Scaffold secure-by-default MCP servers (TypeScript or JavaScript) with deny-all permissions, typed tool stubs, and audit hooks pre-wired.
mcpnew is a scaffolding CLI tool, not a functional MCP server. The only tool present is 'ping', a health check with minimal utility. The tool has a basic description and a simple input schema with one parameter. However, the server itself is STDIO-only and exposes no real domain functionality. The 'ping' tool is trivial (echo parameter with default 'pong') and does not represent a production-grade tool. The codebase focuses on scaffolding templates and audit logic, not on implementing a feature-rich MCP server. This is a meta-tool for generating other servers, not a server itself.
Health check. Allowed only when the manifest says so.
Only one trivial tool (ping). No domain functionality. This is a scaffolding CLI, not a functional MCP server.
Tool description 'Health check. Allowed only when the manifest says so.' is vague about when/why to use it and does not explain the permission-gating mechanism clearly.
No output schema documented. The tool returns an echo but the response structure is not specified for the LLM.
No error handling guidance. What happens if the tool is not allowed? How should the LLM recover?
STDIO-only transport. Not remotely accessible; cannot be used by hosted MCP clients. Hard cap at 50 for protocol readiness.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | <=2025-11-25 | v2 |