dev-mcp-servers

# dev-mcp-servers

Ten small MCP servers for everyday development and security checks. Each one is a separate npm package you add to Claude Code, Claude Desktop, Cursor or any other MCP client with one line, and each does one job well: look up vulnerabilities, grade security headers, decode a JWT, test a regex, explain a cron expression, validate JSON against a schema, lint an OpenAPI document or a Dockerfile, read statistics out of a git repository, or build an `llms.txt`.

All servers are TypeScript on the official `@modelcontextprotocol/sdk`, speak stdio only, validate every input with zod, bound their inputs and run time, send no telemetry, and ship with `node:test` suites that cover every tool.

## Servers

| Server | Purpose | Install |
|---|---|---|
| [osv-advisories](packages/osv-advisories) | Query OSV.dev for known vulnerabilities by package and version; scan `package-lock.json`, `requirements.txt`, `poetry.lock` and `go.sum` | `claude mcp add osv-advisories -- npx -y @basitalisandhu/mcp-osv-advisories@0.1.1` |
| [security-headers](packages/security-headers) | Fetch a public URL's response headers and grade CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookies | `claude mcp add security-headers -- npx -y @basitalisandhu/mcp-security-headers@0.1.1` |
| [jwt-tools](packages/jwt-tools) | Decode a JWT without verifying it, flag `alg: none`, expiry and missing claims, verify HS256/RS256 with a key, sign test tokens | `claude mcp add jwt-tools -- npx -y @basitalisandhu/mcp-jwt-tools@0.1.1` |
| [regex-lab](packages/regex-lab) | Test a regex against samples in a timeout-guarded worker, explain it, detect catastrophic backtracking | `claude mcp add regex-lab -- npx -y @basitalisandhu/mcp-regex-lab@0.1.1` |
| [cron-tools](packages/cron-tools) | Parse, explain and validate 5-field cron, list the next runs in a time zone | `claude mcp add cron-tools -- npx -y @basitalisandhu/mcp-cron-tools@0.1.1` |
| [json-schema-tools](packages/json-schema-tools) | Validate JSON with Ajv, infer a schema from samples, diff two schemas with a compatibility verdict | `claude mcp add json-schema-tools -- npx -y @basitalisandhu/mcp-json-schema-tools@0.1.1` |
| [openapi-lint](packages/openapi-lint) | Lint OpenAPI 3.x for missing security, responses, descriptions and versioning; list operations | `claude mcp add openapi-lint -- npx -y @basitalisandhu/mcp-openapi-lint@0.1.1` |
| [dockerfile-lint](packages/dockerfile-lint) | Lint Dockerfiles for root users, `latest` tags, secrets in `ENV`/`ARG`, missing `HEALTHCHECK`, apt without cleanup, `ADD` vs `COPY` | `claude mcp add dockerfile-lint -- npx -y @basitalisandhu/mcp-dockerfile-lint@0.1.1` |
| [git-insights](packages/git-insights) | Read-only git statistics: log, blame ownership, churn, authors, large files | `claude mcp add git-insights -- npx -y @basitalisandhu/mcp-git-insights@0.1.1` |
| [llms-txt](packages/llms-txt) | Generate `llms.txt` from local Markdown or a sitemap, check an existing one | `claude mcp add llms-txt -- npx -y @basitalisandhu/mcp-llms-txt@0.1.1` |

Every package README lists its tools with inputs and outputs, the exact `claude mcp add` command, a `.mcp.json` snippet, and what the server touches on disk and on the network.

## Quick start

With Claude Code:

```bash
claude mcp add jwt-tools -- npx -y @basitalisandhu/mcp-jwt-tools@0.1.1
claude mcp list
```

Add `-s user` to install for every project rather than the current one. For clients that read `.mcp.json` (Claude Code, Claude Desktop, Cursor), add an entry per server:

```json
{
  "mcpServers": {
    "jwt-tools": { "command": "npx", "args": ["-y", "@basitalisandhu/mcp-jwt-tools@0.1.1"] },
    "osv-advisories": { "command": "npx", "args": ["-y", "@basitalisandhu/mcp-osv-advisories@0.1.1"] }
  }
}
```

Pin the version in the `npx` argument, as above. An unpinned `npx -y package` runs whatever is on the registry at the time, which turns a package update into code that runs inside your editor without review.

From a checkout instead of npm:

```bash
git clone https://github.com/basitalisandhu/dev-mcp-servers
cd dev-mcp-servers
npm install
npm run build
claude mcp add jwt-tools -- node "$PWD/packages/jwt-tools/dist/index.js"
```

Packages are published to GitHub Packages (npm and container images, see Install) when a version tag is pushed; until a tag exists for a version, install from a checkout.

