requests:

name: MCP Trust Check

on: [pull_request]

jobs: mcp-trust: runs-on: ubuntu-latest steps:

uses: xka0085-byte/mcpreflight@v1 with: endpoint: https://your-mcp-server.example/mcp mode: schema format: markdown

Use mode: x402 when you only care about the payment layer: one request, the 402 challenge and its accepts[], no handshake, no discovery probes. Use mode: inspect for the full report. The action fails on FAIL or UNKNOWN by default; set fail-on: false for an informational check. Looking for it in the Marketplace? Search "MCP Trust Preflight" or "mcp server test", or browse the mcp-trust-preflight listing.

Starter template

Start a new MCP project with this check already wired in:

Secure MCP Server Starter

The check is read-only and should target a public test endpoint. Do not place private keys or credentials in workflow inputs.

What the report means

PASS means the observed response matched the checks in this version. It is not a security audit, protocol certification, payment-success guarantee, or proof that an endpoint is s

Only the beginning is shown; read the rest in the repo

Mcpreflight

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

MCP Server Autocad Lisp Helper

README from the maker

mcpreflight

What it is

Same name, different job

Check an endpoint you do not own

Use it as an MCP server

Seen in use

Start here

Find the right guide

Run it now

Which command?

What it does NOT check

GitHub Actions

Starter template

What the report means