Is MCP X safe to use?

MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install MCP X?

MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.

What AI clients work with MCP X?

MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is MCP X actively maintained?

MCP X is less actively maintained — last commit was 298 days ago. It has 141 GitHub stars.

MCP X

Name: MCP X
Author: TimeCyber

uvx · by TimeCyber

这是一个MCP客户端，让你轻松配置各个大模型，对接各种MCP Server而开发。This is an MCP client that allows you to easily configure various large models and develop interfaces with various MCP servers.

141 3 tools GitHub npm PyPI

No known CVEs

Apache-2.0 license

Stale

Last commit 298d ago

Works with most clients

Transport: stdio, sse, http

3 tools · ~145 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 1h ago

This server has been archived and is no longer actively maintained.

Edit this pageView history

MCP X is an MCP server that 这是一个MCP客户端，让你轻松配置各个大模型，对接各种MCP Server而开发。This is an MCP client that allows you to easily configure various large models and develop interfaces with various MCP servers. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 74/100 on MCPpedia's security, maintenance and efficiency rubric.

AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "MCP_SERVER_NAME": {
      "url": "YOUR_SSE_SERVER_URL",
      "enabled": true,
      "transport": "sse"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-x)](https://mcppedia.org/s/mcp-x)

Read me

What MCP X does

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

74/100across 5 weighted dimensions

How we score →

0255075100

−26

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

12 fixed

CVE-2026-55404high · fixedCVSS 7.5

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files.

Affected: >= 0Fixed in 2026.7.4source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH strea

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.ur

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download st

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~145 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is MCP X safe to use?: MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install MCP X?: MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can MCP X do?: MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.
What AI clients work with MCP X?: MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is MCP X actively maintained?: MCP X is less actively maintained — last commit was 298 days ago. It has 141 GitHub stars.

Similar servers

Others in ai-ml

View all →

Dsh MCP Client97

MCP client bridge: connects to MCP servers and registers their tools on ctx.tools

186.4k 4

Modelcontextprotocol96

The official MCP server implementation for the Perplexity API Platform

2.5k 4

Antigravity Workspace Template96

Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.

1.3k 2

Claude Flow95

Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

68.9k 4

MCP Security Weekly

Get CVE alerts and security updates for MCP X and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

This server has been archived and is no longer actively maintained.

Edit this pageView history

AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "MCP_SERVER_NAME": {
      "url": "YOUR_SSE_SERVER_URL",
      "enabled": true,
      "transport": "sse"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-x)](https://mcppedia.org/s/mcp-x)

Read me

What MCP X does

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

README

MCP-X Agent 🤿 🤖

English | 中文

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Use Cases 🎯

AI Agent

MCP-X good at agent and understanding various types of content through its powerful AI agents. Here's an example of food content agent:

Key Features Demonstrated:

🍽️ Food Content Analysis: Detailed breakdown of dishes, ingredients, and nutritional information
🎯 Targeted Recommendations: Personalized suggestions based on user preferences
📊 Structured Output: Well-organized information with clear categorization
💬 Interactive Chat: Natural conversation flow with comprehensive responses

Perfect for:

Food bloggers and content creators
Nutritionists and health professionals
Restaurant owners and chefs
Anyone interested in food analysis and recommendations

This showcases how MCP-X can transform simple queries into detailed, actionable insights across various domains.

What's New

We've just rolled out major updates to improve your experience:

📚 Brand New Knowledge Base Feature (v0.1.0)

MCP-X now supports powerful knowledge base management!

Knowledge Management: Upload, view, search, and delete knowledge documents (supports txt, md, json, csv, xml, html formats)
Smart Search: Full-text search by filename and content with highlighted matching results
Chat References: One-click reference to knowledge base documents in chat, AI can answer based on your knowledge base content
Document Preview: Real-time document content preview with file metadata display
Responsive Design: Perfect adaptation for desktop and mobile devices

🚀 AI Agent System

MCP-X as a full-fledged AI agent platform.

New Agent Sidebar: Discover, manage, and search for specialized AI agents.
One-Click Talk: Instantly talk to any agent for your current task.
Agent Profiles: See what each agent can do, with details on their skills and example uses.
Organized for You: Agents are sorted into categories like content creation, data analysis, and programming.

🎨 A Fresh New Look

We've redesigned the app to be cleaner and more intuitive.

New Side Navigation: A permanent sidebar gives you quick access to Chat, Agents, Knowledge Base, Tools, Models, and System settings.
Clearer Icons: Navigation icons now have text labels so you know exactly where you're going.
Consistent Design: We've unified the color scheme and layout for a more polished feel.

This update also includes a move to a more professional icon set (react-icons) and various under-the-hood CSS and component optimizations for better performance.

Features 🎯

🌐 Universal LLM Support: Compatible with ChatGPT, Anthropic, Ollama and OpenAI-compatible models
💻 Cross-Platform: Available for Windows, MacOS, and Linux
📚 Knowledge Base Management: Upload, search, and reference knowledge documents, let AI answer based on your materials
🔄 Model Context Protocol: Enabling seamless MCP AI agent integration on both stdio and SSE mode
🤖 AI Agent System: Rich professional AI agents covering various domain-specific needs
🌍 Multi-Language Support: Traditi

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

74/100across 5 weighted dimensions

How we score →

0255075100

−26

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

12 fixed

CVE-2026-55404high · fixedCVSS 7.5

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Affected: >= 0Fixed in 2026.7.4source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~145 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is MCP X safe to use?: MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install MCP X?: MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can MCP X do?: MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.
What AI clients work with MCP X?: MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is MCP X actively maintained?: MCP X is less actively maintained — last commit was 298 days ago. It has 141 GitHub stars.

Similar servers

Others in ai-ml

View all →

Dsh MCP Client97

MCP client bridge: connects to MCP servers and registers their tools on ctx.tools

186.4k 4

Modelcontextprotocol96

The official MCP server implementation for the Perplexity API Platform

2.5k 4

Antigravity Workspace Template96

Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.

1.3k 2

Claude Flow95

Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

68.9k 4

MCP Security Weekly

Get CVE alerts and security updates for MCP X and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?