mcp-cap

Wiring up an MCP server is a trust decision made at runtime. There is no manifest, no static schema file, and the tool list only becomes visible after the process starts. npx fetches the latest version on every invocation, so the capability surface you reviewed last month may differ from what runs today. Most clients hand the entire environment to a program you have not read line by line, and a tool's real danger often hides in its description text and JSON Schema, the two fields nobody diff-reviews. mcp-cap exists to close that gap.

It starts the server in strict read-only mode, calling only the four listing methods (initialize, tools/list, resources/list, prompts/list) and never invoking a single tool. It then writes the declared capability surface, schema annotations, inferred risk levels, and supporting evidence into a lock file you can commit to version control. A subsequent verify re-inspects and diffs against that seal, using distinct exit codes to distinguish unchanged, surface changed, a dangerous capability added, and inspection failed. By default the server receives only PATH, HOME, and temporary directories; environment variable values are neither printed nor stored, eliminating an entire class of credential leakage by design.

Built for developers and security teams who integrate third-party MCP servers into agent pipelines: you need an auditable, committable capability approval record that can be reviewed in pull requests, and you want a fast, deterministic answer to one question, since I last approved this server, did it gain a capability it should not have.