All in one vscode plugin for mcp developer
# Add to your Claude Code skills
git clone https://github.com/LSTM-Kirigaya/openmcp-clientGuides for using ai agents skills like openmcp-client.
Last scanned: 5/7/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@microsoft/api-extractor: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@microsoft/api-extractor-model: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@microsoft/tsdoc-config: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@originjs/vite-plugin-commonjs: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@rushstack/node-core-library: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@rushstack/terminal: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@rushstack/ts-command-line: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios is vulnerable to DoS attack through lack of data size check",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "copy-webpack-plugin: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"severity": "low"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data uses unsafe random function in form-data for choosing boundary",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "jsonpath-plus: JSONPath Plus Remote Code Execution (RCE) Vulnerability",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "markdown-it: markdown-it is has a Regular Expression Denial of Service (ReDoS)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "markdown-it-katex: Cross-Site Scripting in markdown-it-katex",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "mocha: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "sinon: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"severity": "high"
},
{
"type": "npm-audit",
"message": "terser-webpack-plugin: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"severity": "low"
},
{
"type": "npm-audit",
"message": "underscore: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite middleware may serve files starting with the same name with the public directory",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-plugin-static-copy: vite-plugin-static-copy files not included in `src` are possible to access with a crafted request",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior",
"severity": "low"
}
],
"status": "FAILED",
"scannedAt": "2026-05-07T06:36:11.914Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
English | 中文
🫱 Official Documentation
OpenMCP QQ Group
OpenMCP Discord Channel
An all-in-one vscode/trae/cursor plugin for MCP server debugging.
Integrated Inspector + MCP client basic functions, combining development and testing into one.
![]()
Test mcp tools, prompts and resources with a variety of tools.
![]()
Tested tools can be placed in the "Interactive Testing" module for large model interaction testing.
![]()
Complete project-level management panel for easier MCP project management at both project and global levels.
![]()
Supports multiple large models: DeepSeek, OpenAI, Qwen, Gemini, Grok, Mistral, MiniMax, Groq, Perplexity, Kimi, Ollama, OpenRouter and more.
![]()
Support XML mode and customized options for your tool selection.
![]()
once everything is tested and verified in openmcpent, you can deploy your mcp as an agent app with openmcp-sdk fastly and easily:
npm install openmcp-sdk
then deploy your agent with just lines of codes
import { OmAgent } from 'openmcp-sdk/service/sdk';
// create Agent
const agent = new OmAgent();
// Load configuration, which can be automatically generated after debugging with openmcp client
agent.loadMcpConfig('./mcpconfig.json');
// Read the debugged prompt
const prompt = await agent.getPrompt('hacknews', { topn: '5' });
// Execute the task
const res = await agent.ainvoke({ messages: prompt });
console.log('⚙️ Agent Response', res);
output
[2025/6/20 20:47:31] 🚀 [crawl4ai-mcp] 1.9.1 connected
[2025/6/20 20:47:35] 🤖 Agent wants to use these tools get_web_markdown
[2025/6/20 20:47:35] 🔧 using tool get_web_markdown
[2025/6/20 20:47:39] ✓ use tools success
[2025/6/20 20:47:46] 🤖 Agent wants to use these tools get_web_markdown, get_web_markdown, get_web_markdown
[2025/6/20 20:47:46] 🔧 using tool get_web_markdown
[2025/6/20 20:47:48] ✓ use tools success
[2025/6/20 20:47:48] 🔧 using tool get_web_markdown
[2025/6/20 20:47:54] ✓ use tools success
[2025/6/20 20:47:54] 🔧 using tool get_web_markdown
[2025/6/20 20:47:57] ✓ use tools success
⚙️ Agent Response
⌨️ Today's Tech Article Roundup
📌 How to Detect or Observe Passing Gravitational Waves?
Summary: This article explores the physics of gravitational waves, explaining their effects on space-time and how humans might perceive or observe this cosmic phenomenon.
Author: ynoxinul
Posted: 2 hours ago
Link: https://physics.stackexchange.com/questions/338912/how-would-a-passing-gravitational-wave-look-or-feel
📌 Learn Makefile Tutorial
Summary: A comprehensive Makefile tutorial for beginners and advanced users, covering basic syntax, variables, automatic rules, and advanced features to help developers manage project builds efficiently.
Author: dsego
Posted: 4 hours ago
Link: https://makefiletutorial.com/
📌 Hurl: Run and Test HTTP Requests in Plain Text
Summary: Hurl is a command-line tool that allows defining and executing HTTP requests in plain text format, ideal for data fetching and HTTP session testing. It supports chained requests, value capture, and response queries, making it perfect for testing REST, SOAP, and GraphQL APIs.
Author: flykespice
Posted: 8 hours ago
Link: https://github.com/Orange-OpenSource/hurl
Click here to learn how to make contribution to OpenMCP.
lstmkirigaya| Module | Feature | Priority | Status | Fix Priority |
|---------|---------|--------|---------|-----------|
| all | Complete basic infrastructure | Full Version | 100% | Done |
| render | Support cost analysis in chat mode | Iteration | 100% | Done |
| ext | Support basic MCP project management | Iteration | 100% | P0 |
| service | Support custom OpenAI-compatible large model integration | Full Version | 100% | Done |
| service | Support custom protocol large model integration | MVP | 0% | P1 |
| all | Support debugging multiple MCP Servers simultaneously | MVP | 100% | P0 |
| all | Support online verification via large models | Iteration | 100% | Done |
| all | Support saving user's server debugging work | Iteration | 100% | Done |
| render | High-risk operation permission confirmation | MVP | 0% | P1 |
| service | Hot update for connected MCP servers | MVP | 0% | P1 |
| all | System prompt management module | Iteration | 100% | Done |
| service | Tool-wise logging system | MVP | 0% | P1 |
| service | MCP security checks (prevent prompt injection, etc.) | MVP | 0% | P1 |
| service | Built-in OCR for character recognition | Iteration | 100% | Done |
OpenMCP adopts a layered modular design. By assembling different modules, it can be implemented in different modes on different platforms.
flowchart TD
subgraph OpenMCP Core Components
renderer[Renderer]
openmcpservice[OpenMCPService]
end
subgraph OpenMCP_Web["OpenMCP Web"]
renderer
openmcpservice
nginx[Nginx]
end
subgraph OpenMCP_Plugin["OpenMCP Plugin"]
renderer
openmcpservice
vscode[VSCode Plugin Code]
end
subgraph OpenMCP_App["OpenMCP App"]
renderer
openmcpservice
electron[Electron Code]
end
subgraph QQBot["OpenMCP-based QQ Bot"]
lagrange[Lagrange.OneBot]
openmcpservice
end
%% Dependencies
OpenMCP_Web -->|Frontend Rendering| renderer
OpenMCP_Web -->|Backend Service| openmcpservice
OpenMCP_Web -->|Reverse Proxy| nginx
OpenMCP_Plugin -->|UI Interface| renderer
OpenMCP_Plugin -->|Core Logic| openmcpservice
OpenMCP_Plugin -->|IDE Integration| vscode
OpenMCP_App -->|Frontend UI| renderer
OpenMCP_App -->|Local Service| openmcpservice
OpenMCP_App -->|Desktop Packaging| electron
QQBot -->|Protocol Adaptation| lagrange
QQBot -->|Business Logic| openmcpservice
Quickly setup and run OpenMCP development environment with a single command:
# Install CLI globally
npm install -g @agent-ruler/openmcp
# Create a new project
openmcp init my-project
cd my-project
# Start development servers (service + renderer)
openmcp dev
| Command | Description |
|---------|-------------|
| openmcp init <project-name> | Initialize a new OpenMCP project |
| openmcp dev | Start development mode (backend + frontend) |
| openmcp dev --service-only | Start only the backend service |
| openmcp dev --renderer-only | Start only the frontend renderer |
| openmcp start | Start production mode |
| openmcp update | Update to the latest version |
flowchart LR
D[renderer] <--> A[Dev Server]
<--ws--> B[service]
B <--mcp--> m(MCP Server)
Project setup:
npm run setup
Start dev server:
npm run serve
flowchart LR
D[renderer] <--> A[extention.ts] <--> B[service]
B <--mcp--> m(MCP Server)
Build for deployment:
npm run build
build vscode extension:
npm run build:plugin
Then just press F5, いただきます (Let's begin)
✅ npm run build ✅ npm run build:task-loop ✅ openmcpent UT ✅ openmcp-sdk UT ✅ vscode extension UT