CliSAFE
Fine-grained control over model context protocol (MCP) clients, servers, and tools. Context is God.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Fine-grained control over model context protocol (MCP) clients, servers, and tools. Context is God.
[](https://oclif.io) [](https://npmjs.org/package/mcpgod) [](https://npmjs.org/package/mcpgod) [](LICENSE) [](coverage/lcov-report/index.html)
Overview
MCPGod is a CLI tool designed to help developers manage MCP servers with speed and ease. Whether you need to add, run, list, or remove servers—or even interact with server tools—MCPGod provides a streamlined interface to handle all these tasks on Windows, macOS, or Linux.
Features
- Client Management
Add, remove, and list MCP servers for specific clients.
- Tool Discovery
List every tool on any MCP server.
- Tool Calling
Run any tool on any MCP server directly from the command line.
- Tool/Client Permissions
Allow or block specific tools for specific clients.
- Detailed Logging
Log every server run from every client, with timestamps and clean output for easy debugging.
Installation
Install mcpgod globally using npm:
npm install -g mcpgod
Verify the installation:
mcpgod --version
Or run directly with npx.
npx -y mcpgod
Usage
Access the CLI with the mcpgod command (or npx -y mcpgod). Below are some common examples:
- Add a Server to a Client
Add an MCP server to a client (e.g., Claude) with mcpgod add -c :
mcpgod add @modelcontextprotocol/server-everything -c claude
- Only Add Specific Tools to a Client
Only add specific tools to a client with mcpgod add -c --tools=:
mcpgod add @modelcontextprotocol/server-ev
0f882d5a6549OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcpgod -- npx -y [email protected]
{
"mcpServers": {
"mcpgod": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
echo | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
.mocharc.json
.prettierrc.json
@modelcontextprotocol/sdk, @oclif/core, strip-ansi, winston, zod, @eslint/compat, @oclif/prettier-config, @oclif/test
Gates applied: no_behavioural_pass.
0f882d5a6549full audit observations/trust-audit/mcp-server/mcpgod__cli-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 0f882d5a6549 | SAFE | B | 89 | first audit |
Questions
What is the Cli MCP server?
Fine-grained control over model context protocol (MCP) clients, servers, and tools. Context is God.
What tools does Cli expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Cli safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Cli need?
No credential environment variables were found in its source, so it appears to need none.
How does Cli run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcpgod at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (0f882d5a6549), read on 2026-10-07. The repository is watched and re-audited when it changes.