ScalePad

Name: ScalePad
Author: wyre-technology

作者：wyre-technology版本 1.0.5i★ –i在你的电脑上运行

注册名称io.github.wyre-technology/scalepad-mcp

安装

概览

作者提供的说明（英文原文）

MCP server for ScalePad — Core, Lifecycle Manager, ControlMap, Backup Radar, and Quoter.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i尚未统计★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 其他
你需要填写：SCALEPAD_API_KEY, QUOTER_CLIENT_SECRET

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： SCALEPAD_API_KEY, SCALEPAD_REGION, QUOTER_CLIENT_ID, QUOTER_CLIENT_SECRET, MCP_TRANSPORT, AUTH_MODE, LOG_LEVEL

标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。

你需要

Docker已安装 Docker

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "scalepad": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SCALEPAD_API_KEY",
        "-e",
        "SCALEPAD_REGION",
        "-e",
        "QUOTER_CLIENT_ID",
        "-e",
        "QUOTER_CLIENT_SECRET",
        "-e",
        "MCP_TRANSPORT",
        "-e",
        "AUTH_MODE",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/scalepad-mcp:v1.0.5"
      ],
      "env": {
        "SCALEPAD_API_KEY": "your-value",
        "SCALEPAD_REGION": "your-value",
        "QUOTER_CLIENT_ID": "your-value",
        "QUOTER_CLIENT_SECRET": "your-value",
        "MCP_TRANSPORT": "your-value",
        "AUTH_MODE": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add scalepad --env SCALEPAD_API_KEY=your-value --env SCALEPAD_REGION=your-value --env QUOTER_CLIENT_ID=your-value --env QUOTER_CLIENT_SECRET=your-value --env MCP_TRANSPORT=your-value --env AUTH_MODE=your-value --env LOG_LEVEL=your-value -- docker run -i --rm -e SCALEPAD_API_KEY -e SCALEPAD_REGION -e QUOTER_CLIENT_ID -e QUOTER_CLIENT_SECRET -e MCP_TRANSPORT -e AUTH_MODE -e LOG_LEVEL ghcr.io/wyre-technology/scalepad-mcp:v1.0.5

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "scalepad": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SCALEPAD_API_KEY",
        "-e",
        "SCALEPAD_REGION",
        "-e",
        "QUOTER_CLIENT_ID",
        "-e",
        "QUOTER_CLIENT_SECRET",
        "-e",
        "MCP_TRANSPORT",
        "-e",
        "AUTH_MODE",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/scalepad-mcp:v1.0.5"
      ],
      "env": {
        "SCALEPAD_API_KEY": "your-value",
        "SCALEPAD_REGION": "your-value",
        "QUOTER_CLIENT_ID": "your-value",
        "QUOTER_CLIENT_SECRET": "your-value",
        "MCP_TRANSPORT": "your-value",
        "AUTH_MODE": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "scalepad": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "SCALEPAD_API_KEY",
        "-e",
        "SCALEPAD_REGION",
        "-e",
        "QUOTER_CLIENT_ID",
        "-e",
        "QUOTER_CLIENT_SECRET",
        "-e",
        "MCP_TRANSPORT",
        "-e",
        "AUTH_MODE",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/scalepad-mcp:v1.0.5"
      ],
      "env": {
        "SCALEPAD_API_KEY": "your-value",
        "SCALEPAD_REGION": "your-value",
        "QUOTER_CLIENT_ID": "your-value",
        "QUOTER_CLIENT_SECRET": "your-value",
        "MCP_TRANSPORT": "your-value",
        "AUTH_MODE": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

SCALEPAD_API_KEY 机密必填 env
ScalePad platform API key (generated in the ScalePad app by an Administrator)
SCALEPAD_REGION env
Data-residency region for ControlMap/Backup Radar: 'us' (default), 'eu', 'ca', or 'au'
QUOTER_CLIENT_ID env
Optional Quoter OAuth Client ID — only for the standalone api.quoter.com path
QUOTER_CLIENT_SECRET 机密 env
Optional Quoter OAuth Client Secret, paired with QUOTER_CLIENT_ID
MCP_TRANSPORT env
Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODE env
Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVEL env
Log verbosity: debug, info, warn, error

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 wyre-technology 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“其他”中的其他服务器比较i

