Atlas / MCP servers / particlefuture / One MCP

One MCPCAUTION

Name: One MCP
Author: particlefuture

mcp/particlefuture/one-mcp-1

MCP server by particlefuture · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Verdict

CAUTION

Grade

Trust score

85 /100

Exposed tools

5 5r · 0w · 0d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://mcp.1mcpserver.com/)

MCP of MCPs — automatically discover and configure MCP servers on your machine (remote or local).

After setup, you can usually just say:

“I want to perform . Call the deep_search tool and follow the outlined steps.”

The goal is that you only install this MCP server, and it handles the rest (searching servers, selecting servers, configuring servers, etc.).

Demo video 🎥: https://youtu.be/W4EAmaTTb2A

Quick Setup

Choose one of the following:

Remote (simplest & fastest ⚡💨)
Local (prebuilt) — Docker, uvx, or npx
Local (from source) — run this repo directly

1) Remote 🌍⚡💨

Use the hosted endpoint (recommended for the simplest setup).

Docs + guided setup: https://mcp.1mcpserver.com/

Configure your MCP client

Add the following entry to your client config file:

Cursor: ./.cursor/mcp.json
Gemini CLI: ./gemini/settings.json (see Gemini docs)
Claude Desktop:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Codex:
macOS: ~/.codex/config.toml
Windows: %USERPROFILE%\.codex\config.toml

Remote config (JSON):

{
"mcpServers": {
"1mcpserver": {
"url": "https://mcp.1mcpserver.com/mcp/",
"headers": {
"Accept": "text/event-stream",
"Cache-Control": "no-cache"
}
}
}
}

If you already have other servers configured, just merge this entry under mcpServers For example:

{
"mcpServers": {
"1mcpserver": {
"url": "https://mcp.1mcpserver.com/mcp/",
"headers": {
"Accept": "text/event-stream",
"Cache-Control": "no-cache"
}
},

Read from source at commit 7c433c7f5ea4OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add 1mcpserver --env GITHUB_TOKEN=${GITHUB_TOKEN} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y @1mcpserver/[email protected]

claude-desktop

{
  "mcpServers": {
    "1mcpserver": {
      "command": "npx",
      "args": [
        "-y",
        "@1mcpserver/[email protected]"
      ],
      "env": {
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (5)

5 read · 0 write · 0 destructive.

Tool	Risk	Description
`configure_mcp_plan`	read
`deep_search_planning`	read
`fetch_readme`	read
`file_system_config_setup`	read
`quick_search`	read

Trust audit

CAUTIONgrade B · trust 85/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (22)

MEDIUMInventory / provenance · inv.binary · CWE-1104

db/faiss_index/index.pkl

index.pkl

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

npm/1mcpserver-1mcpserver-0.1.1.tgz

1mcpserver-1mcpserver-0.1.1.tgz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

npm/node_modules/.package-lock.json

.package-lock.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

docs/.archive/_next/static/chunks/polyfills-42372ed130431b0a.js:1

!function(){var t="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(t){var e={exports:{}};return

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

docs/.archive/_next/static/chunks/webpack-341aa4a4d509aee2.js:1

(()=>{"use strict";var e={},t={};function r(o){var n=t[o];if(void 0!==n)return n.exports;var a=t[o]={exports:{}},i=!0;try{e[o](a,a.exports,r),i=!1}finally{i&&delete t[o]}return a.exports}r.m=e,(()=>{v

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

db/mcp_servers.md:393

- [cyberchitta/llm-context.py](https://github.com/cyberchitta/llm-context.py)   - Share code context with LLMs via MCP or clipboard