## Install

Every release is published in two places by `publish-github-packages.yml`: an npm package per server on GitHub Packages, and a container image per server on the GitHub Container Registry. The `npx` commands above use npmjs.com, where the packages appear once that registry is set up (see Releasing).

| Server | npm (GitHub Packages) | Container (GHCR) |
|---|---|---|
| osv-advisories | `npm i -g @basitalisandhu/mcp-osv-advisories@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-osv-advisories:0.1.1` |
| security-headers | `npm i -g @basitalisandhu/mcp-security-headers@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-security-headers:0.1.1` |
| jwt-tools | `npm i -g @basitalisandhu/mcp-jwt-tools@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-jwt-tools:0.1.1` |
| regex-lab | `npm i -g @basitalisandhu/mcp-regex-lab@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-regex-lab:0.1.1` |
| cron-tools | `npm i -g @basitalisandhu/mcp-cron-tools@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-cron-tools:0.1.1` |
| json-schema-tools | `npm i -g @basitalisandhu/mcp-json-schema-tools@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-json-schema-tools:0.1.1` |
| openapi-lint | `npm i -g @basitalisandhu/mcp-openapi-lint@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-openapi-lint:0.1.1` |
| dockerfile-lint | `npm i -g @basitalisandhu/mcp-dockerfile-lint@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-dockerfile-lint:0.1.1` |
| git-insights | `npm i -g @basitalisandhu/mcp-git-insights@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-git-insights:0.1.1` |
| llms-txt | `npm i -g @basitalisandhu/mcp-llms-txt@0.1.1` | `docker run --rm -i ghcr.io/basitalisandhu/mcp-llms-txt:0.1.1` |

### npm from GitHub Packages

Point the `@basitalisandhu` scope at GitHub Packages in `~/.npmrc`:

```
@basitalisandhu:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
```

GitHub's npm registry asks for a token even to install public packages. That is a GitHub limitation, not a setting of this repository: use a personal access token (classic) with the `read:packages` scope, exported as `GITHUB_TOKEN`. With that in place, install globally as in the table, or let the client start the server through `npx`:

```bash
claude mcp add jwt-tools -- npx -y @basitalisandhu/mcp-jwt-tools@0.1.1
```

Each package installs a `mcp-<server>` command (for example `mcp-jwt-tools`) that speaks MCP on stdio.

### Container images

Images are built for `linux/amd64` and `linux/arm64`, run as the non-root `node` user, and speak stdio, so `-i` is required and no port is published. Each image is tagged with the version and `latest`; pin the version.

With Claude Code:

```bash
claude mcp add jwt-tools -- docker run --rm -i ghcr.io/basitalisandhu/mcp-jwt-tools:0.1.1
```

With Cursor (`.cursor/mcp.json`) or any client that reads `.mcp.json`:

```json
{
  "mcpServers": {
    "jwt-tools": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/basitalisandhu/mcp-jwt-tools:0.1.1"]
    }
  }
}
```

A container only sees the files you mount. For servers that read local files (`dockerfile-lint`, `openapi-lint`, `osv-advisories` lockfile scans, `llms-txt`), mount the directory read-only and pass paths inside it, for example `docker run --rm -i -v "$PWD:/work:ro" ghcr.io/basitalisandhu/mcp-openapi-lint:0.1.1` and then `/work/openapi.yaml`. For `git-insights`, mount the repository at `/repo` (the image marks only `/repo` as a safe git directory): `docker run --rm -i -v "$PWD:/repo:ro" ghcr.io/basitalisandhu/mcp-git-insights:0.1.1`.

Every image is signed with cosign (keyless) and carries a build provenance attestation; an SPDX SBOM per image is attached to the GitHub release. To check an image before running it:

```bash
cosign verify ghcr.io/basitalisandhu/mcp-jwt-tools:0.1.1 \
  --certificate-identity-regexp '^https://github.com/basitalisandhu/dev-mcp-servers/\.github/workflows/publish-github-packages\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/basitalisandhu/mcp-jwt-tools:0.1.1 --owner basitalisandhu
```

To build an image locally from a checkout: `docker build --build-arg SERVER=jwt-tools -t mcp-jwt-tools .`

## MCP registry

Each server is listed in the official [MCP registry](https://registry.modelcontextprotocol.io) as `io.github.basitalisandhu/mcp-<name>`, for example `io.github.basitalisandhu/mcp-jwt-tools`. The listing points at the signed GHCR image for that version (`ghcr.io/basitalisandhu/mcp-<name>:<version>`, stdio transport), so a client or catalogue that reads the registry installs a server by running that image with `docker run --rm -i`, exactly as under Container images above. Look a server up directly:

```bash
curl -s 'https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.basitalisandhu/mcp-'
curl -s 'https://registry.modelcontextprotocol.io/v0.1/servers/io.github.basitalisandhu%2Fmcp-jwt-tools/versions/latest'
```

The registry lists the container images rather than the npm packages because it verifies npm ownership only on registry.npmjs.org, and these packages are on GitHub Packages. It verifies the images by pulling each one anonymously and checking its `io.modelcontextprotocol.server.name` label, which the `Dockerfile` and the publish workflow set to the server's registry name.

## Security posture

- **Stdio only.** No server opens a port. Each one is a child process of your MCP client and exits w