mcpnew scaffolds secure-by-default MCP servers in TypeScript or JavaScript — deny-all permissions, typed tool stubs, and audit hooks pre-wired from the first commit.
$ npx mcpnewcli create inventory --lang ts ✔ scaffolded inventory (ts) + src/server.ts # typed tools + gates + audit hooks + src/audit.js # JSONL trail → logs/audit.jsonl + mcp.permissions.json # everything starts "deny" $ npx mcpnewcli audit ✔ audit passed: deny-all posture intact, audit hooks wired
The default MCP demo copies an allow-everything posture into your codebase. mcpnew ships the opposite default and keeps it verifiable.
Tools, resources, prompts, network, filesystem — every capability starts denied in mcp.permissions.json. Wildcards are rejected outright.
mcpnew add-tool inserts a zod-schema'd stub already wired through its permission gate and audit hook. You write the body; the plumbing is correct on arrival.
Every tool call logs timestamp, tool, arguments, outcome, and duration to logs/audit.jsonl — gitignored, append-only, yours to ship anywhere.
npx mcpnewcli audit exits non-zero if anything loosens: allow-all defaults, ungated tools, unwired hooks. Drop it into CI and stay honest.
One flag switches between strict TypeScript (with manifest types) and plain ESM JavaScript. Both get identical security scaffolding.
mcpnew itself has zero runtime dependencies on Node 18+. Your generated project depends only on the official MCP SDK and zod.
From empty directory to CI-audited MCP server in under a minute.
mcpnew create srv
Pick TS or JS. You get a working stdio MCP server, tests that assert the deny-all posture, and a permission manifest where everything is denied.
mcpnew add-tool search
Each new tool arrives typed, gated by requireAllowed(), audited — and denied until you flip exactly one manifest line after review.
mcpnew audit
Fails loudly when defaults loosen, tools lose their gates, or hooks go missing. Wire it into CI so drift never merges.
The scaffold is free and open source, forever. Pro is for teams running MCP servers in production.
No — denial happens per tool call with a clear error naming the manifest line to change. Scaffolded tests assert the posture you intend, so flipping a tool to allow is a reviewed, visible diff.
The official @modelcontextprotocol/sdk with zod schemas over stdio. No lock-in: it's ordinary SDK code you own and can extend.
Both are first-class: --lang ts adds strict types for the permission manifest and tool args; the default JS build runs with zero build step.
Governance: pull-request diffs of permission manifests, required approval before any deny becomes allow, centralized audit-log shipping, and a compliance report mapping each grant to its approval record. One tier, $9/month.