星标数多于此分类中其他 32706 个服务器的 0%
发布到注册中心的时间比此分类中其他 32706 个服务器的 28% 更新
基础检查结果等于或优于此分类中其他 32706 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

ScalePad 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：SCALEPAD_API_KEY, QUOTER_CLIENT_SECRET

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（1.0.5）于3个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Docker。

有什么可以替代它？

同一分类中有：Spec Driven Development, Remote Desktop Commander, Kanal Varna — drains, leaks & plumbing (Varna, BG)

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Spec Driven Development

作者：formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

在你的电脑上运行★ 440MIT14个月前更新

安装

Remote Desktop Commander

作者：desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

在云端运行★ 211前天更新

安装

Kanal Varna — drains, leaks & plumbing (Varna, BG)

作者：kanalvarna.com

Drain unblocking, leak detection & plumbing in Varna, Bulgaria: services, prices, areas, contact

在云端运行今天更新

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

scalepad-mcp

MCP server for the ScalePad platform — Core, Lifecycle Manager, ControlMap, Backup Radar, and Quoter — built natively on the MCP SDK v2 (2026-07-28 spec) with dual-era serving: the same endpoint answers both legacy 2025-era initialize-handshake clients and modern envelope clients.

Architecture

Flat tool surface: every tool is exposed upfront in tools/list for universal client compatibility. Navigation tools are discovery aids, not gates.

Tool	Purpose
`scalepad_navigate`	Describe a product domain's tools (`core`, `lifecycle-manager`, `controlmap`, `backup-radar`, `quoter`) — a help/discovery aid, not a prerequisite
`scalepad_status`	Show credential status and available domains

Product domains

Domain	Tool prefix	Coverage
`core`	`scalepad_core_`	Unified platform data (read-only, US-only): clients, contacts, members, sites, opportunities, hardware/SaaS assets, product catalog, service contracts, tickets, integrations
`lifecycle-manager`	`scalepad_lm_`	Engagement/roadmap workflows: initiatives, goals, meetings, action items, assessments, deliverables, budgets, contracts, workspace
`controlmap`	`scalepad_cm_`	Compliance per client: risks, controls, evidence, policies, frameworks, assessments, action items (regions: us, eu, ca, au)
`backup-radar`	`scalepad_br_`	Read-only backup health and backup device inventory (regions: us, eu)
`quoter`	`scalepad_quoter_`	Quotes, catalog, contacts, suppliers, and standalone-OAuth helpers (defaults to the ScalePad-hosted Quoter API)

All tools are callable at any time; scalepad_navigate simply summarizes a domain's tools.

Credentials

One ScalePad API key (generated in the ScalePad app by an Administrator) covers every product; endpoints for products without an active subscription return 402.

Copy .env.example and set the variables below. Leave CONDUIT_S2S_SECRET empty in that file.

Environment variables (`AUTH_MODE=env`, default for stdio/local)

Variable	Required	Notes
`SCALEPAD_API_KEY`	For stdio and `AUTH_MODE=env`	Forwarded to `api.scalepad.com` as `x-api-key`
`SCALEPAD_REGION`	no	`us` (default), `eu`, `ca`, or `au` — selects the regional base URL for ControlMap (us/eu/ca/au) and Backup Radar (us/eu); Core and Lifecycle Manager are US-only
`QUOTER_CLIENT_ID`	no	Only for the standalone `api.quoter.com` OAuth path (Quoter Account > API Keys, Account Owner only)
`QUOTER_CLIENT_SECRET`	no	Paired with `QUOTER_CLIENT_ID`
`MCP_TRANSPORT`	no	`stdio` (default) or `http`
`AUTH_MODE`	no	`gateway` (Docker image and Compose default) or `env`. Gateway mode requires `X-ScalePad-Api-Key` on each `/mcp` request and never falls back to `SCALEPAD_*`. `env` uses those variables only after S2S auth succeeds.
`CONDUIT_S2S_SECRET`	Yes for HTTP	Service-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder (`changeme`, `your-s2s-secret`, and similar copied example values). Compose will not start without it. Never commit a real value. The value is never logged.
`MCP_ALLOW_INSECURE_DEV`	no	Set to exactly `1` only for local development to start HTTP without `CONDUIT_S2S_SECRET`. The process logs a warning and does not enforce `X-Gateway-S2S`. The listener is forced to `127.0.0.1` even if `MCP_HTTP_HOST` is a wider address such as `0.0.0.0`. A known placeholder secret is still refused.
`MCP_HTTP_HOST`	no	Bind address when `MCP_TRANSPORT=http` and `CONDUIT_S2S_SECRET` is set. When unset, the server binds `127.0.0.1`. The container image sets `0.0.0.0`.
`MCP_HTTP_PORT`	no	HTTP port. Defaults to `8080`.

