R
robyroro/mcp-latchpoint
Offline MCP configuration auditor with a CLI, SARIF output, and a read-only MCP server
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"robyroro-mcp-latchpoint": {
"command": "uvx",
"args": ["packages"]
}
}
}Parsed from the README we fetched on 2026-10-26; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"robyroro-mcp-latchpoint": {
"command": "uvx",
"args": ["packages"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio robyroro-mcp-latchpoint -- uvx packages
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 0 ★ · robyroro/mcp-latchpoint · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 23 sources · mcp
- Install
uvx packages
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
uvx packages. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
robyroro/mcp-latchpoint；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# mcp-latchpoint
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
mcp-latchpoint audits MCP client configuration files without running the configured servers. It works offline, reads only local files you select, and produces text, JSON, or SARIF results.
This is an early defensive tool. Review findings in context before changing a working configuration.
## What it checks
The v0.1 rules cover:
plain HTTP for non-loopback remote endpoints
shell wrappers and inline shell control syntax
identifiable npx and uvx packages without exact versions
literal credentials in environment values, headers, arguments, or URLs
filesystem roots and home roots passed as recognizable access scopes
wildcard hosts and recognizable wildcard scopes
conflicting, missing, invalid, or unsupported transport settings
Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
## Install
Python 3.11 or newer is required.
console
python -m pip install mcp-latchpoint
To install from a local checkout:
console
python -m venv .venv
# Linux or macOS
. .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
python -m pip install .
For development:
console
python -m pip install -e ".[dev]"
pytest
ruff check .
mypy
The MCP server uses the official Python SDK v2 and the dependency is constrained to mcp>=2.3, results.sarif
Restrict every explicit path to an approved directory:
console
mcp-latchpoint scan ./configs --allowed-root ./configs
Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with --max-files and --max-bytes.
Exit codes are 0 for a completed scan below the chosen threshold, 1 when a finding meets --fail-on, and 2 for input, containment, or parse errors. The default --fail-on none reports findings without failing a build.
List and explain rules:
console
mcp-latchpoint rules
mcp-latchpoint explain MCP004
### Recognized layouts
Explicit files may use these structures:
| Client layout | Container | Accepted file syntax |
| Claude Desktop, Cursor, portable .mcp.json, generic MCP JSON | top-level mcpServers object | JSON |
| Claude Code user/local settings | top-level mcpServers, plus projects. .mcpServers in ~/.claude.json | JSON |
| VS Code | top-level servers object | JSONC for .vscode/mcp.json |
| Codex | [mcpservers. ] tables | TOML |
Files ending in .jsonc are also parsed as JSONC. Other .json files remain strict JSON so malformed input is not silently accepted.
--discover checks only the following paths when they exist. It does not search the rest of the home directory.
All systems: ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, $COPILOTHOME/mcp-config.json with ~/.copilot/mcp-config.json as the fallback
Current project: .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json
Windows: %APPDATA%\Claude\claudedesktopconfig.json, %APPDATA%\Code\User\mcp.json
macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json, ~/Library/Application Support/Code/User/mcp.json
Linux: $XDGCONFIGHOME/Code/User/mcp.json, falling back to ~/.config/Code/User/mcp.json
This is an early defensive tool. Review findings in context before changing a working configuration.
## What it checks
The v0.1 rules cover:
plain HTTP for non-loopback remote endpoints
shell wrappers and inline shell control syntax
identifiable npx and uvx packages without exact versions
literal credentials in environment values, headers, arguments, or URLs
filesystem roots and home roots passed as recognizable access scopes
wildcard hosts and recognizable wildcard scopes
conflicting, missing, invalid, or unsupported transport settings
Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
## Install
Python 3.11 or newer is required.
console
python -m pip install mcp-latchpoint
To install from a local checkout:
console
python -m venv .venv
# Linux or macOS
. .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
python -m pip install .
For development:
console
python -m pip install -e ".[dev]"
pytest
ruff check .
mypy
The MCP server uses the official Python SDK v2 and the dependency is constrained to mcp>=2.3, results.sarif
Restrict every explicit path to an approved directory:
console
mcp-latchpoint scan ./configs --allowed-root ./configs
Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with --max-files and --max-bytes.
Exit codes are 0 for a completed scan below the chosen threshold, 1 when a finding meets --fail-on, and 2 for input, containment, or parse errors. The default --fail-on none reports findings without failing a build.
List and explain rules:
console
mcp-latchpoint rules
mcp-latchpoint explain MCP004
### Recognized layouts
Explicit files may use these structures:
| Client layout | Container | Accepted file syntax |
| Claude Desktop, Cursor, portable .mcp.json, generic MCP JSON | top-level mcpServers object | JSON |
| Claude Code user/local settings | top-level mcpServers, plus projects. .mcpServers in ~/.claude.json | JSON |
| VS Code | top-level servers object | JSONC for .vscode/mcp.json |
| Codex | [mcpservers. ] tables | TOML |
Files ending in .jsonc are also parsed as JSONC. Other .json files remain strict JSON so malformed input is not silently accepted.
--discover checks only the following paths when they exist. It does not search the rest of the home directory.
All systems: ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, $COPILOTHOME/mcp-config.json with ~/.copilot/mcp-config.json as the fallback
Current project: .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json
Windows: %APPDATA%\Claude\claudedesktopconfig.json, %APPDATA%\Code\User\mcp.json
macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json, ~/Library/Application Support/Code/User/mcp.json
Linux: $XDGCONFIGHOME/Code/User/mcp.json, falling back to ~/.config/Code/User/mcp.json
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/robyroro-mcp-latchpoint/)
- Source
- awesome · https://github.com/robyroro/mcp-latchpoint
- Browse by field
- MCP servers
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.