stackdeckCAUTION
Your projects folder, as a control panel: start, stop, branch-switch and watch your local dev services. Zero dependencies, never talks to the internet.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/beingmechon/stackdeck/actions/workflows/ci.yml)
Your agent made four worktrees. Something has to run them.
Making the worktree is the easy part. The hour after is the problem: four branches, four dev servers, ports you didn't choose, and no idea which are up or what they're printing. Stackdeck starts them, keeps them running, streams their logs, shows every port on the machine, and hands all of it to your agent over MCP.
It works on the rest of your projects folder too — scans your roots, works out how to run each repo across ~15 ecosystems, boards them all. One Node process, one HTML page, no dependencies, bound to 127.0.0.1, never talks to the internet.
Install
npm i -g stackdeck # npm brew install beingmechon/tap/stackdeck # Homebrew curl -fsSL https://beingmechon.github.io/stackdeck/install.sh | sh # no npm needed
stackdeck # starts the daemon, opens http://localhost:8899 stackdeck tui # the same board, in your terminal
Point it at your projects folder in settings, then press configure on any project. npx stackdeck runs it without installing anything.
Node 18.13+, macOS or Linux — WSL2 included, with caveats; Windows-native is out of scope. The curl installer unpacks into ~/.local after checking the tarball against the hash npm recorded at publish time (read it first); undo with ... | sh -s -- --uninstall.
stackdeck 5 running · 12 stopped ─────────────────────────────────────────────────────────────
d9be53ae6184OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add web -- npx -y @acme/web
{
"mcpServers": {
"web": {
"command": "npx",
"args": [
"-y",
"@acme/web"
]
}
}
}Exposed tools (9)
5 read · 2 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
get_logs | read | Return the most recent log lines for a service (from its on-disk log). |
kill_pid | destructive | Kill a process by pid. Only pids currently holding a listening port can be killed; the daemon |
list_ports | read | Every listening TCP port on this machine, not just configured services: port, pid, process, full command, age, which Stackdeck service owns it, whether it is an OS process, and whether it belongs to another user (then it cannot be inspected or killed without sudo, which Stackdeck never uses). |
list_services | read | List all Stackdeck services with running state, port, pid, git branch, and dirty flag. |
list_worktrees | read | Every git worktree of a service |
restart_service | write | Restart a service by name. |
stop_service | destructive | Stop (kill) a service by name. |
stop_worktree | write | Stop a running worktree instance by its key (the \ |
whats_on_port | read | What is holding a specific port, if anything. Use this before starting a service that failed to bind. |
Trust audit
CAUTIONgrade C · trust 73/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (23)
Stackdeck.icns
const BASE = `http://127.0.0.1:${PORT}`;rewriteDbUrl("postgres://user:pw@localhost:5432/app_dev", "sd_app_x"),const out = rewriteDbUrl("postgres://u:[email protected]:5433/app?sslmode=require&pool=5", "sd_app_x");const out = rewriteDbUrl("postgres://user:p%40ss%3Aword@localhost/app", "sd_x");const src = "postgres://u:p@localhost:5432/production_like";
kill_pid, stop_service
.nojekyll
const digest = crypto.createHash("sha1").update(`${svc}\u0000${branch}`).digest("hex").slice(0, 6);"../../etc/passwd",
"a/../../b",
const r = linkHeavyDirs({ name: "s", linkDirs: ["../../etc", "..", "../escape-secret"] }, main, wt);if [ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:$STACKDECK_PORT/api/ping")" = "200" ]; thenconst r = await waitReadyFor({ readyWhen: { http: `http://127.0.0.1:${port}/health` }, alive: () => true }, 5000);const r = await waitReadyFor({ readyWhen: { http: `http://127.0.0.1:${port}/` }, alive: () => true }, 8000);res.writeHead(302, { Location: `http://127.0.0.1:${target.port}/` });django
docs/demo.gif
- `isolateDb` never read the `.env` file, which is where essentially every
- A landing page, a `curl | sh` installer, and a Homebrew formula.
curl -fsSL https://beingmechon.github.io/stackdeck/install.sh | sh # no npm needed
<div class="cmd"><span class="prompt" aria-hidden="true">$</span><code>curl -fsSL https://beingmechon.github.io/stackdeck/install.sh | sh</code><button class="copy" type="button">Copy</button></div>
<pre><span class="f">$</span> curl -fsSL https://beingmechon.github.io/stackdeck/install.sh | sh</pre>
Gates applied: no_behavioural_pass.
d9be53ae6184full audit observations/trust-audit/mcp-server/beingmechon__stackdeck.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | d9be53ae6184 | CAUTION | C | 73 | first audit |
Questions
What is the stackdeck MCP server?
Your projects folder, as a control panel: start, stop, branch-switch and watch your local dev services. Zero dependencies, never talks to the internet.
What tools does stackdeck expose?
9 in total: 5 read-only, 2 that write, and 2 that can delete or overwrite (kill_pid, stop_service). Every one is listed on this page with its risk.
Is stackdeck safe to connect to an agent?
With care. The audit graded it C (73/100) and found 23 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does stackdeck need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (d9be53ae6184), read on 2026-10-12. The repository is watched and re-audited when it changes.