mcp-serverBLOCK
ローカルOllmaを参照、公開するMCPサーバー
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
ローカルのOllamaをMCPサーバーとして公開し、Claudeから作業を任せられるようにするNode.jsのサーバーです。 公式のMCP TypeScript SDK v2で作っています。
入口は次の2つです。 どちらもMCPの2026-07-28版(server/discover)と2025年版(initialize)の両方に応答します。
構成
[ローカル] Claude Code / Claude Desktop ──stdio──> docker exec ollama-mcp node stdio.ts ──> Ollama(ホストの11434番) [リモート] claude.ai ──HTTPS──> Cloudflare Access ──> Cloudflare Tunnel ──> 127.0.0.1:3000/mcp ──> Ollama
claude.aiとClaude Desktopのカスタムコネクタは、このPCではなくAnthropicのクラウドから接続します。 同じPCで使うだけなら、ローカル(stdio)の接続が確実です。 トンネルとAccessは要りません。
MCPのツール
988adba364f2OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env GITHUB_MCP_TOKEN=${GITHUB_MCP_TOKEN} --env MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GITHUB_MCP_TOKEN": "${GITHUB_MCP_TOKEN}",
"MCP_AUTH_TOKEN": "${MCP_AUTH_TOKEN}"
}
}
}
}Exposed tools (13)
11 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
git_clone | read | Clone a GitHub repository into ${cloneLabel()} on the machine that runs Ollama, so its files can be passed to the Ollama tools. |
git_read | read | Read the state of a cloned repository: status, log, diff, show, branches or remotes. |
git_write | write | Fetch, switch or create a branch, stage files, commit and push in a cloned repository. |
github_read | read | Read pull requests, issues, diffs, comments and check runs from GitHub for these owners: ${ownersLabel() || |
github_write | write | Open a pull request, or comment on a pull request or issue. |
list_files | read | List files and directories under ${fileRootsLabel()} on the machine that runs Ollama, so their paths can be passed to the \ |
ollama_chat | read | Delegate a self-contained text task to a local LLM running on the user |
ollama_explain_error | read | Ask the local LLM (default ${config.deepModel}) to analyse an error message or log and list likely causes with checks and fixes. |
ollama_health | read | Check that the local Ollama is reachable and show the server settings (default models, timeout, file access). |
ollama_job | read | Check a background job started with |
ollama_list_models | read | List the models installed in the local Ollama with size, quantization and context length. |
ollama_review_code | read | Get a second-opinion code review from the local LLM (default ${config.deepModel}). |
read_file | read | Read one file under ${fileRootsLabel()} on the machine that runs Ollama, without sending it to the local model. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (20)
.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F--]/g, "");
.markdownlint-cli2.jsonc
.textlintignore
.textlintrc.js
".git-credentials",
"app/.ssh/config": "Host github.com\n",
"app/.ssh/known_hosts": "github.com ssh-rsa AAAA\n",
"app/.kube/config": "apiVersion: v1\n",
"deploy/.git-credentials",
["..で外へ出る", () => `${root}/app/../../outside.txt`, /outside the allowed roots/],["..", "../../etc", /must be "owner\/repo"/],
for (const value of ["../outside.txt", "a/../../b", "..\\windows"]) {await assert.rejects(ollamaReviewCode({ git_diff: { repo: "../../etc" } }), /must be "owner\/repo"/);if docker exec "${CONTAINER}" wget -qO- http://127.0.0.1:3000/healthz; thendocker exec "${CONTAINER}" wget -qO- http://127.0.0.1:3000/healthzhttp://127.0.0.1:3000/mcp)
- 変えたあとは`docker compose up -d --build`で作り直し、`curl.exe http://127.0.0.1:3000/healthz`と、stdioの`initialize`の応答を確かめます
curl.exe http://127.0.0.1:3000/healthz
"+const ok = true;",
@modelcontextprotocol/express, @modelcontextprotocol/node, @modelcontextprotocol/server, express, express-rate-limit, zod, @223n/lint-config-ja, @modelcontextprotocol/client
Gates applied: no_behavioural_pass.
988adba364f2full audit observations/trust-audit/mcp-server/223n__mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 988adba364f2 | BLOCK | D | 69 | first audit |
Questions
What is the mcp-server MCP server?
ローカルOllmaを参照、公開するMCPサーバー
What tools does mcp-server expose?
13 in total: 11 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does mcp-server need?
It reads GITHUB_MCP_TOKEN and MCP_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcp-server run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as mcp-server at 2.3.0.
How current is this page?
The grade is for one exact copy of the source (988adba364f2), read on 2026-10-14. The repository is watched and re-audited when it changes.