Is io.github.VouchlyAI/pincer safe to use?

io.github.VouchlyAI/pincer has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.VouchlyAI/pincer?

io.github.VouchlyAI/pincer supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.VouchlyAI/pincer do?

io.github.VouchlyAI/pincer provides 12 tools: gemini_generate, openai_chat, openai_list_models, openai_compatible_chat, openai_compatible_list_models and 7 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.VouchlyAI/pincer?

io.github.VouchlyAI/pincer is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.VouchlyAI/pincer actively maintained?

io.github.VouchlyAI/pincer is less actively maintained — last commit was 90 days ago. It has 5 GitHub stars.

io.github.VouchlyAI/pincer

pincer-mcp

Secure grip for your agent's secrets - security-hardened MCP gateway with proxy token architecture

5 16/wk 12 tools GitHub npm

No known CVEs

No license

Maintained

Last commit 90d ago

Works with most clients

Transport: stdio, sse, http

12 tools · ~620 tok

Grade B · 0.3% of 200K ctx

Edit this pageView history

Security AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-vouchlyai-pincer": {
      "args": [
        "-y",
        "pincer-mcp"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-vouchlyai-pincer)](https://mcppedia.org/s/io-github-vouchlyai-pincer)

Read me

What io.github.VouchlyAI/pincer does

Pincer-MCP is a security-hardened Model Context Protocol (MCP) gateway that eliminates the "Lethal Trifecta" vulnerability in agentic AI systems. By acting as a stateless intermediary, Pincer ensures agents never see your real API keys.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'pincer-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

78/100across 5 weighted dimensions

How we score →

0255075100

−22

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked pincer-mcp against OSV.dev.

Inventory

Tools (12)

Click any tool to inspect its schema.

~620 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VouchlyAI/pincer safe to use?: io.github.VouchlyAI/pincer has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VouchlyAI/pincer?: io.github.VouchlyAI/pincer supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.VouchlyAI/pincer do?: io.github.VouchlyAI/pincer provides 12 tools: gemini_generate, openai_chat, openai_list_models, openai_compatible_chat, openai_compatible_list_models and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.VouchlyAI/pincer?: io.github.VouchlyAI/pincer is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.VouchlyAI/pincer actively maintained?: io.github.VouchlyAI/pincer is less actively maintained — last commit was 90 days ago. It has 5 GitHub stars.

Similar servers

Others in security / ai-ml

View all →

Memory MCP Server98

Persistent memory using a knowledge graph

85.9k 5

Context Mode95

Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.

15.1k 6

Gemini Cli95

An open-source AI agent that brings the power of Gemini directly into your terminal.

104.3k 8

Better Chatbot94

Just a Better Chatbot. Powered by Agent & MCP & Workflows.

1.1k 4

MCP Security Weekly

Get CVE alerts and security updates for io.github.VouchlyAI/pincer and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-vouchlyai-pincer": {
      "args": [
        "-y",
        "pincer-mcp"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-vouchlyai-pincer)](https://mcppedia.org/s/io-github-vouchlyai-pincer)

Read me

What io.github.VouchlyAI/pincer does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'pincer-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Pincer MCP 🦀

🔒 The Problem

Current AI agents store long-lived API keys in plain-text .env files or local databases. If compromised via prompt injection or host intrusion, attackers gain direct access to your:

Database passwords
Third-party API keys

✨ The Solution: Proxy Token Architecture

Pincer implements a "blindfold" security model:

Agent knows: Only a unique proxy token (pxr_abc123...)
Pincer knows: Mapping of proxy tokens → real API keys (encrypted in OS keychain)
Agent never sees: The actual credentials

sequenceDiagram
    participant Agent
    participant Pincer
    participant Vault (OS Keychain)
    participant External API

    Agent->>Pincer: tools/call + proxy_token: pxr_abc123
    Pincer->>Vault: Decrypt real API key
    Vault-->>Pincer: gemini_api_key: AIzaSy...
    Pincer->>External API: API call with real key
    External API-->>Pincer: Response
    Pincer->>Pincer: Scrub key from memory
    Pincer-->>Agent: Response (no credentials)

📦 Available Tools

gemini_generate: Secure Google Gemini API calls.
openai_chat: Chat completions with OpenAI GPT models (gpt-4o, gpt-4-turbo, gpt-3.5-turbo, etc.).
openai_list_models: List all available OpenAI models.
openai_compatible_chat: Chat completions with any OpenAI-compatible API (Azure OpenAI, Ollama, vLLM, etc.).
openai_compatible_list_models: List models from custom OpenAI-compatible endpoints.
claude_chat: Chat completions with Anthropic Claude models (Claude 3.5 Sonnet, Opus, Haiku).
openrouter_chat: Unified API access to 100+ models from multiple providers (OpenAI, Anthropic, Google, Meta, etc.).
openrouter_list_models: List all available models across OpenRouter providers.
openwebui_chat: OpenAI-compatible interface for self-hosted LLMs.
openwebui_list_models: Discover available models on an OpenWebUI instance.
gpg_sign_data: Sign data or files using a GPG/PGP private key stored in Pincer's vault. (Keyless Execution — agent never sees the key)
gpg_decrypt: Decrypt PGP-encrypted data using a vault-stored private key.

🔑 GPG Key Management

# Generate a new GPG keypair (private key stored in vault)
pincer key generate --name "Release Signing" --email dev@example.com

# Import an existing PGP private key
pincer key import ./my-key.asc --passphrase "my-passphrase"

# List all stored GPG keys
pincer key list

# Export public key (safe to share)
pincer key export <key-id>

# Authorize an agent for signing
pincer agent authorize mybot gpg_sign_data --key <key-id>

(More callers coming soon!)

🚀 Quick Star

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

78/100across 5 weighted dimensions

How we score →

0255075100

−22

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked pincer-mcp against OSV.dev.

Inventory

Tools (12)

Click any tool to inspect its schema.

~620 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VouchlyAI/pincer safe to use?: io.github.VouchlyAI/pincer has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VouchlyAI/pincer?: io.github.VouchlyAI/pincer supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.VouchlyAI/pincer do?: io.github.VouchlyAI/pincer provides 12 tools: gemini_generate, openai_chat, openai_list_models, openai_compatible_chat, openai_compatible_list_models and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.VouchlyAI/pincer?: io.github.VouchlyAI/pincer is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.VouchlyAI/pincer actively maintained?: io.github.VouchlyAI/pincer is less actively maintained — last commit was 90 days ago. It has 5 GitHub stars.