What's Allowed MCP Server

by stcmain Your server? Claim it

local only

What's Allowed runs on your own machine — the client starts it, so there is no endpoint to ping. 48 installs a week from npm. Last commit 1 Oct 2026.

Merged agent permission rules: which settings file wins, and which rules your client ignores.

Installs per day peak 13 · avg 5 · -17% w/w

a month agotoday

Installs / week

npm · whats-allowed-mcp

Stars

0 open issues

1 Oct 2026

Last commit

no releases in 90 days

MIT

License

TypeScript

What the code does

We read the source, 3 d ago · rules 995398eba69f

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Deletes files or strips permissions src/lint.ts:308

              "`devbox run rm -rf .`. These runners are not in Claude Code's built-in wrapper list, so the " +

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch What's Allowed and you get told the day something new turns up.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add whats-allowed-mcp -- npx -y whats-allowed-mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "whats-allowed-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "whats-allowed-mcp"
      ]
    }
  }
}

~/.codex/config.toml

[mcp_servers.whats-allowed-mcp]
command = "npx"
args = ["-y", "whats-allowed-mcp"]

.cursor/mcp.json

{
  "mcpServers": {
    "whats-allowed-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "whats-allowed-mcp"
      ]
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "whats-allowed-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "whats-allowed-mcp"
      ]
    }
  }
}

Alternatives to What's Allowed

same job, measured the same way

Envibe

by dominic-righthere

Secure permission layer between AI agents and your .env files

49 installs/wk local only

Command Mail

by commandmail

One inbox for all your addresses: your AI agent reads, sorts, drafts and sends with your permission.

answering

What's Loaded

by stcmain

What fills your agent's context window before a session starts: skill descriptions, memory files.

68 installs/wk local only

CleanSlop

by cleanslop

Your coding agent scans your pushed code, reads what's worth fixing, fixes it, and rescans.

answering

Marsell

by marsell-official

Manage content, marketing and sales in Marsell with your own AI. Read work and act with permission.

answering

Vertical Flows

by verticalflows

View client requests, prepare actions and approve work within your firm's permissions.

answering

WireCat WhatsApp

by wirecat

Your WhatsApp account for agents: read, search and send messages. Sign in with the wa CLI first.

3 462 installs/wk local only

Supercut

by supercut

Read recordings, transcripts, frames, and comments with your permissions.

answering

What's Allowed — questions

Answers built from our own checks of this server.

Why is there no uptime for What's Allowed?

What's Allowed runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package whats-allowed-mcp was installed 48 times last week.

How do I connect What's Allowed?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls whats-allowed-mcp straight from npm; nothing to host, nothing to sign up for.

How many people use What's Allowed?

The npm package whats-allowed-mcp was installed 48 times in the last week. Week over week that is -17%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is What's Allowed open source?

Yes — it is published under the MIT licence, written in TypeScript and 1 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.