ModelsAtlas
Explore
Atlas / MCP servers / saml1211 / PRD Creator

PRD CreatorBLOCK

mcp/saml1211/prd-creator
MCP server by saml1211 · ai · documentation · mcp · Audited 2026-10-08
⚑ Report / re-scanSource ↗

Flagship Model Context Protocol server for generating Product Requirement Documents (PRDs) from codebase context.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 1r · 0w · 0d
Transport
stdio
License
MIT
Stars
36
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/Saml1211/prd-mcp-server/actions/workflows/ci.yml) [](https://www.npmjs.com/package/prd-creator-mcp) [](https://github.com/Saml1211/prd-mcp-server/blob/main/LICENSE) [](https://github.com/Saml1211/prd-mcp-server/issues)

A specialized Model Context Protocol (MCP) server dedicated to creating Product Requirements Documents. This MCP server enables AI systems connected to MCP clients to generate detailed, well-structured product requirement documents through a standardized protocol interface.

  • Quick Start
  • Features
  • Installation
  • API Reference
  • Provider Configuration
  • Integrations
  • CLI Usage
  • Docker
  • Contributing
  • Changelog
  • Appendix

Quick Start

Via NPX (recommended):

npx -y prd-creator-mcp

Via Docker:

docker pull saml1211/prd-creator-mcp
docker run -i --rm saml1211/prd-creator-mcp

Configure Providers:

  • Copy .env.example to .env and set your API keys and preferred models.
  • Optionally, update provider credentials at runtime using the update_provider_config MCP tool.

Get Help:

npx prd-creator-mcp --help

Features

  • PRD Generator: Create complete PRDs based on product descriptions, user stories, and requirements
  • AI-Driven Generation: Generate high-quality PRDs using multiple AI providers
  • Multi-Provider Support: Choose from OpenAI, Google Gemini, Anthropic Claude, or local models
  • Provider Configuration: Cust
Read from source at commit 6c8966e83e0aOBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add prd-creator-mcp --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "prd-creator-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
standardreadStandard PRD template
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
none-observed
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/storage/db.ts:20
exec(sql: string): Promise<void>;
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/config/logging.ts:9
const logsDir = path.join(__dirname, '../../logs');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/core/ai-providers/anthropic-provider.ts:2
import { logger } from '../../config/logging.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/core/ai-providers/gemini-provider.ts:2
import { logger } from '../../config/logging.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/core/ai-providers/index.ts:7
import { logger } from '../../config/logging.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/core/ai-providers/local-provider.ts:2
import { logger } from '../../config/logging.js';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, openai, sqlite3, uuid, winston, zod, dotenv, @types/jest
Why it matters. 19 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
memory-bank/techContext.md:33
-   **Security**: API keys are read from environment variables. Care must be taken not to expose the `.env` file or log keys.
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 6c8966e83e0afull audit observations/trust-audit/mcp-server/saml1211__prd-creator.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-086c8966e83e0aBLOCKD69first audit
06

Questions

What is the PRD Creator MCP server?

Flagship Model Context Protocol server for generating Product Requirement Documents (PRDs) from codebase context.

What tools does PRD Creator expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is PRD Creator safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does PRD Creator need?

It reads ANTHROPIC_API_KEY, GEMINI_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does PRD Creator run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as prd-creator-mcp at 0.1.1.

How current is this page?

The grade is for one exact copy of the source (6c8966e83e0a), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement