openmcp-client

Name: openmcp-client
Author: LSTM-Kirigaya

Issues

All in one vscode plugin for mcp developer

752stars

55forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/LSTM-Kirigaya/openmcp-client

Getting Started

Guides for using ai agents skills like openmcp-client.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 5/7/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor-model: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/tsdoc-config: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@originjs/vite-plugin-commonjs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/node-core-library: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/terminal: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/ts-command-line: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios is vulnerable to DoS attack through lack of data size check",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "copy-webpack-plugin: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "form-data: form-data uses unsafe random function in form-data for choosing boundary",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "jsonpath-plus: JSONPath Plus Remote Code Execution (RCE) Vulnerability",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "markdown-it: markdown-it is has a Regular Expression Denial of Service (ReDoS)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "markdown-it-katex: Cross-Site Scripting in markdown-it-katex",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mocha: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "sinon: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "terser-webpack-plugin: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "underscore: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite middleware may serve files starting with the same name with the public directory",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite-plugin-static-copy: vite-plugin-static-copy files not included in `src` are possible to access with a crafted request",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior",
      "severity": "low"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-07T06:36:11.914Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is openmcp-client?

openmcp-client is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by LSTM-Kirigaya. All in one vscode plugin for mcp developer. It has 752 GitHub stars.

Is openmcp-client safe to use?

openmcp-client failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install openmcp-client?

Clone the repository with "git clone https://github.com/LSTM-Kirigaya/openmcp-client" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is openmcp-client written in?

openmcp-client is primarily written in TypeScript. It is open-source under LSTM-Kirigaya on GitHub, so you can review or fork the full source.

Are there alternatives to openmcp-client?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh openmcp-client against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

superpowers

by obra

An agentic skills framework & software development methodology that works.

234,966

pentest-agents reddit-mcp-buddy

English | 中文

🫱 Official Documentation

OpenMCP QQ Group

OpenMCP Discord Channel

OpenMCP

An all-in-one vscode/trae/cursor plugin for MCP server debugging.

👆 Full Video

openmcpent

Integrated Inspector + MCP client basic functions, combining development and testing into one.

Test mcp tools, prompts and resources with a variety of tools.

Tested tools can be placed in the "Interactive Testing" module for large model interaction testing.

Complete project-level management panel for easier MCP project management at both project and global levels.

Supports multiple large models: DeepSeek, OpenAI, Qwen, Gemini, Grok, Mistral, MiniMax, Groq, Perplexity, Kimi, Ollama, OpenRouter and more.

Support XML mode and customized options for your tool selection.

openmcp-sdk

once everything is tested and verified in openmcpent, you can deploy your mcp as an agent app with openmcp-sdk fastly and easily:

npm install openmcp-sdk

then deploy your agent with just lines of codes

import { OmAgent } from 'openmcp-sdk/service/sdk';

// create Agent
const agent = new OmAgent();
    
// Load configuration, which can be automatically generated after debugging with openmcp client
agent.loadMcpConfig('./mcpconfig.json');

// Read the debugged prompt
const prompt = await agent.getPrompt('hacknews', { topn: '5' });    

// Execute the task
const res = await agent.ainvoke({ messages: prompt });

console.log('⚙️ Agent Response', res);

output

[2025/6/20 20:47:31] 🚀 [crawl4ai-mcp] 1.9.1 connected
[2025/6/20 20:47:35] 🤖 Agent wants to use these tools get_web_markdown
[2025/6/20 20:47:35] 🔧 using tool get_web_markdown
[2025/6/20 20:47:39] ✓  use tools success
[2025/6/20 20:47:46] 🤖 Agent wants to use these tools get_web_markdown, get_web_markdown, get_web_markdown
[2025/6/20 20:47:46] 🔧 using tool get_web_markdown
[2025/6/20 20:47:48] ✓  use tools success
[2025/6/20 20:47:48] 🔧 using tool get_web_markdown
[2025/6/20 20:47:54] ✓  use tools success
[2025/6/20 20:47:54] 🔧 using tool get_web_markdown
[2025/6/20 20:47:57] ✓  use tools success

⚙️ Agent Response
⌨️ Today's Tech Article Roundup

📌 How to Detect or Observe Passing Gravitational Waves?
Summary: This article explores the physics of gravitational waves, explaining their effects on space-time and how humans might perceive or observe this cosmic phenomenon.
Author: ynoxinul
Posted: 2 hours ago
Link: https://physics.stackexchange.com/questions/338912/how-would-a-passing-gravitational-wave-look-or-feel

📌 Learn Makefile Tutorial
Summary: A comprehensive Makefile tutorial for beginners and advanced users, covering basic syntax, variables, automatic rules, and advanced features to help developers manage project builds efficiently.
Author: dsego
Posted: 4 hours ago
Link: https://makefiletutorial.com/

📌 Hurl: Run and Test HTTP Requests in Plain Text
Summary: Hurl is a command-line tool that allows defining and executing HTTP requests in plain text format, ideal for data fetching and HTTP session testing. It supports chained requests, value capture, and response queries, making it perfect for testing REST, SOAP, and GraphQL APIs.
Author: flykespice
Posted: 8 hours ago
Link: https://github.com/Orange-OpenSource/hurl

🔗 Document of openmcp-sdk

Want to become a contributor ?

Click here to learn how to make contribution to OpenMCP.

Join Our Community

Email: zhelonghuang@qq.com
QQ: 782833642
Wechat: contact lstmkirigaya
Discord: https://discord.gg/SKTZRf6NzU

TODO

Feature Roadmap

Module	Feature	Priority	Status	Fix Priority
`all`	Complete basic infrastructure	`Full Version`	100%	`Done`
`render`	Support cost analysis in chat mode	`Iteration`	100%	`Done`
`ext`	Support basic MCP project management	`Iteration`	100%	`P0`
`service`	Support custom OpenAI-compatible large model integration	`Full Version`	100%	`Done`
`service`	Support custom protocol large model integration	`MVP`	0%	`P1`
`all`	Support debugging multiple MCP Servers simultaneously	`MVP`	100%	`P0`
`all`	Support online verification via large models	`Iteration`	100%	`Done`
`all`	Support saving user's server debugging work	`Iteration`	100%	`Done`
`render`	High-risk operation permission confirmation	`MVP`	0%	`P1`
`service`	Hot update for connected MCP servers	`MVP`	0%	`P1`
`all`	System prompt management module	`Iteration`	100%	`Done`
`service`	Tool-wise logging system	`MVP`	0%	`P1`
`service`	MCP security checks (prevent prompt injection, etc.)	`MVP`	0%	`P1`
`service`	Built-in OCR for character recognition	`Iteration`	100%	`Done`

Project Concept

OpenMCP adopts a layered modular design. By assembling different modules, it can be implemented in different modes on different platforms.

flowchart TD
    subgraph OpenMCP Core Components
        renderer[Renderer]
        openmcpservice[OpenMCPService]
    end

    subgraph OpenMCP_Web["OpenMCP Web"]
        renderer
        openmcpservice
        nginx[Nginx]
    end

    subgraph OpenMCP_Plugin["OpenMCP Plugin"]
        renderer
        openmcpservice
        vscode[VSCode Plugin Code]
    end

    subgraph OpenMCP_App["OpenMCP App"]
        renderer
        openmcpservice
        electron[Electron Code]
    end

    subgraph QQBot["OpenMCP-based QQ Bot"]
        lagrange[Lagrange.OneBot]
        openmcpservice
    end

    %% Dependencies
    OpenMCP_Web -->|Frontend Rendering| renderer
    OpenMCP_Web -->|Backend Service| openmcpservice
    OpenMCP_Web -->|Reverse Proxy| nginx

    OpenMCP_Plugin -->|UI Interface| renderer
    OpenMCP_Plugin -->|Core Logic| openmcpservice
    OpenMCP_Plugin -->|IDE Integration| vscode

    OpenMCP_App -->|Frontend UI| renderer
    OpenMCP_App -->|Local Service| openmcpservice
    OpenMCP_App -->|Desktop Packaging| electron

    QQBot -->|Protocol Adaptation| lagrange
    QQBot -->|Business Logic| openmcpservice

OpenMCP CLI

Quickly setup and run OpenMCP development environment with a single command:

# Install CLI globally
npm install -g @agent-ruler/openmcp

# Create a new project
openmcp init my-project
cd my-project

# Start development servers (service + renderer)
openmcp dev

CLI Commands

Command	Description
`openmcp init <project-name>`	Initialize a new OpenMCP project
`openmcp dev`	Start development mode (backend + frontend)
`openmcp dev --service-only`	Start only the backend service
`openmcp dev --renderer-only`	Start only the frontend renderer
`openmcp start`	Start production mode
`openmcp update`	Update to the latest version

📖 Full CLI Documentation

Development

renderer : Frontend UI definitions
service : Test components for renderer , including a simple forwarding layer
src : VSCode plugin definitions

Renderer & Service Development

flowchart LR
D[renderer] <--> A[Dev Server] 
<--ws--> B[service]
B <--mcp--> m(MCP Server)

Project setup:

npm run setup

Start dev server:

npm run serve

Extension Development

flowchart LR
D[renderer] <--> A[extention.ts] <--> B[service]
B <--mcp--> m(MCP Server)

Build for deployment:

npm run build

build vscode extension:

npm run build:plugin

Then just press F5, いただきます (Let's begin)

CI Pipeline

✅ npm run build ✅ npm run build:task-loop ✅ openmcpent UT ✅ openmcp-sdk UT ✅ vscode extension UT