Atlas / MCP servers / basementstudio / xmcp

xmcpBLOCK

Name: xmcp
Author: basementstudio

mcp/basementstudio/xmcp

MCP server by basementstudio · framework · mcp · modelcontextprotocol · Audited 2026-10-12

⚑ Report / re-scan Source ↗

The TypeScript MCP framework

Verdict

BLOCK

Grade

Trust score

60 /100

Exposed tools

75 72r · 3w · 0d

Transport

streamable-http

License

MIT

Stars

1,337

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Feature PRs that change core package behavior should include a changeset:

pnpm changeset

The core packages (xmcp, @xmcp-dev/compiler, create-xmcp-app, and init-xmcp) version together. UI and plugin packages version independently. Merge the generated Version Packages PR to publish unpublished versions through the stable workflow.

@xmcp-dev/cli is ignored by stable versioning and has a separate manual publish workflow. Before Changesets decides whether to version or publish, the stable workflow removes ignored-only changesets from its disposable checkout. Those changesets remain in git; they must not prevent publishing already-versioned packages. Mixed and empty changesets retain the normal Changesets behavior.

Run the release-decision regression checks with:

node --test scripts/prepare-stable-release.test.cjs

Read from source at commit fcaa495ab7b1OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add xmcp --env API_KEY=${API_KEY} --env BETTER_AUTH_BASE_URL=${BETTER_AUTH_BASE_URL} --env BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} --env BILLING_SECRET_KEY=${BILLING_SECRET_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "xmcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "BETTER_AUTH_BASE_URL": "${BETTER_AUTH_BASE_URL}",
        "BETTER_AUTH_SECRET": "${BETTER_AUTH_SECRET}",
        "BILLING_SECRET_KEY": "${BILLING_SECRET_KEY}"
      }
    }
  }
}

Exposed tools (75)

72 read · 3 write · 0 destructive.

Tool	Risk	Description
`add`	write	Add two numbers
`ai_chat`	read	Chat with AI, tracks token consumption per model
`ai_generate`	read	Generate content with AI, tracks 1 unit per call
`app-config`	read	Application configuration data
`browser-navigate`	read	Navigate to a URL
`classify-sentiment`	read	Classify sentiment using example exchanges
`client-info`	read	Echo request client identity
`completion-members`	read	Team member profiles
`confirm`	read	Ask for confirmation
`counter`	read	Counter React
`create-user`	write	Create a new user in the system
`disabled-metadata`	read	Disabled UI tool
`echo`	read	Echo text
`experimental-greeting`	read	A greeting that is not available yet
`export`	read	Export data in multiple formats, Pro plan only
`extra-arguments`	read	Access extra arguments from a tool call, including repeated HTTP client info headers
`fail`	read	Return an application error
`feature-extra`	read	Feature fixture tool
`few-shot`	read	Classify sentiment
`get-alerts`	read	Get the alerts for a state
`get-forecast`	read	Get the forecast for a state
`get-library-docs`	read	Get the docs for a library
`get-my-memberships`	read	Returns the user
`get-pet`	read	Read a pet from the local example API
`get-time`	read	Get the current time, optionally in a specific timezone
`get-user`	read	Get details of a specific user by their ID
`get-user-info`	read	Get user details
`get-weather`	read	Get current weather for a location
`get_doc`	read	Fetch the full Markdown of a docs page. Pass a docs path like
`greet`	read	Greet the user
`hash-string`	read	Hash a string using SHA-256
`hello`	read	Says hello to a user
`hostThemeDemo`	read	Host-Aware Workspace demo for MCP Apps: host context, CSS variables, view modes, safe areas, and size reporting.
`identity`	read	Inspect the current request
`info`	read	Static fixture data
`internal-dashboard`	read	An internal dashboard excluded by the component visibility rules
`list-users`	read	List all users in the system
`liveToolDemo`	read	Ops Console demo for MCP Apps: tool calling, polling, host connection state, and granted view modes in one operator workflow.
`log`	read
`mcp-app-playbook`	read	Small reference document used by the ui showcase resource/composer demo.
`media-content`	read	Return mixed media content
`media-preview`	read	Return a one-pixel PNG and an embedded description
`metadata-prompt`	read	Metadata example
`metadata-tool`	read	Metadata example
`navigate`	read	Navigate the current browser tab to a same-origin path on the xmcp site, e.g.
`preview-elicitation`	read	Preview a basic extra.elicit() flow in MCPJam
`preview-input-required`	read	Ask the user to confirm before applying a theme, using a multi round-trip input_required result (protocol 2026-07-28; 2025-era clients are served through the SDK
`preview-sampling`	read	Preview a basic extra.sample() flow in MCPJam
`preview_elicitation`	read	Demonstrate extra.elicit() flows for screenshots and manual verification
`random-number`	read	Generate a random number
`renderJson`	read	Render a full @xmcp-dev/ui AppSchema for MCP Apps-compatible clients. Before generating the schema, read the skill://xmcp-ui/schema-reference resource for the full component catalog and schema format. The JSON must include at least title, mcpServerUrl, and a root component object.
`report`	read	Generate a demo report. Costs three quota units.
`request-context`	read	Read request details from an async helper without passing tool arguments
`request-helpers`	read	Exercise local values and request notifications
`request-progress`	read	Normalize a list and report progress using request-local values
`resourceComposerDemo`	write	Resource and Composer demo for MCP Apps: read a real resource, send a message, and update model context through the host.
`review-code`	read	Review code for best practices and potential issues
`schemaAppDemo`	read	Schema-driven MCP App demo that runs through host-backed transport and calls tools via declarative actions.
`search`	read	Search xmcp documentation.
`search_docs`	read	Full-text search across the xmcp documentation. Returns a ranked list of matching pages with their titles and URLs. Use get_doc to read a result.
`serverStats`	read	Returns live server metrics. Used by the ui showcase MCP App demos as a backend data source.
`shadcnDemo`	read	A local shadcn Card sharing the xmcp UI kit
`show-external-url`	read	Creates a UI resource displaying an external URL (example.com).
`show-raw-html`	read	Creates a UI resource displaying raw HTML.
`show-remote-dom`	read	Creates a UI resource displaying a remote DOM script.
`showcase`	read	Landing page for the refreshed ui showcase, organized around real MCP App examples and a smaller component reference set.
`team-greeting`	read	Generate a greeting for team members
`uiKitDemo`	read	Starter MCP App built with @xmcp-dev/ui components.
`user`	read	Templated fixture data
`user-profile`	read	User profile information
`validate-email`	read	Validate the format of an email address.
`weather`	read	Weather App
`whoami`	read	Returns the full Auth0 user session and account information
`xmcp-e2e`	read	Conformance fixture
`xmcp-ui-schema-reference`	read	Component catalog and schema format for generating valid xmcp UI JSON

Trust audit

BLOCKgrade D · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (5 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

packages/compiler/src/telemetry/events/post-payload.ts

post-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/compiler/src/compiler/parse-xmcp-config.ts:173

const func = new Function(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMHard-coded secrets · inv.env_committed · CWE-798, CWE-321

examples/middlewares-api-key/.env

.env

Why it matters. a real .env in the package

Fix. ship .env.example with placeholders only