R
robyroro/mcp-latchpoint
Offline MCP configuration auditor with a CLI, SARIF output, and a read-only MCP server
SECURITY.md ✓
在 GitHub 查看 ↗链接已于 2026-11-12 核查 · HTTP 200 · 打开的是厂商自己的官网
安装与配置
客户端配置（取自该仓库的安装命令）
{
"mcpServers": {
"robyroro-mcp-latchpoint": {
"command": "uvx",
"args": ["packages"]
}
}
}解析自我们于 2026-10-26 抓取的该仓库 README；我们未执行过。
command/args 来自仓库写明的安装命令；不确定时请以该项目 README 为准。
VS Code（.vscode/mcp.json —— 键名是 servers）
{
"servers": {
"robyroro-mcp-latchpoint": {
"command": "uvx",
"args": ["packages"]
}
}
}VS Code 顶层键是 <code>servers</code>，其余与上面那份相同。
Claude Code（命令行）
claude mcp add --transport stdio robyroro-mcp-latchpoint -- uvx packages
Claude Code 不收 JSON 文件，用这条命令直接加。
配置项的键名以你的客户端为准：客户端与 CLI
- ★ 数取值
- 0 ★ · robyroro/mcp-latchpoint · 取自 GitHub 搜索 API · （2026-11-13 20:00:50 核对）
- 来源明细
- 收录自 punkpeye/awesome-mcp-servers 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-10-23 · 最近见到 2026-11-14 · 共见到 26 次 · 被 23 个来源列出
- 评分构成
- 综合分 2,300 · 23 个来源 · mcp
- 安装
uvx packages
常见问题（答案都来自我们的记录）
怎么安装？
该仓库给出的安装命令是
uvx packages。我们的记录里它是仓库自己提供的；不保证在你的客户端上直接可用。它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
仓库
robyroro/mcp-latchpoint；我们收录于 2026-10-23；最近见到 2026-11-14。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。# mcp-latchpoint
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
mcp-latchpoint audits MCP client configuration files without running the configured servers. It works offline, reads only local files you select, and produces text, JSON, or SARIF results.
This is an early defensive tool. Review findings in context before changing a working configuration.
## What it checks
The v0.1 rules cover:
plain HTTP for non-loopback remote endpoints
shell wrappers and inline shell control syntax
identifiable npx and uvx packages without exact versions
literal credentials in environment values, headers, arguments, or URLs
filesystem roots and home roots passed as recognizable access scopes
wildcard hosts and recognizable wildcard scopes
conflicting, missing, invalid, or unsupported transport settings
Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
## Install
Python 3.11 or newer is required.
console
python -m pip install mcp-latchpoint
To install from a local checkout:
console
python -m venv .venv
# Linux or macOS
. .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
python -m pip install .
For development:
console
python -m pip install -e ".[dev]"
pytest
ruff check .
mypy
The MCP server uses the official Python SDK v2 and the dependency is constrained to mcp>=2.3, results.sarif
Restrict every explicit path to an approved directory:
console
mcp-latchpoint scan ./configs --allowed-root ./configs
Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with --max-files and --max-bytes.
Exit codes are 0 for a completed scan below the chosen threshold, 1 when a finding meets --fail-on, and 2 for input, containment, or parse errors. The default --fail-on none reports findings without failing a build.
List and explain rules:
console
mcp-latchpoint rules
mcp-latchpoint explain MCP004
### Recognized layouts
Explicit files may use these structures:
| Client layout | Container | Accepted file syntax |
| Claude Desktop, Cursor, portable .mcp.json, generic MCP JSON | top-level mcpServers object | JSON |
| Claude Code user/local settings | top-level mcpServers, plus projects. .mcpServers in ~/.claude.json | JSON |
| VS Code | top-level servers object | JSONC for .vscode/mcp.json |
| Codex | [mcpservers. ] tables | TOML |
Files ending in .jsonc are also parsed as JSONC. Other .json files remain strict JSON so malformed input is not silently accepted.
--discover checks only the following paths when they exist. It does not search the rest of the home directory.
All systems: ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, $COPILOTHOME/mcp-config.json with ~/.copilot/mcp-config.json as the fallback
Current project: .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json
Windows: %APPDATA%\Claude\claudedesktopconfig.json, %APPDATA%\Code\User\mcp.json
macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json, ~/Library/Application Support/Code/User/mcp.json
Linux: $XDGCONFIGHOME/Code/User/mcp.json, falling back to ~/.config/Code/User/mcp.json
This is an early defensive tool. Review findings in context before changing a working configuration.
## What it checks
The v0.1 rules cover:
plain HTTP for non-loopback remote endpoints
shell wrappers and inline shell control syntax
identifiable npx and uvx packages without exact versions
literal credentials in environment values, headers, arguments, or URLs
filesystem roots and home roots passed as recognizable access scopes
wildcard hosts and recognizable wildcard scopes
conflicting, missing, invalid, or unsupported transport settings
Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
## Install
Python 3.11 or newer is required.
console
python -m pip install mcp-latchpoint
To install from a local checkout:
console
python -m venv .venv
# Linux or macOS
. .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
python -m pip install .
For development:
console
python -m pip install -e ".[dev]"
pytest
ruff check .
mypy
The MCP server uses the official Python SDK v2 and the dependency is constrained to mcp>=2.3, results.sarif
Restrict every explicit path to an approved directory:
console
mcp-latchpoint scan ./configs --allowed-root ./configs
Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with --max-files and --max-bytes.
Exit codes are 0 for a completed scan below the chosen threshold, 1 when a finding meets --fail-on, and 2 for input, containment, or parse errors. The default --fail-on none reports findings without failing a build.
List and explain rules:
console
mcp-latchpoint rules
mcp-latchpoint explain MCP004
### Recognized layouts
Explicit files may use these structures:
| Client layout | Container | Accepted file syntax |
| Claude Desktop, Cursor, portable .mcp.json, generic MCP JSON | top-level mcpServers object | JSON |
| Claude Code user/local settings | top-level mcpServers, plus projects. .mcpServers in ~/.claude.json | JSON |
| VS Code | top-level servers object | JSONC for .vscode/mcp.json |
| Codex | [mcpservers. ] tables | TOML |
Files ending in .jsonc are also parsed as JSONC. Other .json files remain strict JSON so malformed input is not silently accepted.
--discover checks only the following paths when they exist. It does not search the rest of the home directory.
All systems: ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, $COPILOTHOME/mcp-config.json with ~/.copilot/mcp-config.json as the fallback
Current project: .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json
Windows: %APPDATA%\Claude\claudedesktopconfig.json, %APPDATA%\Code\User\mcp.json
macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json, ~/Library/Application Support/Code/User/mcp.json
Linux: $XDGCONFIGHOME/Code/User/mcp.json, falling back to ~/.config/Code/User/mcp.json
收录徽章（可选）
想把收录标记放进 README 就复制这行，可选，不影响收录。
[](https://anclum.com/zh/s/robyroro-mcp-latchpoint/)
- 来源
- awesome · https://github.com/robyroro/mcp-latchpoint
- 按领域浏览
- MCP 服务
- 收录来源
- 23 个独立来源
- 收录于
- 今天
- 安全策略
- 该仓库根目录有
SECURITY.md（我们只核文件存在，未核内容）
同类推荐
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。