curatedmcp

The CuratedMCP Agent. One CLI to discover, run, audit, and govern every MCP server your AI tools (Claude, Cursor, Windsurf, Copilot, Gemini) use.

# 10-second risk scan of your machine — no signup
npx curatedmcp audit

Plug it in once. Add servers anytime. Audit and govern them from one place.

---

What you get

Command	What it does
curatedmcp audit	Scan your MCP configs for risky servers (high/medium/low). Zero auth, instant value.
curatedmcp (no args)	Run as an MCP hub server over stdio for Claude, Cursor, Windsurf, etc.
curatedmcp add <slug>	Add a server from the CuratedMCP catalog to your stack.
curatedmcp remove <slug>	Remove a server from your stack.
curatedmcp list	Show your current stack.
curatedmcp init	Print the config snippet to drop into your AI client.
curatedmcp guard -- <cmd>	Run a server behind the local action firewall.
curatedmcp login	Authenticate the agent to your CuratedMCP account.
curatedmcp sync	Pull your team's registry config and push audit results.

---

1. Audit (the wedge — start here)

npx curatedmcp audit

Scans every MCP config file on your machine (Claude Desktop, Cursor, Windsurf, Claude Code, …), classifies each server against the CuratedMCP catalog, and flags:

• 🔴 HIGH — unverified or known-risky servers with credentials
• 🟡 MEDIUM — verified servers running outside catalog defaults
• 🟢 VERIFIED — known-good catalog servers

No signup, no cloud, no data leaves your machine. Logged in? Add --sync to push the result to your dashboard.

---

2. Run as the MCP Hub

If you use MCP servers across multiple AI clients, you've felt this pain: configure GitHub MCP in Claude Desktop, then re-do it in Cursor, then in Windsurf. New agent ships? Re-paste every config.

The agent fixes that. It's one MCP entry that fans out to every server you've added, in every AI client.

   Claude   Cursor   Windsurf   Copilot   Gemini
       \      \      |      /      /
        ┌──────────────────────────┐
        │       curatedmcp         │   ← one config in each agent
        │     (the MCP hub)        │
        └────┬──────┬──────┬───────┘
             │      │      │
          GitHub  Postgres  Stripe   ← `add`'d once, available everywhere

Add it to your AI client

{
  "mcpServers": {
    "curatedmcp": {
      "command": "npx",
      "args": ["-y", "curatedmcp"]
    }
  }
}

Client	Path
Claude Desktop	~/Library/Application Support/Claude/claude_desktop_config.json (mac) / %APPDATA%\Claude\claude_desktop_config.json (win)
Cursor	~/.cursor/mcp.json
Windsurf	~/.codeium/windsurf/mcp_config.json
Claude Code	~/.claude/mcp.json (or .claude/mcp.json per-project)

Add servers to your stack

npx curatedmcp add github          # prompts for GITHUB_TOKEN
npx curatedmcp add postgres --env DATABASE_URL=postgres://...
npx curatedmcp list

Restart your AI client

Tools appear with a <slug>__ prefix:

• github__create_issue
• postgres__query
• filesystem__read_file

---

3. Guard (local action firewall)

npx curatedmcp guard -- npx -y @modelcontextprotocol/server-github

Wraps an MCP server with a local policy engine that gates every tools/call against ~/.curatedmcp/guard-policy.json. Default policy allows read, prompts on write, blocks destructive.

npx curatedmcp guard --dashboard --port 7878 -- npx -y @some/server
# Then open http://localhost:7878 for the live action log

---

4. Login + sync (for teams)

Once you have a CuratedMCP account, link the CLI to it:

npx curatedmcp login                  # paste a registry key from your dashboard
npx curatedmcp sync                   # pull team registry config + push audit results
npx curatedmcp sync --team acme-eng   # pick a specific team if you're in more than one

Sync pulls the locked-down server list approved by your team and merges it into your local stack — so every developer's machine runs the same vetted set of servers.

---

Config files

~/.curatedmcp/stack.json — your stack, plain JSON, hand-editable, version-controllable:

{
  "version": 1,
  "entries": [
    {
      "slug": "github",
      "name": "GitHub",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx" },
      "addedAt": "2026-05-01T10:14:00.000Z"
    }
  ]
}

Set "disabled": true on an entry to skip it without removing it.

Other files (created on first use):

• ~/.curatedmcp/auth.json — login token (mode 0600)
• ~/.curatedmcp/guard-policy.json — firewall policy
• ~/.curatedmcp/launcher.json — anonymous client UUID

---

In-agent discovery

The agent itself exposes discovery tools to your AI client, so you can ask:

"Find me an MCP server for Postgres." "What's the best Stripe MCP?" "Add the Postgres MCP server to my stack."

The agent uses search_servers, get_server_details, and add_to_stack to do all of that without you leaving the chat.

---

Privacy

• All config is local at ~/.curatedmcp/. No cloud sync unless you login.
• Anonymous telemetry only (event names like "search", "add"). Disable with --no-telemetry or CURATOR_TELEMETRY=false.
• Audit results stay on your machine unless you login and run --sync.

---

Compatibility

• Works with Claude Desktop, Claude Code, Cursor, Windsurf, Copilot, Gemini, OpenAI Agents — anything that supports MCP over stdio.
• Node.js ≥ 18.

---

Migrating from the old packages

The agent replaces three earlier packages, which are now deprecated:

Old	New
@curatedmcp/launcher	curatedmcp (no args) / curatedmcp add / curatedmcp list
@curatedmcp/auditor (aka mcp-audit)	curatedmcp audit
@curatedmcp/sentinel (aka sentinel)	curatedmcp guard

A launcher bin alias is kept for back-compat.

---

Links

• 🌐 curatedmcp.com/launcher
• 📚 Marketplace
• 🐙 GitHub
• 💬 Issues

MIT licensed.