ModelsAtlas
Explore
Atlas / MCP servers / clerk / clerk

clerkBLOCK

mcp/clerk/cli
MCP server by clerk · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Put your agent in control with the Clerk CLI

Verdict
BLOCK
Grade
F
Trust score
34 /100
Exposed tools
17 13r · 3w · 1d
Transport
streamable-http
License
MIT
Stars
55
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The Clerk command-line interface.

Add Clerk to an app

npx -y clerk@latest init

clerk init is the setup path for developers and coding agents. It detects the framework, installs the matching Clerk SDK for npm-based projects when it is missing, and scaffolds the Clerk wiring it can safely generate.

For accountless-capable frameworks (Next.js, Astro, Nuxt, TanStack Start, and React Router), unauthenticated agent runs can start without a Clerk account or browser login. With no --app and no linked project, a first clerk init run creates an unclaimed development application, writes local development keys, and stores a claim breadcrumb for a later clerk auth login. Later runs keep an existing unclaimed application instead of replacing it, unless you pass --fresh. Frameworks without accountless support need an authenticated app target before keys can be pulled: pass --app , use a linked project, or run npx -y clerk@latest init --login in an interactive terminal to log in and link one.

What clerk init changes:

  • Installs missing Clerk SDK packages in npm-based projects.
  • Creates or updates supported framework files, such as provider wiring,

middleware or proxy files, and sign-in/sign-up routes.

  • Writes Clerk keys to an env file when a real or accountless app is available.
  • When it creates a new accountless application, writes .clerk/keyless.json

and adds .clerk/ to .gitignore.

  • In npm-based projects, offers to install Clerk agent skills; agent mode runs

that step non-interactively unless --no-skills is passed.

After setup, run clerk doctor to verify the integration:

npx -y clerk@latest doctor

Installation

Homebrew (macOS / Linux)

brew install clerk/stable/clerk

npm

npm install -g clerk

Usage

Usage: clerk [options] [command]

Clerk CLI

Options:
-h, --help           Display help for command
--input-json   Pass command options as a JSON string,
Read from source at commit cc4e1a5bee28OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add clerk-fixture-fastify --env CLERK_AUTH_TIMEOUT_MS=${CLERK_AUTH_TIMEOUT_MS} --env CLERK_OAUTH_BASE_URL=${CLERK_OAUTH_BASE_URL} --env CLERK_OAUTH_CLIENT_ID=${CLERK_OAUTH_CLIENT_ID} --env CLERK_OAUTH_SCOPES=${CLERK_OAUTH_SCOPES} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "clerk-fixture-fastify": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "CLERK_AUTH_TIMEOUT_MS": "${CLERK_AUTH_TIMEOUT_MS}",
        "CLERK_OAUTH_BASE_URL": "${CLERK_OAUTH_BASE_URL}",
        "CLERK_OAUTH_CLIENT_ID": "${CLERK_OAUTH_CLIENT_ID}",
        "CLERK_OAUTH_SCOPES": "${CLERK_OAUTH_SCOPES}"
      }
    }
  }
}
03

Exposed tools (17)

13 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
Areadthe A
DELETEdestructiveDelete resource
GETreadRead resource
PATCHwritePartially update resource
POSTwriteCreate resource
PUTwriteReplace resource
agentreadNon-interactive agent mode
authreadManage authentication
canaryreadLatest canary (pre-release) build
devreadDevelopment instance
humanreadInteractive terminal mode
item_idreadItem ID
latestreadLatest stable release
orgsreadOrganizations only
prodreadProduction instance
user_idreadThe ID of the user
usersreadUsers only
04

