
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
legitshow-mcp
Advanced tools
MCP server for Legit.Show — let Claude Desktop / Cursor / Cline / Windsurf search a directory of launched software (web apps, SaaS, AI tools, MCP servers) by measured production-readiness through the Model Context Protocol.
Model Context Protocol server for Legit.Show. Plug it into Claude Desktop, Cursor, Cline, Windsurf, or any MCP host, and your model can search a directory of launched software by measured production-readiness — not GitHub stars — without ever leaving the chat.
// any MCP host config (Claude Desktop · Cursor · Cline · Windsurf · …)
{
"mcpServers": {
"legitshow": {
"command": "npx",
"args": ["-y", "legitshow-mcp"]
}
}
}
That's the entire install. No API key. The server is a stdio shim over the public
https://legit.show/api/search REST surface — one source of truth for the data.
Most "find me a tool" flows rank by GitHub stars or popularity. Legit.Show carries a deterministic 7-Frame production-readiness benchmark (Performance, Accessibility, Security, Privacy, Reliability, Standards, Discoverability) measured from the public surface — real Lighthouse, HTTP headers, live probes, no LLM in the scoring path. So your agent can filter by whether something is actually production-ready:
"find production-ready, open-source MCP servers with Security ≥ 80"
| Tool | What it does |
|---|---|
search_services({ query?, category?, min_scores?, is_open_source?, limit? }) | Search launched software by name or filter. Returns each match with its per-frame scores and its legit.show/s/<slug> page. |
fetch_docs() | Pull the canonical Legit.Show docs (llms.txt) — what Legit.Show is, the 7-Frame benchmark, and how to cite a service. |
Boundary: per-frame scores + summary + the page only. There is no combined overall total in the public data (it's a licensed product), so the model won't invent one.
claude_desktop_config.json{ "mcpServers": { "legitshow": { "command": "npx", "args": ["-y", "legitshow-mcp"] } } }
.cursor/mcp.json{ "mcpServers": { "legitshow": { "command": "npx", "args": ["-y", "legitshow-mcp"] } } }
Same three-line npx -y legitshow-mcp invocation in the host's MCP config.
GET https://legit.show/api/search?q=<name>
Filters: category, min_scores (e.g. {"security":80}), is_open_source, limit (≤50).
GET or POST. No key.
| Env | Default | Used by |
|---|---|---|
LEGIT_SEARCH_API | https://legit.show/api/search | search_services |
LEGIT_DOCS_BASE | https://legit.show | fetch_docs (llms.txt) |
MIT · operated by Madeflo, Inc.
FAQs
MCP server for Legit.Show — let Claude Desktop / Cursor / Cline / Windsurf search a directory of launched software (web apps, SaaS, AI tools, MCP servers) by measured production-readiness through the Model Context Protocol.
We found that legitshow-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.