Graneth MCP Server

by graneth Your server? Claim it

answering

Graneth is answering right now. Last checked 4 min ago. 112 installs a week from npm. It exposes 4 tools. Last commit 8 Sep 2026.

Pre-flight check for AI coding agents: hallucinated packages + secrets, 6 ecosystems, no account.

Installs per day peak 77 · avg 17 · +257% w/w

a month agotoday

Uptime history 47 days of history

47 days agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

189 ms

Response time

average over 24h

112

Installs / week

npm and PyPI

What changed 1

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 21 August 2026. No other catalogue keeps this.

21 Aug a tool description was rewritten get_findings

Nothing serious here today

Today is the operative word: we check Graneth every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 4 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-server --transport http https://graneth.com/api/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://graneth.com/api/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.mcp-server]
url = "https://graneth.com/api/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://graneth.com/api/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "mcp-server": {
      "url": "https://graneth.com/api/mcp"
    }
  }
}

Available tools 4

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

auto

auto_remediate

Generate an automated security fix for a specific finding. Creates a GitHub PR with the patched code. Verifies the fix with Level 1 SAST before opening the PR. Requires authentication, 3 credits, and ANTHROPIC_API_KEY.

findings

get_findings

Retrieve the security findings recorded by your most recent scan of this repository, optionally filtered by exact file path or severity. Returns an error if you have never scanned it — that is not the same answer as no findings. Checks that could not run are reported as a count, never listed among the findings.

pre

pre_flight_check

Security pre-flight check for local file changes BEFORE committing. Run this whenever you are about to suggest `git commit`, `git push`, or open a pull request — especially when changes touch auth, secrets, SQL queries, package.json / requirements.txt, or environment variables. Returns CLEAR or BLOCKED with specific findings and remediation steps.

scan

scan_repository

Trigger a Level 1 + Level 2 security scan on a GitHub pull request. Returns SAST findings, taint flows, entropy-detected secrets, and (for PRO users) LLM-triaged results. Requires Graneth authentication.

Endpoints

URL	Transport	State	Latency	Checked
https://graneth.com/api/mcp	streamable-http	answering	167 ms	4 min ago

Alternatives to Graneth

same job, measured the same way

Think MCP

by agentutil

Intent security pre-flight checks for autonomous AI agents.

23 installs/wk local only

Opzyai Security Check

by opzyai

Local-first security check for AI coding agents: secrets, .env exposure, git-history leaks, CVEs.

50 installs/wk local only

SRIFT

by srift

Secure P2P file transfer and encrypted chat for AI agents. No accounts, no API keys.

288 installs/wk 8 tools answering

Pop Pay

by 100xpercent

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

119 installs/wk local only

q-ring

by i4ctime

OS keychain secrets for AI coding agents, over MCP.

712 installs/wk local only

Switchboard

by wkoverfield

One firewall and password manager for all your AI coding agents' MCP servers and secrets.

89 installs/wk local only

Mess

by mess

Inventory of your service accounts, kept current by your coding agents. Metadata only, no secrets.

answering

pkgxray

by adamsjack711-ux

Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.

92 installs/wk local only

Graneth — questions

Answers built from our own checks of this server.

What can Graneth do?

It exposes 4 tools, read directly from the server on our last check. Among them: auto_remediate, get_findings, pre_flight_check, scan_repository. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Graneth working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 189 ms. The bar chart above shows every period we have measured.

How do I connect Graneth?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Graneth need an API key?

No. Graneth completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Graneth?

It answers our handshake in 189 ms on average, which is faster than 68% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use Graneth?

The npm package @graneth/mcp-server was installed 112 times in the last week. Week over week that is +257%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Graneth open source?

Yes — it is published under the MIT licence, written in TypeScript, 0 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.