mcp-preflight 0.1.0

See what an MCP server exposes before you trust or connect it.

mcp-preflight

See what an MCP server exposes before you trust or connect it.

TLDR

Run one command and get a quick capability + risk report for an MCP server (tools, resources, prompts).

Install

Recommended (CLI):

pipx install mcp-preflight

Alternative:

pip install mcp-preflight

Usage

mcp-preflight "uv run server.py"

Quick “real server” smoke test

mcp-preflight "npx @modelcontextprotocol/server-filesystem /tmp"

Other examples

mcp-preflight "npx my-mcp-server"
mcp-preflight "python3 /path/to/server.py"

Save a report (JSON)

mcp-preflight --save report.json "uv run server.py"

Diff two saved reports

mcp-preflight diff before.json after.json

JSON output

mcp-preflight --json "uv run server.py"

Example output

my-server (MCP 2025-03-26)

  Note: this runs the server locally; it does not sandbox the process.

  Tools:
    🟢 list_items     "List all items in the database"
    🟢 get_item       "Get a single item by ID"
    🟡 create_item    "Create a new item"
    🟡 update_item    "Update an existing item"
    🔴 delete_item    "Permanently delete an item"

  Resources:
    📄 my-server://items
    📄 my-server://items/{id}

  Prompts:
    💬 analyze_items (project_name)

  Signals (heuristic):
    ⚠️  system prompt mention: prompt analyze_items
    (may be false positives/negatives)

  Notes:
    ℹ️  timeout: mcp list_resources

  Risk: 2 write, 1 destructive, 2 read-only

Risk classification

Based on tool names and descriptions (conservative by default):

• 🟢 read-only: get, list, search, read, fetch, find, show, view
• 🟡 write: create, add, update, set, send, write, upload
• 🔴 destructive: delete, remove, destroy, drop, purge, clear, reset
• Unknown → 🟡 (assume write until proven otherwise)

Non-goals

• No sandboxing
• No policy enforcement
• No runtime analysis

This tool inspects exposed MCP capabilities. It does not call tools (call_tool).

Support

• Bugs / feature requests: https://github.com/jordanstarrk/mcp-preflight/issues