Kitsune MCP

pip install kitsune-mcp # recommended # or uvx kitsune-mcp # isolated env via uv, no venv setup # or npx kitsune-mcp # npm (delegates to uvx internally)

{ "mcpServers": { "kitsune": { "command": "kitsune-mcp" } } }

Also works with OpenClaw, Zed, and any MCP-compatible client.

Lean profile at rest:9 tools · ~1,774 tokens/turn(status,search,auth,shapeshift,call,auto, plus theconnect/release/reloadREPL trio) — measured viapython examples/benchmark.py.

Building an MCP normally means: edit → restart client → lose session → re-test. Kitsune turns that into anMCP REPLin one session — andconnect/release/reloadare in thedefault lean profile, so this works on a plainpip installwith noKITSUNE_TOOLS=all.

connect("uvx --from . my-mcp-server", name="dev") # start child process shapeshift("dev") # mount tools → client sees them call("summarize", arguments={"url": "https://example.com"}) # … edit the tool in your editor … reload("dev") # release → restart fresh code → remount, one call call("summarize", arguments={"url": "https://example.com"})

reload("dev")folds the whole cycle — kill the stale process, start your edited code, remount so the client sees the new schemas — into a single call. It also removes the classic footgun: callingconnect()again after an editwithoutreleasing first hands you back theoldprocess;reloadalways releases first.

shapeshift(server_id)picks a transport (stdio / HTTP+SSE / WebSocket / Docker), connects, fetchestools/list, and registers each tool as a native FastMCP tool with the server's real schema. The client getsnotifications/tools/list_changedand sees first-class tools — no wrapper indirection.

shapeshift()with no args deregisters proxies, closes the connection, and returns to the lean baseline.

search()fans out across no-auth registries by default. AddSMITHERY_API_KEYfor hosted HTTP servers (no local install).

Reach into 130k community servers only works if unknown code can becontained. Consent, sandbox, and pins are product features — not footnotes.

- confirm=True(orKITSUNE_TRUST) before community / local mounts
- Community npm/PyPI mounts cage in hardened Docker by default(when Docker is present);sandbox=FalseorKITSUNE_SANDBOX=offopts out,sandbox=Trueforces it,KITSUNE_SANDBOX=allcages every local mount
- TOFU pins in~/.kitsune/pins.json— later malicious publishes don't silently replace what you already ran

KITSUNE_TRUST=communitywaives the gate;status()warns when that override is active.

confirm=Trueis not a human-approval boundary.The model can set it. Real approval belongs in your client's tool-approval UI.

2. Shell injection at spawn.Install commands are validated (no& ; | $ \\n/../) and launched withcreate_subprocess_exec— no shell. Vets the launch line, not what the package does once running.

3. SSRF.fetch()and registry HTTP are HTTPS-only; private/loopback/non-global hosts blocked;every redirect hop re-validated(KITSUNE_ALLOW_LOCAL_FETCH=1to opt out).

4. Credential exposure.~/.kitsune/.envandoauth/at mode0600; OAuth 2.1 + PKCE S256 + DCR (RFC 7591); missing-cred warnings before calls;auth(id, "logout")clears tokens (RFC 7009 where available).

5. Docker sandbox for untrusted local servers — on by default.Communitynpm/pypi/githubmounts (and theauto()/call()/run()exec paths) cage automatically when Docker is onPATH; no host FS,--cap-drop ALL, read-only rootfs, RAM/PID caps. Cred env vars forwarded bynameonly (docker -e KEY) — never in argv,ps, or the pool key. First sandboxed mount pullsnode:22-slim/uv:python3.13-bookworm-slim. Best-effort: no Docker → runs uncaged with a nudge (an explicitsandbox=Truehard-fails instead). Opt out per-call withsandbox=Falseor session-wide withKITSUNE_SANDBOX=off. Filesystem-style servers need host paths and don't fit the sandbox.

