ModelsAtlas
Explore
Atlas / MCP servers / shane-kercheval / Mcp Client Agent

Mcp Client AgentCAUTION

mcp/shane-kercheval/mcp-client-agent
MCP server by shane-kercheval · Audited 2026-10-09
⚑ Report / re-scanSource ↗

CLI that uses DSPy to interact with MCP servers.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
5 5r · 0w · 0d
Transport
stdio
License
Apache-2.0
Stars
24
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

./clients/mcp_client.py is a CLI that uses DSPy to interact with MCP servers. The goal is to provide a similar experience to Claude Desktop. In particular, the DSPy agent uses the tool definitions defined in the MCP server(s) to autonomously and iteratively use the tools to accomplish the user's request.

The CLI program takes a configuration file in the same format that Claude Desktop uses and loads all of the servers in the config. The tools across all servers are available for the agent to use.

Running the Project

Useful commands for running the project can be found in the Makefile.

Quickstart

  • create a .env file in the project directory and add OPENAI_API_KEY key and value.
  • adjust this path /Users/shanekercheval/repos/mcp-client-agent/servers in ./servers/mcp_fake_server_config.json accordingly
  • make build
  • make chat
  • starts the chat CLI command using the ./servers/mcp_fake_server_config.json config to start the MCP Server ./servers/mcp_fake_server.py
  • This MCP server contains trivial tools like count_characters or calulator_multiply
  • this command uses openai/gpt-4o-mini as the model (DSPy model path formatting) and requires OPENAI_API_KEY to be set in the .env file

Example using make chat command and mcp_fake_server.py:

Multiply the number of characters in both the following two texts: "Lorem ipsum odor amet, consectetuer adipiscing elit. Nisl ligula molestie nec a sodales morbi vel. Diam interdum metus ante semper, lorem ornare massa. Accumsan dapibus lacus venenatis; elementum varius nascetur nibh sodales ipsum. Suspendisse mauris cubilia sit elit netus mattis. Rhoncus vivamus ridiculus nostra sociosqu bibendum. Eleifend ultricies orci proin maecenas justo felis sagittis. Elit blandit mattis dis consectetur morbi quisque penatibus." and "Lorem ipsum odor amet, consectetuer adipiscing elit. Proin maximus condimentum fusce nam, dictum adipiscing maximus. Lacinia pellentesque
Read from source at commit e917b22e88fdOBSERVED · 2026-10-09
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mcp-client-agent --env OPENAI_API_KEY=${OPENAI_API_KEY} -- uvx mcp-client-agent
claude-desktop
{
  "mcpServers": {
    "mcp-client-agent": {
      "command": "uvx",
      "args": [
        "mcp-client-agent"
      ],
      "env": {
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}
03

Exposed tools (5)

5 read · 0 write · 0 destructive.

ToolRiskDescription
calculator_multiplyread
calculator_sumread
count_charactersread
count_wordsread
reverse_textread
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
Makefile:31
--base_url 'http://127.0.0.1:8080' \
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
Makefile:37
--base_url 'http://127.0.0.1:1234/v1' \
LOWInventory / provenance · inv.hidden_file · CWE-1104
.ruff.toml
.ruff.toml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose

Gates applied: no_behavioural_pass.

Audited 2026-10-09 · audit v0.4.1 · source sha e917b22e88fdfull audit observations/trust-audit/mcp-server/shane-kercheval__mcp-client-agent.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-09e917b22e88fdCAUTIONB89first audit
06

Questions

What is the Mcp Client Agent MCP server?

CLI that uses DSPy to interact with MCP servers.

What tools does Mcp Client Agent expose?

5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Mcp Client Agent safe to connect to an agent?

With care. The audit graded it B (89/100) and found 3 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Mcp Client Agent need?

It reads OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Mcp Client Agent run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as mcp-client-agent.

How current is this page?

The grade is for one exact copy of the source (e917b22e88fd), read on 2026-10-09. The repository is watched and re-audited when it changes.

Advertisement