claude-prompts-mcp

Overview

From the repository's own README, as read at the audited commit.

<!-- maintainers: this README is governed by docs/portfolio/readme-charter.md — run `cd server && npm run validate:readme` before committing changes --><div align="center"><img src="assets/brand/claude-prompts-avatar.svg" alt="Claude Prompts mascot, an asymmetric curled creature forming a C-shaped counter with two directional eyes" width="160" /><h1>Claude Prompts</h1>**The portable workflow layer beside your AI coding harness.**<p>Your client executes with its own tools, agents, and context.<br>Claude Prompts adds reusable prompt resources, composable chains, validation gates, and client-native skill export.</p><p><a href="#claude-code-recommended"><img src="https://img.shields.io/badge/Claude_Code-Set_up_plugin-D97757?style=flat-square&amp;logo=anthropic&amp;logoColor=white&amp;labelColor=111715" alt="Set up the Claude Code plugin"></a><a href="#codex-install"><img src="https://img.shields.io/badge/Codex-Set_up_experimental-2A8F83?style=flat-square&amp;logo=openai&amp;logoColor=white&amp;labelColor=111715" alt="Set up the experimental Codex plugin"></a></p><p><a href="https://www.npmjs.com/package/claude-prompts"><img src="https://img.shields.io/npm/v/claude-prompts.svg?style=flat-square&amp;logo=npm&amp;logoColor=white&amp;labelColor=111715&amp;color=2A8F83" alt="npm version"></a><a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-555E5A.svg?style=flat-square&amp;labelColor=111715" alt="MIT license"></a></p>[Quick Start](#quick-start) · [What You Get](#what-you-get) · [Compose Workflows](#compose-workflows) · [Run Anywhere](#run-anywhere) · [Docs](#documentation)</div>### What your AI client gives you — and what this server adds| Your client already does   | This server adds                                                                      || -------------------------- | ------------------------------------------------------------------------------------- || Run a prompt               | Compose prompts with validati

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add claude-prompts -- npx -y [email protected]

Exposed tools (77) 75 read · 2 write · 0 destructive

Details

Source

minipuft/claude-prompts-mcp

npm

claude-prompts@4.0.1

Transports

sse · stdio · streamable-http

Credentials it reads

AWS_SECRET_ACCESS_KEYGITHUB_TOKENMY_SECRET_KEY

License

MIT

Stars

186 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (6 observation(s))

Network

declared (11 observation(s))

Shell

declared (8 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

const data = yaml.load(readFileSync(yamlPath, 'utf-8'));

parsed = yaml.load(readFileSync(descriptorPath, 'utf8'));

const doc = yaml.load(yamlText);

data = yaml.load(readFileSync(yamlPath, 'utf-8')) as Record<string, unknown>;

const phasesData = yaml.load(readFileSync(phasesPath, 'utf-8'));

/^sh -c 'echo "[^"]*" >> \S+; export CLAUDE_PLUGIN_DATA="[^"]*"; exec (.*)'$/;

this.logger.info(`[Handoff] Minted token for session ${sessionId} (${session.chainId})`);

'    { "name": "red-team", "description": "Confirm exfil path" },  // Simple check',

const baseUrl = `http://127.0.0.1:${port}`;

await waitHealth(`http://127.0.0.1:${PORT_A}`);

await waitHealth(`http://127.0.0.1:${PORT_B}`);

const a = client(`http://127.0.0.1:${PORT_A}`);

const b = client(`http://127.0.0.1:${PORT_B}`);

.ignore

.mcpbignore

.node-version

.prettierignore

.prettierrc.json

const rawDb = (engine as unknown as { db: { exec(sql: string): void } }).db;

return new Function(

.createHash("sha1")

const CLI = join(__dirname, '../../dist/cpm.js');

const SERVER_PACKAGE = join(__dirname, '../../../server/package.json');

const CLI = join(__dirname, '../../dist/cpm.js');

const CLI = join(__dirname, '../../dist/cpm.js');

Gates applied: no_behavioural_pass.

Audited 2026-09-16 · audit v0.4.0 · source sha 5068214c526d · full audit: observations/trust-audit/mcp-server/minipuft__claude-prompts-mcp.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions