Mcp Launcher

io.github.oneprofile-devPublished by GitHub account oneprofile-devv2.1.1Updated Oct 24, 2026

Single MCP hub: discover, add, audit, and govern MCP servers across every AI client.

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP hub that discovers, adds, audits, and governs other MCP servers across AI clients from one entry.

What you can do
Runs as a single stdio MCP hub that fans out to every server you add, so one config entry in each AI client exposes all of them with slug-prefixed tool names. Provides discovery tools such as search_servers, get_server_details, and add_to_stack, plus CLI commands to audit MCP configs for risky servers, add or remove servers, list your stack, and print client config snippets. A guard mode wraps another MCP server with a local policy engine that gates tool calls, and login plus sync pull a team registry config and push audit results.
When to use it
Useful when you run MCP servers across several AI clients and want to configure them once instead of re-pasting configs. Also suited to reviewing which MCP servers already exist on a machine and to enforcing a shared, vetted server list across a team.
Requirements
Local process started via npx, so Node.js 18 or newer is required. Desktop clients only; no web executable. No authentication is needed for audit or hub use; login uses a registry key from a CuratedMCP account. Optional environment variable CURATOR_API_URL overrides the API base URL, and CURATOR_TELEMETRY=false disables telemetry.
Before you install
The stack file stores server credentials in plain JSON, for example GITHUB_TOKEN and DATABASE_URL, so protect that file. Guard mode gates tool calls but its default policy allows reads and prompts on writes, so review the policy before relying on it. Login and sync send data to CuratedMCP, and anonymous telemetry is on unless disabled.

Installation

In SourceWeft

  1. Open Mcp Launcher in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

curatedmcp

[npm version] [npm downloads] [License: MIT] [Node.js ≥18]

The CuratedMCP Agent. One CLI to discover, run, audit, and govern every MCP server your AI tools (Claude, Cursor, Windsurf, Copilot, Gemini) use.

bash
# 10-second risk scan of your machine — no signupnpx curatedmcp audit

Plug it in once. Add servers anytime. Audit and govern them from one place.

What you get

CommandWhat it does
curatedmcp auditScan your MCP configs for risky servers (high/medium/low). Zero auth, instant value.
curatedmcp (no args)Run as an MCP hub server over stdio for Claude, Cursor, Windsurf, etc.
curatedmcp add <slug>Add a server from the CuratedMCP catalog to your stack.
curatedmcp remove <slug>Remove a server from your stack.
curatedmcp listShow your current stack.
curatedmcp initPrint the config snippet to drop into your AI client.
curatedmcp guard -- <cmd>Run a server behind the local action firewall.
curatedmcp loginAuthenticate the agent to your CuratedMCP account.
curatedmcp syncPull your team's registry config and push audit results.

1. Audit (the wedge — start here)

bash
npx curatedmcp audit

Scans every MCP config file on your machine (Claude Desktop, Cursor, Windsurf, Claude Code, …), classifies each server against the CuratedMCP catalog, and flags:

  • 🔴 HIGH — unverified or known-risky servers with credentials
  • 🟡 MEDIUM — verified servers running outside catalog defaults
  • 🟢 VERIFIED — known-good catalog servers

No signup, no cloud, no data leaves your machine. Logged in? Add --sync to push the result to your dashboard.

2. Run as the MCP Hub

If you use MCP servers across multiple AI clients, you've felt this pain: configure GitHub MCP in Claude Desktop, then re-do it in Cursor, then in Windsurf. New agent ships? Re-paste every config.

The agent fixes that. It's one MCP entry that fans out to every server you've added, in every AI client.

   Claude   Cursor   Windsurf   Copilot   Gemini       \      \      |      /      /        ┌──────────────────────────┐        │       curatedmcp         │   ← one config in each agent        │     (the MCP hub)        │        └────┬──────┬──────┬───────┘             │      │      │          GitHub  Postgres  Stripe   ← `add`'d once, available everywhere

Add it to your AI client

json
{  "mcpServers": {    "curatedmcp": {      "command": "npx",      "args": ["-y", "curatedmcp"]    }  }}
ClientPath
Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.json (mac) / %APPDATA%\Claude\claude_desktop_config.json (win)
Cursor~/.cursor/mcp.json
Windsurf~/.codeium/windsurf/mcp_config.json
Claude Code~/.claude/mcp.json (or .claude/mcp.json per-project)

Add servers to your stack

bash
npx curatedmcp add github          # prompts for GITHUB_TOKENnpx curatedmcp add postgres --env DATABASE_URL=postgres://...npx curatedmcp list

Restart your AI client

Tools appear with a <slug>__ prefix:

  • github__create_issue
  • postgres__query
  • filesystem__read_file

3. Guard (local action firewall)

bash
npx curatedmcp guard -- npx -y @modelcontextprotocol/server-github

Wraps an MCP server with a local policy engine that gates every tools/call against ~/.curatedmcp/guard-policy.json. Default policy allows read, prompts on write, blocks destructive.

bash
npx curatedmcp guard --dashboard --port 7878 -- npx -y @some/server# Then open http://localhost:7878 for the live action log

4. Login + sync (for teams)

Once you have a CuratedMCP account, link the CLI to it:

bash
npx curatedmcp login                  # paste a registry key from your dashboardnpx curatedmcp sync                   # pull team registry config + push audit resultsnpx curatedmcp sync --team acme-eng   # pick a specific team if you're in more than one

Sync pulls the locked-down server list approved by your team and merges it into your local stack — so every developer's machine runs the same vetted set of servers.

Config files

~/.curatedmcp/stack.json — your stack, plain JSON, hand-editable, version-controllable:

json
{  "version": 1,  "entries": [    {      "slug": "github",      "name": "GitHub",      "command": "npx",      "args": ["-y", "@modelcontextprotocol/server-github"],      "env": { "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx" },      "addedAt": "2026-05-01T10:14:00.000Z"    }  ]}

Set "disabled": true on an entry to skip it without removing it.

Other files (created on first use):

  • ~/.curatedmcp/auth.json — login token (mode 0600)
  • ~/.curatedmcp/guard-policy.json — firewall policy
  • ~/.curatedmcp/launcher.json — anonymous client UUID

In-agent discovery

The agent itself exposes discovery tools to your AI client, so you can ask:

"Find me an MCP server for Postgres." "What's the best Stripe MCP?" "Add the Postgres MCP server to my stack."

The agent uses search_servers, get_server_details, and add_to_stack to do all of that without you leaving the chat.

Privacy

  • All config is local at ~/.curatedmcp/. No cloud sync unless you login.
  • Anonymous telemetry only (event names like "search", "add"). Disable with --no-telemetry or CURATOR_TELEMETRY=false.
  • Audit results stay on your machine unless you login and run --sync.

Compatibility

  • Works with Claude Desktop, Claude Code, Cursor, Windsurf, Copilot, Gemini, OpenAI Agents — anything that supports MCP over stdio.
  • Node.js ≥ 18.

Migrating from the old packages

The agent replaces three earlier packages, which are now deprecated:

OldNew
@curatedmcp/launchercuratedmcp (no args) / curatedmcp add / curatedmcp list
@curatedmcp/auditor (aka mcp-audit)curatedmcp audit
@curatedmcp/sentinel (aka sentinel)curatedmcp guard

A launcher bin alias is kept for back-compat.

Links

MIT licensed.

Source: README.md at commit 80f4d67

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v2.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts