Env Contract Mcp

io.github.mrfentmenPublished by GitHub account mrfentmenv1.0.1Updated Nov 5, 2026

Local value-free environment contract and configuration drift inspection. Tools include inspect...

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that compares declared environment variable names with references in a project's source and config files to surface configuration drift.

What you can do
  • Inspect a project's environment contract: report declared names from .env.example and dotenv files, referenced names found in source and config files, and the files where each occurs.
  • Identify missing names that are referenced but not declared, and unused names that are declared but never referenced.
  • Bound the analysis to a workspace root and skip node_modules, build output, coverage and Git internals.
When to use it
Useful before a project fails at runtime because of a missing or stale environment variable, or when onboarding to an unfamiliar repository and wanting a quick map of which configuration names are used where. It is a heuristic check, not a substitute for a real build, deployment check or secret scanner.
Requirements
Runs as a local stdio process installed from the npm package env-contract-mcp (Node.js, built with npm install and npm run build). Optionally set ENV_CONTRACT_ROOT to bound analysis to a workspace root; it defaults to the parent of the MCP package. No authentication or API keys are declared.
Before you install
It reads local project files, so point it at a workspace root you are comfortable exposing to the assistant. It reports only names and bounded file paths and does not read or emit environment values, but matching is heuristic, so treat results as hints rather than proof of a correct configuration.

Installation

In SourceWeft

  1. Open Env Contract Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

env-contract-mcp

Env Contract is a local MCP tool for finding configuration drift before a project fails at runtime. It compares variable names declared in .env.example and dotenv files with likely environment references in source and config files.

Tool

  • inspect_contract: report declared names, referenced names, missing names, unused names, and the files where they occur.

Safety

  • Reads local project files only; it never fetches URLs.
  • Never reads or emits environment values. Only names and bounded file paths are returned.
  • Ignores node_modules, build output, coverage, and Git internals.
  • Caps file count, file size, recursion depth, and output.
  • Matching is heuristic and is not a replacement for a build, deployment check, or secret scanner.

Set ENV_CONTRACT_ROOT to bound analysis to a workspace root. It defaults to the parent of the MCP package when launched normally.

Run

bash
npm installnpm run buildnode dist/index.js

Source: README.md at commit e50f0ed

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 22, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.