curatedmcp

curatedmcp

The CuratedMCP Agent. One CLI to discover, run, audit, and govern every MCP server your AI tools (Claude, Cursor, Windsurf, Copilot, Gemini) use.

# 10-second risk scan of your machine — no signup
npx curatedmcp audit

Plug it in once. Add servers anytime. Audit and govern them from one place.

What you get

Command	What it does
curatedmcp audit	Scan your MCP configs for risky servers (high/medium/low). Zero auth, instant value.
curatedmcp (no args)	Run as an MCP hub server over stdio for Claude, Cursor, Windsurf, etc.
curatedmcp add <slug>	Add a server from the CuratedMCP catalog to your stack.
curatedmcp remove <slug>	Remove a server from your stack.
curatedmcp list	Show your current stack.
curatedmcp init	Print the config snippet to drop into your AI client.
curatedmcp guard -- <cmd>	Run a server behind the local action firewall.
curatedmcp login	Authenticate the agent to your CuratedMCP account.
curatedmcp sync	Pull your team's registry config and push audit results.

1. Audit (the wedge — start here)

npx curatedmcp audit

Scans every MCP config file on your machine (Claude Desktop, Cursor, Windsurf, Claude Code, …), classifies each server against the CuratedMCP catalog, and flags:

• 🔴 HIGH — unverified or known-risky servers with credentials
• 🟡 MEDIUM — verified servers running outside catalog defaults
• 🟢 VERIFIED — known-good catalog servers

No signup, no cloud, no data leaves your machine. Logged in? Add --sync to push the result to your dashboard.

2. Run as the MCP Hub

If you use MCP servers across multiple AI clients, you've felt this pain: configure GitHub MCP in Claude Desktop, then re-do it in Cursor, then in Windsurf. New agent ships? Re-paste every config.

The agent fixes that. It's one MCP entry that fans out to every server you've added, in every AI client.

   Claude   Cursor   Windsurf   Copilot   Gemini
       \      \      |      /      /
        ┌──────────────────────────┐
        │       curatedmcp         │   ← one config in each agent
        │     (the MCP hub)        │
        └────┬──────┬──────┬───────┘
             │      │      │
          GitHub  Postgres  Stripe   ← `add`'d once, available everywhere

Add it to your AI client

{
  "mcpServers": {
    "curatedmcp": {
      "command": "npx",
      "args": ["-y", "curatedmcp"]
    }
  }
}

Client	Path
Claude Desktop	~/Library/Application Support/Claude/claude_desktop_config.json (mac) / %APPDATA%\Claude\claude_desktop_config.json (win)
Cursor	~/.cursor/mcp.json
Windsurf	~/.codeium/windsurf/mcp_config.json
Claude Code	~/.claude/mcp.json (or .claude/mcp.json per-project)

Add servers to your stack

npx curatedmcp add github          # prompts for GITHUB_TOKEN
npx curatedmcp add postgres --env DATABASE_URL=postgres://...
npx curatedmcp list

Restart your AI client

Tools appear with a <slug>__ prefix:

• github__create_issue
• postgres__query
• filesystem__read_file

3. Guard (local action firewall)

npx curatedmcp guard -- npx -y @modelcontextprotocol/server-github

Wraps an MCP server with a local policy engine that gates every tools/call against ~/.curatedmcp/guard-policy.json. Default policy allows read, prompts on write, blocks destructive.

npx curatedmcp guard --dashboard --port 7878 -- npx -y @some/server
# Then open http://localhost:7878 for the live action log

4. Login + sync (for teams)

Once you have a CuratedMCP account, link the CLI to it:

npx curatedmcp login                  # paste a registry key from your dashboard
npx curatedmcp sync                   # pull team registry config + push audit results
npx curatedmcp sync --team acme-eng   # pick a specific team if you're in more than one

Sync pulls the locked-down server list approved by your team and merges it into your local stack — so every developer's machine runs the same vetted set of servers.

Config files

~/.curatedmcp/stack.json — your stack, plain JSON, hand-editable, version-controllable:

{
  "version": 1,
  "entries": [
    {
      "slug": "github",
      "name": "GitHub",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx" },
      "addedAt": "2026-05-01T10:14:00.000Z"
    }
  ]
}

Set "disabled": true on an entry to skip it without removing it.

Other files (created on first use):

• ~/.curatedmcp/auth.json — login token (mode 0600)
• ~/.curatedmcp/guard-policy.json — firewall policy
• ~/.curatedmcp/launcher.json — anonymous client UUID

In-agent discovery

The agent itself exposes discovery tools to your AI client, so you can ask:

"Find me an MCP server for Postgres." "What's the best Stripe MCP?" "Add the Postgres MCP server to my stack."

The agent uses search_servers, get_server_details, and add_to_stack to do all of that without you leaving the chat.

Privacy

• All config is local at ~/.curatedmcp/. No cloud sync unless you login.
• Anonymous telemetry only (event names like "search", "add"). Disable with --no-telemetry or CURATOR_TELEMETRY=false.
• Audit results stay on your machine unless you login and run --sync.

Compatibility

• Works with Claude Desktop, Claude Code, Cursor, Windsurf, Copilot, Gemini, OpenAI Agents — anything that supports MCP over stdio.
• Node.js ≥ 18.

Migrating from the old packages

The agent replaces three earlier packages, which are now deprecated:

Old	New
@curatedmcp/launcher	curatedmcp (no args) / curatedmcp add / curatedmcp list
@curatedmcp/auditor (aka mcp-audit)	curatedmcp audit
@curatedmcp/sentinel (aka sentinel)	curatedmcp guard

A launcher bin alias is kept for back-compat.

Links

• 🌐 curatedmcp.com/launcher
• 📚 Marketplace
• 🐙 GitHub
• 💬 Issues

MIT licensed.