@galaxy-stack/orbit-mcp

@galaxy-stack/orbit-mcp

Model Context Protocol server for the Orbit framework

Give AI coding agents first-class knowledge of Orbit: framework patterns, code scaffolding, and security review — through the Model Context Protocol.

What it does

Orbit MCP turns any AI coding agent (Claude, Cursor, Codex, …) into an Orbit-aware collaborator. It exposes:

Capability	Tools / Resources	Purpose
Knowledge	orbit_knowledge_topics, orbit_knowledge_read, orbit://knowledge/*	Module/controller/DI/GraphQL/microservices patterns, package map, security checklist
Scaffolding	orbit_scaffold_module, orbit_scaffold_graphql	Generate complete feature modules with validation, guards, and tests
Security review	orbit_security_review	Static checklist against pasted code — missing validation, guards, rate limits, GraphQL limits, hardcoded secrets, unsanitized HTML
Prompts	build_orbit_feature, harden_graphql_api, migrate_from_nestjs	Ready-made task prompts for agents

Quick start

Add to your agent's MCP config:

{
  "mcpServers": {
    "orbit": {
      "command": "bunx",
      "args": ["@galaxy-stack/orbit-mcp"]
    }
  }
}

Or run directly from a checkout:

bun run src/server.ts

Example session

Agent: List what you know about Orbit.

orbit_knowledge_topics → - module-pattern — Module pattern: Organize features into @Module classes… - security-checklist — Security checklist: Helmet headers, CSRF, rate limiting… …

Agent: Review this controller for security issues.

orbit_security_review with the pasted code → 1. [HIGH] Mutation endpoints lack input validation. Add ValidationPipe with a Zod schema… 2. [HIGH] State-changing endpoint without an auth guard…

Companion skill

The skills/orbit-framework/SKILL.md file is a portable skill definition covering the same guidance for agents that prefer skills over MCP. Copy it into your agent's skills directory or reference it in your prompt.

Protocol

Implements MCP 2025-03-26 over stdio (newline-delimited JSON-RPC 2.0): initialize, ping, tools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get. Zero runtime dependencies — runs under Bun or Node >= 18.

License

MIT