Trust audit

BLOCKgrade F · trust 34/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (7 observation(s))
Shell
declared (3 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321
packages/cli-core/src/commands/deploy/prompts.ts:237
!contents.includes("-----BEGIN PRIVATE KEY-----") ||
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
packages/cli-core/src/commands/auth/README.md:54
Two cases report success without anything actually being revoked server-side, both inherent to RFC 7009 §2.2, which specifies `200` for an unrecognised token: an already-expired session, and a token a
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
packages/cli-core/src/commands/webhooks/README.md:57
clerk webhooks listen --token "$(clerk webhooks token)" --forward-to http://localhost:3000/api/webhooks
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
packages/cli-core/src/commands/whoami/README.md:86
| `GET`  | `/oauth/userinfo` | Fetches the user's `email` and `sub` (user ID) using the stored access token. Base URL defaults to `https://clerk.clerk.com`. |
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
packages/cli-core/src/commands/deploy/README.md:88
`components` says which of the four pieces were verified when the run ended: `dns`, `ssl` and `mail` from the domain-status response, `oauth` from whether every required provider has production creden
Why it matters. asks the agent to read credentials
HIGHPrompt injection · prompt.persistence · CWE-94, CWE-1427
packages/cli-core/src/commands/completion/README.md:24
# Or append to ~/.bashrc:
Why it matters. instructs the agent to persist itself in the user's environment
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills/audit-clerk-skill
.agents/skills/audit-clerk-skill
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills/changesets
.agents/skills/changesets
Why it matters. link not followed
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/cli-core/src/commands/auth/login.ts:65
const redirectUri = `http://127.0.0.1:${authServer.port}${CALLBACK_PATH}`;
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
packages/cli-core/src/commands/deploy/index.test.ts:1409
"-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQg\n-----END PRIVATE KEY-----\n",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
packages/cli-core/src/commands/deploy/index.test.ts:1430
"-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQg\n-----END PRIVATE KEY-----\n",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
packages/cli-core/src/commands/deploy/index.test.ts:1438
"missing the -----BEGIN PRIVATE KEY----- framing",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
packages/cli-core/src/commands/deploy/index.test.ts:2436
"-----BEGIN PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQg\n-----END PRIVATE KEY-----\n",
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
packages/cli-core/src/commands/users/interactive/instance-context.test.ts:165
publishable_key: "pk_live_aWRlYWwtbG91c2UtNjEuY2xlcmsuYWNjb3VudHMuZGV2JA",
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
packages/cli-core/src/commands/users/interactive/instance-context.test.ts:205
publishable_key: "pk_live_aWRlYWwtbG91c2UtNjEuY2xlcmsuYWNjb3VudHMuZGV2JA",
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
packages/cli-core/src/commands/users/interactive/instance-context.test.ts:238
publishable_key: "pk_live_aWRlYWwtbG91c2UtNjEuY2xlcmsuYWNjb3VudHMuZGV2JA",
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
packages/cli-core/src/commands/users/interactive/instance-context.test.ts:274
publishable_key: "pk_live_aWRlYWwtbG91c2UtNjEuY2xlcmsuYWNjb3VudHMuZGV2JA",
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
packages/cli-core/src/lib/fapi.test.ts:16
const result = decodePublishableKey("pk_live_Y2xlcmsuZXhhbXBsZS5jb20k");
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
DELETE
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.env.local.example
.env.local.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxfmtrc.json
.oxfmtrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxlintrc.json
.oxlintrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
test/e2e/fixtures/react/.oxlintrc.json
.oxlintrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.symlink · CWE-1104
test/e2e/fixtures/astro/CLAUDE.md
test/e2e/fixtures/astro/CLAUDE.md
Why it matters. link not followed
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/cli-core/src/commands/api/catalog.test.ts:2
import { useCaptureLog, stubFetch } from "../../test/lib/stubs.ts";

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-11 · audit v0.4.1 · source sha cc4e1a5bee28full audit observations/trust-audit/mcp-server/clerk__cli.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11cc4e1a5bee28BLOCKF34first audit
06

Questions

What is the clerk MCP server?

Put your agent in control with the Clerk CLI

What tools does clerk expose?

17 in total: 13 read-only, 3 that write, and 1 that can delete or overwrite (DELETE). Every one is listed on this page with its risk.

Is clerk safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (34/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does clerk need?

It reads CLERK_AUTH_TIMEOUT_MS, CLERK_OAUTH_BASE_URL, CLERK_OAUTH_CLIENT_ID, CLERK_OAUTH_SCOPES, CLERK_PLATFORM_API_KEY, CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY, GITHUB_TOKEN, HOMEBREW_TAP_TOKEN, NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and NUXT_PUBLIC_CLERK_PUBLISHABLE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does clerk run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as clerk-fixture-fastify at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (cc4e1a5bee28), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement