Sponsor MCPSafe10 founding slots
Registry/Mcporter MCP Server

Mcporter MCP Server

v0.14.1
Verified

TypeScript runtime and CLI for connecting to configured Model Context Protocol servers.

MIT
other
other
Scanned Oct 2, 2026
WebsiteRepositoryNPM
Automated scan (limited checks) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. It read the whole repository (179 files). It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

A+100%
Scanned 1w ago

Excellent Security

Vulnerabilities Found
0Crit
0High
0Med
0Low
1Info

Trust Score 76

Usable with caution
Trust grade B

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
100
MCP risk
56
Supply chain
100
Maintenance
71
Docs
100
Freshness
80
Risk traits
Runs shell commands
Network/API access
Requires secrets
Remote transport
Why it scores well
  • • No reviewed severe vulnerabilities published
  • • Healthy maintenance cadence
  • • Good documentation surface
  • • Solid supply-chain metadata
  • • Recently scanned
What reduces confidence
  • • MCP risk traits: Runs shell commands, Network/API access, Requires secrets

Security ScoreA+

100
out of 100

Vulnerabilities Found

0
Crit
0
High
0
Medi
0
Low
1
Info
Last scanned: 10/2/2026

Quality ScoreC

66
out of 100
71
Maint.
0
Popular
100
Docs
78
Compat
Maintenance71%
Popularity0%
Documentation100%
Compatibility78%

Maintenance71

Unknown
Commit Frequency65%
Release Frequency70%
Issue Response80%

Popularity0

0
Stars
0
Downloads
0
Forks
Stars Score0%
Downloads Score0%
Forks Score0%

Documentation100

README Quality100%

Available Documentation

API DocsExamplesChangelog

Compatibility78

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Supported Transports

STDIO

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMEMcporter MCP Server

View source

MCPorter 🧳 — Carry MCP tools into scripts, CLIs, and agents

![CI](https://github.com/openclaw/mcporter/actions/workflows/ci.yml)

![npm](https://www.npmjs.com/package/mcporter)

![Node](https://nodejs.org)

![License](LICENSE)

![Docs](https://mcporter.sh)

<p align="center">

<img src="mcporter.png" alt="MCPorter header banner" width="1100">

</p>

MCPorter is a TypeScript runtime and command-line tool for discovering and calling Model Context Protocol servers. It is for developers and coding agents that need the same MCP tools from a terminal, a script, or a generated standalone CLI.

Install

Try the CLI without installing it:

sh
npx mcporter --version

Install it for repeated command-line use:

sh
brew install steipete/tap/mcporter
# or
npm install -g mcporter

Node 24 or newer is required for npm installs. For the TypeScript runtime, add mcporter to your project with your package manager. Signed macOS binaries and the other supported install paths are covered in the install guide.

Quick start

Inspect a public MCP server, then call one of its tools:

sh
npx mcporter list https://mcp.context7.com/mcp --brief
npx mcporter call https://mcp.context7.com/mcp.resolve-library-id \
  query="React hooks docs" libraryName=react

The first command prints the server's TypeScript-style tool signatures. The second returns matching Context7 library IDs without requiring local configuration or credentials. See the five-minute quickstart for resources, generated CLIs, and typed clients.

Core workflows

| Goal | Command or API | Details |

| ----------------------------------------- | ------------------------------------ | ------------------------------------------ |

| Discover servers and tools | mcporter list | CLI reference |

| Call tools and read resources | mcporter call, mcporter resource | Call syntax |

| Connect to a one-off URL or stdio command | --http-url, --stdio | Ad-hoc servers |

| Complete or seed OAuth | mcporter auth, mcporter vault | Configuration |

| Generate a focused CLI | mcporter generate-cli | CLI generator |

| Generate TypeScript types or clients | mcporter emit-ts | Typed clients |

| Capture a reproducible MCP session | mcporter record, mcporter replay | Record and replay |

Human-readable output goes to stdout by default. Use JSON output when another program or agent needs a stable result, and consult mcporter <command> --help for the flags supported by that command.

