Is io.github.YawLabs/mcp-compliance safe to use?

io.github.YawLabs/mcp-compliance has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.

How do I install io.github.YawLabs/mcp-compliance?

io.github.YawLabs/mcp-compliance supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.YawLabs/mcp-compliance do?

io.github.YawLabs/mcp-compliance provides 8 tools: Options, Grading, Setup, Tools, Requirements and 3 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.YawLabs/mcp-compliance?

io.github.YawLabs/mcp-compliance is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.YawLabs/mcp-compliance actively maintained?

io.github.YawLabs/mcp-compliance is actively maintained - last commit was 14 days ago. It has 2 GitHub stars.

io.github.YawLabs/mcp-compliance

@yawlabs/mcp-compliance

CLI tool and MCP server that tests MCP servers for spec compliance

2 589/wk 8 tools GitHub npm PyPI

No known CVEs

MIT license

Actively maintained

Last commit 14d ago

Works with most clients

Transport: stdio, sse, http

8 tools · ~249 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 2d ago

Edit this pageView history

io.github.YawLabs/mcp-compliance is an MCP server that CLI tool and MCP server that tests MCP servers for spec compliance. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 87/100 on MCPpedia's security, maintenance and efficiency rubric.

Developer Tools

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-compliance": {
      "args": [
        "/c",
        "npx",
        "-y",
        "@yawlabs/mcp-compliance@latest",
        "mcp"
      ],
      "command": "cmd"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-yawlabs-mcp-compliance-yawlabs)](https://mcppedia.org/s/io-github-yawlabs-mcp-compliance-yawlabs)

Read me

What io.github.YawLabs/mcp-compliance does

CLI tool and MCP server that tests MCP servers for spec compliance

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

87/100across 5 weighted dimensions

How we score →

0255075100

−13

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

4 fixed

CVE-2026-27735high · fixed

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

In `mcp-server-git` versions prior to 2026.1.14, the `git_add` tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's `repo.index.add(`, which did not enforce working-tree boundary checks for relative paths. As a result, relative paths containing `../` sequences that resolved outside the repository were accepted and staged into the Git index, potentially allowing sensitive files to be exfiltrated via subsequent commit

Affected: >= 0Fixed in 2026.1.14source →

CVE-2025-68145high · fixed

mcp-server-git has missing path validation when using --repository flag

In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the r

Affected: >= 0Fixed in 2025.12.18source →

CVE-2025-68144high · fixed

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are a

Affected: >= 0Fixed in 2025.12.18source →

CVE-2025-68143high · fixed

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 20

Affected: >= 0Fixed in 2025.9.25source →

Inventory

Tools (8)

Click any tool to inspect its schema.

~249 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.YawLabs/mcp-compliance safe to use?: io.github.YawLabs/mcp-compliance has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install io.github.YawLabs/mcp-compliance?: io.github.YawLabs/mcp-compliance supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.YawLabs/mcp-compliance do?: io.github.YawLabs/mcp-compliance provides 8 tools: Options, Grading, Setup, Tools, Requirements and 3 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.YawLabs/mcp-compliance?: io.github.YawLabs/mcp-compliance is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.YawLabs/mcp-compliance actively maintained?: io.github.YawLabs/mcp-compliance is actively maintained - last commit was 14 days ago. It has 2 GitHub stars.

Similar servers

Others in developer-tools

View all →

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.6k 2

Supabase MCP Server96

Manage Supabase projects — databases, auth, storage, and edge functions

3.0k 4

Mcp Gitlab96

MCP server for using the GitLab API

2.1k 12

com.mux/mcp95

The official MCP Server for the Mux API

182 7

MCP Security Weekly

Get CVE alerts and security updates for io.github.YawLabs/mcp-compliance and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Developer Tools

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-compliance": {
      "args": [
        "/c",
        "npx",
        "-y",
        "@yawlabs/mcp-compliance@latest",
        "mcp"
      ],
      "command": "cmd"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-yawlabs-mcp-compliance-yawlabs)](https://mcppedia.org/s/io-github-yawlabs-mcp-compliance-yawlabs)

Read me

What io.github.YawLabs/mcp-compliance does

CLI tool and MCP server that tests MCP servers for spec compliance

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

README

@yawlabs/mcp-compliance

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

Test any MCP server for spec compliance. Two test suites — 88 tests for MCP 2025-11-25 and 103 tests for MCP 2026-07-28 — covering transport, lifecycle, tools, resources, prompts, error handling, schema validation, and security. The tool probes the server and grades the newest spec revision it speaks, or you pin one with --spec-version. Works against HTTP endpoints (https://my-server.com/mcp) and stdio servers (npx @modelcontextprotocol/server-filesystem /tmp) alike. CLI, MCP server, and programmatic API.

