ForkFree

MCP servers

helixar-mcp

by Helixar-AI

A security connector for Claude that checks other MCP servers for risky settings before you install them. It also validates agent delegation chains and can scan release files for leaked secrets.

Worth a lookEstablished, with a few things to check (listed below).

View on GitHubProject website

Stars
0
Licence
Apache-2.0
Runs on
A cloud service
Setup
Moderate
Language
TypeScript
Age
194 days

What you can do with it

  • Scan an MCP server's URL or manifest for risky tools and get a risk score with a written security brief
  • Validate an agent delegation chain for scope escalation, expired hops and missing signatures
  • Scan release folders for secrets, metadata leaks and licence gaps using the local ReleaseGuard tool

Make money with it

A freelancer could offer MCP and AI-agent security review services, using the scans as the starting point for a written report.

An idea, not financial advice. Check the licence before charging for anything built on it.

Ways a business could use it

  • Vet third-party MCP servers before connecting them to company data, reducing the chance of a security incident
  • Check release builds for leaked secrets and licence gaps before shipping software to customers

Can you use it commercially?

Free to use, change and sell, including in paid products. Keep the copyright notice.

Not legal advice. Read the project's licence file before building a product on it.

Add it to Claude Code

claude mcp add --transport http mcp https://mcp.helixar.ai/mcp

This one runs on the maker's server, not your computer, so what you send it leaves your machine.

From the official MCP Registry (ai.helixar/mcp). Only connect MCP servers you trust: they can act on your behalf.

Getting it running

Add the hosted URL as a custom connector in Claude, or clone the repository and run npm install and npm run build to use it locally over stdio.

Follow the official instructions in the project README.

Things to check

  • Hosted server is public with no authentication in this version
  • Deep mode with all 26 rules needs an API key, and real key validation is not yet built
  • Narrated security briefs use the Anthropic API and may need a key, otherwise a basic fallback is used
  • The ReleaseGuard tool needs a separate binary and works only locally
  • Very new project with no stars, so it is untested by the community
  • Scanning sends your manifest or URL to a third-party hosted service

Checked 02 Nov 2026. Summary drafted by AI from the project's README.

More in MCP servers

kanzo emanuele-em
Hidden gem

Kanzo is a small kanban board that runs in your browser and also works as an MCP server, so you and your AI coding agents share the same task list. All data sits in one local folder, which can be synced between machines through a private git repository.

717 stars +145 a day AGPL-3.0
earshot Leonxlnx
New and promising

Earshot is a toolkit that lets AI coding agents analyse and describe audio, check how well sound fits a description or a video, and create their own sound effects in code. It runs locally on a CPU as a command-line tool, a Python library or an MCP server.

3.5k stars +83 a day MIT
cueframe-mcp cueframe-ai
New and promising

CueFrame is a hosted video service that lets an AI assistant, a command-line tool or a REST API create, edit, caption and render video as editable projects. This repository holds the connection tools and skill packs that link agents such as Claude Code, Codex and Cursor to that service.

2 stars Apache-2.0