Configuration and discovery

MCPorter reads project and user config, then imports MCP servers from Cursor, Claude Code and Desktop, Codex, Windsurf, OpenCode, and VS Code. A minimal config/mcporter.json looks like this:

json
{
  "mcpServers": {
    "context7": {
      "url": "https://mcp.context7.com/mcp"
    }
  }
}

Config files accept JSONC, environment placeholders (${VAR}, ${VAR:-fallback}, or whole-value $env:VAR), HTTP and stdio definitions, OAuth settings, tool filters, and lifecycle policy. The configuration guide defines precedence and the full schema; the import reference lists every discovered client format. The ${env:VAR} form used by some MCP clients is not supported; mcporter rejects it with the accepted alternatives instead of sending it literally.

Chrome DevTools definitions using --autoConnect can control Chrome through a paired OpenClaw extension relay. MCPorter discovers OpenClaw's active extension relay endpoint, with a 20-second cold-start budget and an optional MCPORTER_CHROME_DEVTOOLS_RELAY_URL in the canonical Chrome definition’s env map. Failed discovery reports its cause without guessing a default port. It uses Browser Relay Authentication v2 over one retained loopback socket, keeps the host key out of the network and child process, and gives chrome-devtools-mcp a credential-free loopback URL plus ephemeral authorization through an OS-protected preload handoff. Old relay authentication is never retried. Under shared ownership, both the default prefer and require fail closed; off requires matching canonical configuration. Caller shell relay controls do not override the daemon’s canonical Chrome configuration.

TypeScript runtime

Use createRuntime() when a process needs explicit server definitions, connection reuse, or several calls:

ts
import { createRuntime } from 'mcporter';

const runtime = await createRuntime({
  servers: [{ name: 'context7', command: { kind: 'http', url: new URL('https://mcp.context7.com/mcp') } }],
});
try {
  console.log((await runtime.listTools('context7')).map((tool) => tool.name));
} finally {
  await runtime.close();
}

callOnce() handles a single configured call and cleanup. createServerProxy() maps MCP tool names to callable camelCase properties and wraps results with text, Markdown, JSON, image, and raw-content helpers. See the runtime overview and tool-calling guide.

Protocols and long-lived servers

MCPorter connects to stdio, Streamable HTTP, and legacy SSE servers. It negotiates the current 2026-07-28 protocol or a legacy revision per server, while legacy connections advertise client elicitation capabilities. Interactive CLI calls can answer form and URL requests; headless and daemon-managed calls decline them with an actionable hint.

The repository's modern and legacy fixture servers cover both generations; CI exercises representative fixture paths end-to-end over stdio and Streamable HTTP. See protocols and interactive requests for negotiation controls and the keep-alive daemon for pooled servers, the MCP bridge, and Chrome DevTools integration.

Development

sh
pnpm install --frozen-lockfile
pnpm check
pnpm test
pnpm docs:site

The project uses the pnpm version declared in package.json and Vitest 5. Use Node 24 or 26 for development: CI checks Node 24 on Linux, macOS, and Windows, plus Node 26 on Linux. Vitest 5 excludes the non-LTS Node 25 line; the package's runtime requirement remains Node 24 or newer. Live hosted-server tests are opt-in; see live tests and manual testing.

Related

License

MIT — see LICENSE.

Embed Security Badge

Add this badge to your README or documentation

Mcporter MCP Server MCPSafe Security
[![Mcporter MCP Server MCPSafe Security](https://api.mcpsafe.org
/api/badge/mcporter-mcp-server.svg)](https://mcpsafe.org/registry/mcporter-mcp-server)
Need more customization options?Badge Documentation

Server Information

Source
NPM
Package
mcporter
Version
0.14.1
Language
other
License
MIT
Transport
STDIO
Added
Aug 11, 2026
Updated
Sep 27, 2026