Built and maintained by Yaw Labs.

Why this tool?

MCP servers are multiplying fast — but most ship without compliance testing. Broken transport handling, missing error codes, malformed schemas, and silent capability violations are common. Hand-rolling test scripts is tedious and incomplete.

This tool solves that:

Two spec revisions, one tool — 88 tests for MCP 2025-11-25 (the initialize + session era) and 103 tests for MCP 2026-07-28 (stateless, per-request _meta, server/discover, caching hints, MRTR). Both cover the same 8 categories: transport, lifecycle, tools, resources, prompts, error handling, schema validation, and security. HTTP-specific tests (CORS, TLS, header validation, rate limiting) are gated out on stdio: the 2025-11-25 suite runs 85 tests on HTTP and 55 on stdio, the 2026-07-28 suite 99 and 75.
Auto-detected revision — one server/discover probe tells the tool which era the server speaks; dual-era servers are graded against 2026-07-28 with a warning. Pin either revision with --spec-version. See Spec version.
Capability-driven — tests adapt to what the server declares. If it says it supports tools, tool tests become required. No false failures for features the server doesn't claim.
Graded scoring — A-F letter grade with a weighted score (required tests 70%, optional 30%). One number to communicate compliance.
CI-ready — --strict mode exits with code 1 on required test failures. Drop it into any pipeline.
Spec-referenced — every test links to the exact section of the MCP specification it validates. No ambiguity about what's being tested or why.
Three interfaces — CLI for humans, MCP server for AI assistants, programmatic API for integration.
Published methodology — the testing methodology and rule catalog are open (CC BY 4.0) so anyone can build compatible tooling or fork the rules.

Quick start

Remote HTTP server:

npx @yawlabs/mcp-compliance@latest test https://my-server.com/mcp

Local stdio server (the vast majority of MCP servers on npm):

# Pass the command directly, Inspector-style
npx @yawlabs/mcp-compliance@latest test npx @modelcontextprotocol/server-filesystem /tmp

# Or a local build
npx @yawlabs/mcp-compliance@latest test node ./dist/server.js

# With env vars
npx @yawlabs/mcp-compliance@latest test -E GITHUB_TOKEN=$GITHUB_TOKEN -- np

... [View full README on GitHub](https://github.com/yawlabs/mcp-compliance#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

87/100across 5 weighted dimensions

How we score →

0255075100

−13

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

4 fixed

CVE-2026-27735high · fixed

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Affected: >= 0Fixed in 2026.1.14source →

CVE-2025-68145high · fixed

mcp-server-git has missing path validation when using --repository flag

Affected: >= 0Fixed in 2025.12.18source →

CVE-2025-68144high · fixed

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

Affected: >= 0Fixed in 2025.12.18source →

CVE-2025-68143high · fixed

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

Affected: >= 0Fixed in 2025.9.25source →

Inventory

Tools (8)

Click any tool to inspect its schema.

~249 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.YawLabs/mcp-compliance safe to use?: io.github.YawLabs/mcp-compliance has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install io.github.YawLabs/mcp-compliance?: io.github.YawLabs/mcp-compliance supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.YawLabs/mcp-compliance do?: io.github.YawLabs/mcp-compliance provides 8 tools: Options, Grading, Setup, Tools, Requirements and 3 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.YawLabs/mcp-compliance?: io.github.YawLabs/mcp-compliance is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.YawLabs/mcp-compliance actively maintained?: io.github.YawLabs/mcp-compliance is actively maintained - last commit was 14 days ago. It has 2 GitHub stars.