What's Allowed MCP Server

by stcmain Your server? Claim it

local only

What's Allowed runs on your own machine — the client starts it, so there is no endpoint to ping. 33 installs a week from npm. Last commit 12 Aug 2026.

Merged agent permission rules: which settings file wins, and which rules your client ignores.

Installs per day peak 284 · avg 10

a month agotoday

Installs / week

npm · whats-allowed-mcp

Stars

0 open issues

12 Aug 2026

Last commit

0 releases in 90 days

MIT

License

JavaScript

What the code does

We read the source, 21 h ago · rules 3dff92dd89df

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Deletes files or strips permissions src/lint.ts:308

              "`devbox run rm -rf .`. These runners are not in Claude Code's built-in wrapper list, so the " +

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch What's Allowed and you get told the day something new turns up.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add whats-allowed-mcp -- npx -y whats-allowed-mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "whats-allowed-mcp": {
      "args": [
        "-y",
        "whats-allowed-mcp"
      ],
      "command": "npx"
    }
  }
}

~/.codex/config.toml

[mcp_servers.whats-allowed-mcp]
command = "npx"
args = ["-y", "whats-allowed-mcp"]

.cursor/mcp.json

{
  "mcpServers": {
    "whats-allowed-mcp": {
      "args": [
        "-y",
        "whats-allowed-mcp"
      ],
      "command": "npx"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "whats-allowed-mcp": {
      "args": [
        "-y",
        "whats-allowed-mcp"
      ],
      "command": "npx"
    }
  }
}

Alternatives to What's Allowed

same job, measured the same way

Envibe

by dominic-righthere

Secure permission layer between AI agents and your .env files

41 installs/wk local only

What's Loaded

by stcmain

What fills your agent's context window before a session starts: skill descriptions, memory files.

51 installs/wk local only

Vertical Flows

by verticalflows

View client requests, prepare actions and approve work within your firm's permissions.

answering

Memocore

by memocore

Shared memory for all your AI agents, your whole team and every MCP client — save, search, recall.

answering

Afterpaths

by burnssa

Session memory for AI coding agents. Search past sessions, extract rules, and track what works.

139 installs/wk local only

Context Autopilot

by chiragbachani

Mines your Claude Code and Cursor sessions into evidence-based CLAUDE.md / AGENTS.md rules.

88 installs/wk local only

Sparkbites

by educlopez

Search 500+ curated design websites and install DESIGN.md files directly from your AI agent.

28 installs/wk local only

RE-call MCP Memory Server

by giulioder

Agent memory on your own Postgres that flags superseded facts and abstains instead of guessing.

928 installs/wk local only

What's Allowed — questions

Answers built from our own checks of this server.

Why is there no uptime for What's Allowed?

What's Allowed runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package whats-allowed-mcp was installed 33 times last week.

How do I connect What's Allowed?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It runs locally, so the command pulls whats-allowed-mcp straight from npm; nothing to host, nothing to sign up for.

How many people use What's Allowed?

The npm package whats-allowed-mcp was installed 33 times in the last week. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is What's Allowed open source?

Yes — it is published under the MIT licence, written in JavaScript and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.