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

Gateway headers (`AUTH_MODE=gateway`, hosted deployment)

Header	Required
`X-Gateway-S2S`	yes, when `CONDUIT_S2S_SECRET` is set
`X-ScalePad-Api-Key`	yes
`X-ScalePad-Region`	no
`X-Quoter-Client-Id`	no
`X-Quoter-Client-Secret`	no

In gateway mode credentials are bound per request from these headers. A /mcp request without X-ScalePad-Api-Key is rejected with a 401 JSON-RPC error before any MCP handling and never falls through to env credentials. /health stays unauthenticated.

X-Gateway-S2S signing

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. A missing or invalid header returns 401 before vendor credentials are read.

The header value is t= ,v1= . v1 is HMAC-SHA256 (64 lowercase hex characters) of the ASCII string t= , keyed with CONDUIT_S2S_SECRET. Timestamps more than 300 seconds from the server clock are rejected.

import { createHmac } from "node:crypto";

const t = Math.floor(Date.now() / 1000); const v1 = createHmac("sha256", process.env.CONDUIT_S2S_SECRET).update(t=${t}).digest("hex"); const xGatewayS2s = t=${t},v1=${v1};

Transports

stdio (default): node dist/index.js — for Claude Desktop / CLI. Does not use CONDUIT_S2S_SECRET.
HTTP: MCP_TRANSPORT=http node dist/index.js — serves /mcp (dual-era, legacy: 'stateless') plus /health and /healthz. Refuses to start until CONDUIT_S2S_SECRET is a real secret. MCP_HTTP_PORT defaults to 8080. With a secret set, MCP_HTTP_HOST is honored and defaults to 127.0.0.1 when unset. Without a secret, MCP_ALLOW_INSECURE_DEV=1 is the only way to start, and the listener is 127.0.0.1 only.

Development

export NODE_AUTH_TOKEN=$(gh auth token)   # GitHub Packages read access

npm ci npm run build # tsup (transpile-only; domains stay lazily importable) npm test # vitest (HTTP layer: health, 401 gate, dual-era tools/list, fail-closed S2S) npm run smoke # dual-era smoke against dist/index.js (loopback, insecure-dev bypass) npm run typecheck

Domain handlers live in src/domains/ .ts, each exporting export const handler: DomainHandler (see src/utils/types.ts), and are lazily loaded via src/domains/index.ts.

Local HTTP without a secret:

MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

Docker

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. That bind is safe only because startup refuses to run without a real CONDUIT_S2S_SECRET. Publish the port on loopback and pass the S2S secret. In gateway mode, ScalePad credentials arrive on each request as headers; they are not read from the environment.

docker build --build-arg NODE_AUTH_TOKEN=$(gh auth token) -t scalepad-mcp .

docker run \ -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \ -p 127.0.0.1:8080:8080 \ scalepad-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset. The gateway service does not set SCALEPAD_API_KEY, QUOTER_CLIENT_ID, or QUOTER_CLIENT_SECRET, and it does not use env_file, so a project .env cannot inject static vendor credentials into the container. Compose still interpolates CONDUIT_S2S_SECRET from that file. It publishes 127.0.0.1:8080:8080:

CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses SCALEPAD_API_KEY:

docker run \

-e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \ -e AUTH_MODE=env \ -e SCALEPAD_API_KEY=your-value \ -e SCALEPAD_REGION=us \ -p 127.0.0.1:8080:8080 \ scalepad-mcp

Local HTTP without a secret is development-only. It binds 127.0.0.1 only (a non-loopback MCP_HTTP_HOST, including 0.0.0.0, is overridden) and logs a warning:

MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

The image defaults to AUTH_MODE=gateway for hosted deployment behind the WYRE MCP gateway.

License

Apache-2.0 — see LICENSE.