- Cage needs Docker + opt-in-trusted sources.Community mounts cage by defaultonly when Docker is present; without it (or withsandbox=False/KITSUNE_SANDBOX=off, or for medium/high-trust sources) local stdio runs as your user — full FS, network, inherited env. Process isolation ≠ a security boundary.
- Docker ≠ kernel boundary.Hardened flags blunt escalation / fork bombs / FS tampering; not a guarantee against container escape. No default non-root /--network none(most servers need egress).
- TOFU ≠ digest pin.Pins a version, not a content hash.github:/git+/ hand-writtenconnect()commands aren't pinned. High assurance: pin by digest or vendor.
- Tools first.Resource/prompt proxying is narrower (URI templates skipped; HTTP path differs). "Any server" means tool execution.

Bottom line:strong for supervised developer and personal use.Do not run unattended with production admin, billing, or security credentials in default local mode.Keep Docker installed so the default cage engages, and prefer client approval for untrusted packages.

Optional. Keep daily drivers (GitHub, filesystem, …) native if you prefer. When a config is crowded,status()flags other always-on servers so you can collapse to one Kitsune entry and reach them viashapeshift:

GATEWAY ⚠ 1 other server(s) active in claude-desktop (~8 extra tools in context) Run setup() to harvest their credentials and reduce bloat

setup() # preview setup(action="harvest") # keys → ~/.kitsune/.env (non-destructive) setup(action="absorb") # register for shapeshift() setup(project=True) # project mcp.json with only Kitsune

Never modifies existing configs without explicit confirmation. (setupis forge-profile.)

Warm pool re-attach within a session:0 ms.

Useprewarm(forge) when you know you'll need a server soon.

Real vsfully-mounted always-onor clientswithoutTool Search. On Claude Code 2.1.7+ with native deferral, this is mostly not a Kitsune-specific win. Product pitch is reach + REPL above — not this table.

¹ Break-even: Kitsune pays off past one medium server, or two-plus small ones sharing the single floor. Multi-server stack (GitHub+fs+git → Notion suite):~72–85%vs fully-mounted always-on — same caveat as above.

Fewer visible tools also helps selection reliability (Gorilla / ToolBench); on modern clients Tool Search delivers much of that focus forconfiguredservers. Kitsune-specific accuracy bench: not yet — contributions welcome.

Re-read on everyshapeshift/call— add keys mid-session, no restart.

Search order:CWD/.env→~/.env→~/.kitsune/.env(last wins).

auth("BRAVE_API_KEY", "sk-...") # → ~/.kitsune/.env

{ "env": { "KITSUNE_TOOLS": "shapeshift,call,auth" } } # subset { "env": { "KITSUNE_TOOLS": "all" } } # forge

Default~/.kitsune/(credentials, pins, OAuth, session). Relocate withKITSUNE_HOME=/tmp/kitsune-iso.

KITSUNE_SANDBOX=community # Docker-cage community npm/PyPI mounts KITSUNE_SANDBOX=all # cage every local mount KITSUNE_TRUST=community # waive confirm gate (status warns) KITSUNE_REPIN=1 # adopt newer pinned version

{ "env": { "SMITHERY_API_KEY": "your-key" } }

Switch forms mid-session — take only the slice you need:

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

The MCP server for Bitrix24 provides AI assistants with structured access to the Bitrix24 API. It delivers up-to-date method descriptions, parameters, and valid values, allowing assistants to work with precise data instead of guesswork. This reduces code errors and accelerates Bitrix24 integration development.

One remote MCP server for 500+ production APIs — Stripe, HubSpot, Postgres, Gmail, and more. OAuth and API key auth, credential management, and a CLI.

Single tool to control all 100+ API integrations, and UI components

Agent-native developer Q&A API with MCP + A2A endpoints for citations, job pickup, and answer submission.

Self-hosted MCP gateway: convert REST/SOAP/GraphQL/SQL APIs into MCP tools with 29 pre-built adapters, OAuth2, RBAC and audit log.

A universal bridge to convert any web API into an MCP server, supporting multiple transport types.

Dynamically creates MCP servers from web API configurations, integrating any REST API, GraphQL endpoint, or web service into MCP-compatible tools.

Hosted MCP server and coordination layer for AI coding agents — live API contracts, database schema, frontend/backend mismatch detection, and shared handoff tickets for Claude Code, Cursor, Codex, and Lovable.