MCP Forge
For developers building MCP servers

Ship MCP servers that are
secure from day one.

Most MCP servers leak. mcp-audit finds the holes for free. MCP Forge Kit is the secure-by-default starter that fixes them: auth, SSRF-safe fetch, rate limiting, tests, CI.

Scan your config free Get the Kit, €39

100% local  ·  open source (MIT)  ·  17 security and token checks  ·  no signup, nothing uploaded

1. Scan
Paste your config or run the CLI. Get a 0 to 100 score in seconds.
2. Review
Every issue grouped by risk, each with the exact fix.
3. Fix
Drop in MCP Forge Kit and ship a server that scores an A.

The MCP ecosystem is wide open

A 2026 analysis of ~7,000 public MCP servers found most are dangerously misconfigured.

41%
require no authentication
36.7%
are SSRF-vulnerable
8.5%
use OAuth

And every server you add quietly loads its tool schemas into every request. Five servers commonly burn 50 to 75k tokens of context before you type a word.

Step 1: audit, free

mcp-audit scans your MCP config and tells you exactly what is wrong. 100% local, zero dependencies, open source (MIT). Try it right in your browser, or run the CLI.

Scan your config in the browser →
pipx install git+https://github.com/alih552/mcp-audit
mcp-audit            # auto-detects Claude Desktop, Cursor, VS Code, Windsurf
# → 7 servers · ~13,160 context tokens · score 0/100 (F)
#   ✖ HIGH  Remote server with no authentication  (internal-api)
#   ✖ HIGH  Plaintext secret in config            (github)
#   ▲ MED   Over-broad filesystem root '/Users'    (filesystem)
View on GitHub →

Step 2: fix it with MCP Forge Kit

A production-grade, secure-by-default MCP server starter (TypeScript). Score an A from your first commit.

What's inside

  • Bearer + HS256 JWT auth (drop-in OAuth), fail-closed in prod
  • SSRF-safe fetch that blocks private IPs, cloud metadata, DNS-rebinding
  • Token-bucket rate limiting + body-size caps + security headers
  • zod input validation on every tool
  • 21 passing tests + typecheck + GitHub Actions CI
  • Dockerfile + deploy guide (Fly / Railway / Render / VPS)
  • SECURITY.md checklist + setup guide
One-time purchase · lifetime updates · commercial license
€39once
  • Full source, yours to use in unlimited projects
  • Instant download + license key via Polar
  • Ships an MCP server that passes mcp-audit at A
Buy MCP Forge Kit, €39

Secure checkout by Polar. 14-day refund if it doesn't fit.

FAQ

Is mcp-audit really free?

Yes, MIT licensed, open source, runs entirely on your machine. It never connects to your servers or sends your config anywhere.

What language is the Kit?

TypeScript, on the official @modelcontextprotocol/sdk, runs on Node 18+. Deploy with Docker or any Node host. A serverless/Cloudflare-Workers path is documented.

What exactly do I get?

The full kit source: a secure reference MCP server, the security modules (auth, rate-limit, SSRF guard, validation), 21 tests, CI, a Dockerfile + deploy guide, a SECURITY.md checklist and a setup guide. One-time payment, lifetime updates.

Refunds?

14-day no-questions refund via Polar if it isn't a fit.