HTTP

io.github.Abhishekkumar2021Published by GitHub account Abhishekkumar2021v0.1.0Updated Oct 24, 2026

HTTP/REST client with saved collections, env secrets, and SSRF-safe host allowlisting.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that gives an assistant an HTTP/REST client with saved collections, environment secrets and host-allowlisted, SSRF-safe requests.

What you can do
  • Send ad-hoc HTTP requests to allowed hosts and inspect the responses
  • Save and reuse request collections and environments, with secrets kept in environment variables
  • Restrict outbound calls to an allowlist of exact hosts or wildcard subdomains
  • Optionally enable mutating methods (POST, PUT, PATCH, DELETE) when explicitly turned on
When to use it
Useful when an assistant needs to call REST APIs, test endpoints, or replay saved API requests from the desktop, and you want outbound traffic limited to a known set of hosts.
Requirements
Runs locally over stdio, typically via npx with the npm package. Requires the HTTP_ALLOW_HOSTS environment variable listing permitted hosts; the server refuses to start without it. Set HTTP_WRITABLE to 1 or true to allow mutating methods. Desktop client only; network access to the target hosts is needed.
Before you install
Requests go out to third-party hosts, so anything sent is shared with them; keep the allowlist narrow. Mutating methods are blocked unless HTTP_WRITABLE is enabled, and once enabled the assistant can change or delete remote data. Saved environments may hold secrets, so review what is stored before use.

Installation

In SourceWeft

  1. Open HTTP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Each server lives in its own folder under servers/ and publishes to npm as an independent package, while sharing tooling through an npm workspace. Connect them to any MCP client — Claude Desktop, Claude Code, Cursor, and more.

Table of contents

Servers

ServerDescriptionStatus
notesLocal markdown notes: ranked full-text and semantic search, tags, todos, a [[wiki-link]] knowledge graph, daily notes + templates, and slash-command workflows (prompts)✅ Stable
filesSandboxed local filesystem: read, glob + content search, token-efficient edits, copy/move, soft-delete trash, zip, checksums, and dedup✅ Stable
githubGitHub: search repos/code/issues, read repos/issues/PRs/files, notifications, create issues — OAuth device flow or token✅ Stable
gitGit: status, log, diff, file history, branches/tags, gated stage/commit, and remote clone/fetch/pull/push — pure-JS, no git binary✅ Stable
sqlSQL databases: read-only query + schema introspection over Postgres & SQLite, gated writes✅ Stable
httpHTTP/REST client: ad-hoc requests + saved collections/environments, env secrets, host-allowlisted + SSRF-safe✅ Stable

More on the way: a Spotify controller, and others.

Quickstart

bash
git clone https://github.com/Abhishekkumar2021/mcp-suite.gitcd mcp-suitenpm install      # installs deps for every workspacenpm run build    # builds every server

Install

Every server ships through every common channel. For the Claude Code plugin, add the marketplace once — /plugin marketplace add Abhishekkumar2021/mcp-suite — then install per the table. See each server's README for full config.

ServerClaude Code pluginnpm (any client)Claude Desktop (MCPB)MCP registry
notes/plugin install notesnpx -y @abhishekmcp/notesdrag notes-*.mcpb from the latest releaseio.github.Abhishekkumar2021/notes
files/plugin install filesnpx -y @abhishekmcp/filesdrag files-*.mcpbio.github.Abhishekkumar2021/files
github/plugin install githubnpx -y @abhishekmcp/githubdrag github-*.mcpbio.github.Abhishekkumar2021/github
git/plugin install gitnpx -y @abhishekmcp/gitdrag git-*.mcpbio.github.Abhishekkumar2021/git
sql/plugin install sqlnpx -y @abhishekmcp/sqldrag sql-*.mcpbio.github.Abhishekkumar2021/sql
http/plugin install httpnpx -y @abhishekmcp/httpdrag http-*.mcpbio.github.Abhishekkumar2021/http

notes defaults to ~/notes; files requires FS_ROOTS (the directories it may touch). MCPB bundles install via Claude Desktop → Settings → Extensions.

Connecting to a client

Each server's README has full configuration instructions. As an example, to use the notes server with Claude Code:

bash
claude mcp add notes --env NOTES_DIR=$HOME/notes -- node "$(pwd)/servers/notes/dist/index.js"

Or with Claude Desktop (claude_desktop_config.json):

json
{  "mcpServers": {    "notes": {      "command": "node",      "args": ["/absolute/path/to/mcp-suite/servers/notes/dist/index.js"],      "env": { "NOTES_DIR": "/absolute/path/to/your/notes" }    }  }}

Architecture & conventions

A few principles hold across every server:

  • Pure-JS/WASM by default; native only when genuinely required. Servers run via npx/MCPB on any machine, so portable pure-JS/WebAssembly is strongly preferred and a native dependency is used only when genuinely required (gated + documented). In practice these servers are dependency-light: notes uses MiniSearch + WebAssembly embeddings, sql uses the sql.js WASM SQLite engine, and files uses fast-glob instead of ripgrep. npm audit stays clean.
  • Sandbox-first, layered design. Each server keeps a thin index.ts (tool registration only) over focused modules, with a single security boundary every path must pass through (realpath-containment, symlink-escape rejection, atomic writes).
  • Token-efficient by default. Pagination, head/tail/section reads, snippets, and compact graph refs keep tool output small.
  • Automated, hands-off releases. A GitHub Release tagged <server>-v<version> publishes to npm (with provenance), the official MCP registry, and attaches an MCPB bundle — all via OIDC, no secrets.
  • Tested in CI. Each server ships a committed node:test suite (unit + integration/security) run on every push.

Development

This is an npm workspaces monorepo.

bash
npm install                      # install all workspace dependencies (run once at the root)npm run build                    # build every servernpm run build -w servers/notes   # build a single servernpm test --workspaces --if-present  # run each server's test suitenpm run clean                    # remove all build output

Adding a new server

  1. Create servers/<name>/ with its own package.json (unique npm name) and a tsconfig.json that extends: "../../tsconfig.base.json".
  2. Put source in servers/<name>/src/.
  3. Run npm install at the root so the workspace picks it up.
  4. Add a row to the Servers table above.

All servers follow the naming standard (@abhishekmcp/<slug>). See CONTRIBUTING.md for detailed guidelines.

Publishing

Releases are automated. Cutting a GitHub Release tagged <server>-v<version> triggers publish.yml, which — authenticated entirely via GitHub OIDC (no NPM_TOKEN) — publishes the package to npm with provenance, registers it on the official MCP registry, and builds + attaches the MCPB bundle to the release.

bash
# bump servers/<name>/package.json, commit, then:gh release create <name>-v<version> --title "<name> v<version>" --notes "…"

Contributing

Contributions are welcome! Please read CONTRIBUTING.md and our Code of Conduct. Found a security issue? See SECURITY.md.

License

MIT © Abhishek

Source: README.md at commit dec6a82

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts