What can you do with Graneth?

graneth-mcp

Source for @graneth/mcp-server — an account-free MCP server that checks AI-written changes before they are committed: packages that do not exist, dependency risk shapes, and hardcoded secrets.

npx @graneth/mcp-server

Tool documentation, install snippets for Claude Code / Cursor / Windsurf, and the exact verdicts it returns: packages/mcp-server/README.md.

What is in this repository


`packages/mcp-server`	the MCP server itself — stdio, hand-rolled JSON-RPC, no runtime dependencies
`packages/core-checks`	the detection core it bundles: registry existence across six ecosystems, manifest parsing, secret patterns + entropy, risk scoring

What is not

The hosted scanning service is a separate, closed codebase: pull-request scanning, the second-pass LLM triage, policy enforcement, signed receipts and billing are not here and are not open source. This repository is the free tool and the checks it runs — which is the part you install on your machine, and therefore the part worth being able to read.

How it is maintained

Generated from the internal monorepo, which is the source of truth. Edits made directly here are overwritten on the next sync, so please open an issue rather than a patch — the fix lands upstream and comes back with the next release.

Three of core-checks' test files are held back: they assert that the secret rules fire, so their fixtures are literal example credentials, and every scanner — GitHub's push protection and this project's own — reads them as the real thing. The rules themselves are here in full (packages/core-checks/src/secrets.ts), as are the package's other tests.

Licence

MIT. See LICENSE.

Install

Add Graneth to your client. Pick the one you use.

{
  "servers": {
    "mcp-server": {
      "type": "http",
      "url": "https://graneth.com/api/mcp"
    }
  }
}

Add to `.vscode/mcp.json` in your workspace.

claude mcp add mcp-server -- npx -y @graneth/mcp-server

codex mcp add mcp-server -- npx -y @graneth/mcp-server

amp mcp add mcp-server -- npx -y @graneth/mcp-server

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Add to `claude_desktop_config.json`, then restart Claude Desktop.

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Add to `~/.cursor/mcp.json`, or `.cursor/mcp.json` for a single project.

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Add to `~/.codeium/windsurf/mcp_config.json`.

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Add to `cline_mcp_settings.json` via the MCP Servers panel.

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Add to `~/.gemini/settings.json`.

{
  "mcpServers": {
    "mcp-server": {
      "type": "local",
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ],
      "tools": [
        "*"
      ]
    }
  }
}

Add to `~/.copilot/mcp-config.json`, or run `/mcp add` inside the CLI.

{
  "context_servers": {
    "mcp-server": {
      "command": {
        "path": "npx",
        "args": [
          "-y",
          "@graneth/mcp-server"
        ]
      }
    }
  }
}

Add to your Zed `settings.json`.

npx -y @graneth/mcp-server

Run `goose configure`, choose **Add Extension → Command-line Extension**, and paste this command.

Score

39 / 100

Incomplete

Documentation13/25
Maintenance25/25
Trust13/20
Capability0/15
Install experience15/15

Documents what it does and how to connect
Has a resolvable package or endpoint
Exposes at least one tool, prompt or resource
README has substantive content
Includes a code example
Documents its configuration
Mentions credentials or security posture
Last commit 24 days ago
Has a release history
Repository is not archived
Licensed MIT
Namespace verified in the official MCP registry
Claimed by its owner
Published under an organisation
0 tool(s) documented
Provides prompt templates
Provides resources
18 documented install method(s)
Published to a package registry
Offers a hosted endpoint — no local install

Read the full rubric →

Version history

Versions	Published
0.7.1Latest	Aug 7, 2026
0.6.0	Jul 14, 2026
0.5.1	Jul 14, 2026