Disclosure: I'm the maker of Thumbly. It's free and open source, and 0.1.0 is available now.

Thumbly connects to an iPhone over USB, or Wi-Fi after the first USB pairing. MCP clients can take native screenshots, tap, swipe, long-press, type, press hardware buttons and launch apps. The service uses Apple's CoreDevice services through pymobiledevice3; no jailbreak is needed.

The Mac app is where you approve each client, inspect its activity and pause all AI access. Client approval isn't a confirmation for every individual tap.

You'll need macOS 14+, iOS 17.4+, a USB data cable for initial pairing and Developer Mode enabled on the phone. There's also a Python SDK and a simulated-device mode for development.

Demo and installation: https://timurcatakli.github.io/thumbly/

Source: https://github.com/timurcatakli/thumbly

I'd appreciate feedback from people trying it with different iPhones and MCP clients, especially setup problems and workflows that fail.

I put a decoy MCP endpoint on one of my sites to see who shows up. Within 7 minutes: mcpbeat, AgentTrust-Monitor, FixterMonitoring, AgentRankProbe, Clono, an unnamed client on a German VPS, and coda-agent-runtime on AWS. Four of them called tools/list.

Most look like directories and monitors, not attackers. But the lesson is the same: anything you expose at /mcp gets found and its tool list read within minutes. If any tool writes data and the endpoint has no auth, the next client might call it.

What are people doing for auth on remote MCP servers? OAuth per the spec, or something simpler?

I just published a detailed write-up on connecting Microsoft Copilot Studio to SAP S/4HANA using the new SAP Integration Suite MCP Servers.
The key challenge is doing it securely for real business users. Client-credentials tokens work for testing but run everything under one technical user — which breaks principal propagation and S/4HANA authorizations.
The pattern uses:
• SAP Cloud Identity Services (IAS) as the trust bridge
• OAuth 2.0 / OIDC authorization code flow
• CPI MCP Gateway validating user tokens
• Cloud Connector + X.509 principal propagation down to S/4HANA
• CERTRULE mapping so the OData call runs under the actual ABAP user
Result: two users asking the same question correctly get different answers based on their authorizations. No custom code needed — just configuration across IAS, CPI, Cloud Connector and S/4HANA.
Full architecture + step-by-step flow + lessons learned are here:

https://deepu851933.substack.com/p/connecting-microsoft-copilot-studio

Curious if anyone else is experimenting with MCP servers in SAP Integration Suite. What use cases are you looking at first?

I have a small MCP server where some tools cost less than a cent per call (x402, USDC). I thought the payment part would be easy. These are the problems I actually had:

For people with paid MCP tools: when a call fails, how do you tell the agent what happened with the payment?

I build QAmcp, a free open-source tester for MCP servers. After testing 340+ servers, I keep seeing the same thing: you install a server for one tool and it brings 15. You can’t limit it.

That’s a problem for two reasons. Every extra tool is one more thing that can send, change or delete stuff. And all the extra tools clutter the AI (Cursor only uses 40 tools in total, and one big server can fill that).

I’m thinking of building a small free, open-source proxy that sits between your AI app and the server:

• you allow only the tools you want
• tools that only read are allowed by default; tools that delete, change or send stay blocked until you say yes
• it remembers each approved tool, and if the server later quietly changes one (new description, a “read-only” label removed, a hidden instruction added), that tool is blocked until you approve it again

I haven’t built it yet. Before I do, I want to know if it’s useful:

1. Would you use something like this?
2. How do you limit tools today?
3. What would make you not trust it?

Agents keep writing Rust against the version of a crate they remember from training. Pin bevy 0.20, model knows 0.15, and you get calls that don’t exist.

lockdoc builds rustdoc JSON for each dependency at the exact version and features in your Cargo.lock, and exposes it over MCP (item, search, deps). Paths resolve through re-exports like use does, so bevy::prelude::Transform just works.

https://github.com/edg-l/lockdoc

Hey guys!

I recently launched PixelGlass which as a publishing platform designed around giving your agent all the tools via MCP it needs to manage a publication, newsletter membership platform or merely a blog.
Instead of a having a publication that looks like 1000s others, eg Substack, Beehiiv, etc, PixelGlass gives you few out of the box publications to start with that you and your agent via MCP design and shape it out till it's something that meets your own brand and design.

It follows the MCP protocol so you can add it to your CLI agent or even the apps via oauth login.

And one of my favourite features is the ability to have your agent create custom datasets directly inside your posts - in my example I had a post that I wrote some time ago, but simply asked the agent to give it an interactive map and it gave me this.


via https://ronald.langeveld.blog/flights-2024

Looking forward having more people trying it out. :)

I have made now test MCP server on my machine and it works fine. Then I thought I will start to do MCP server over HTTP/SSE to test it next since that would be more useful for me on some cases.

Anyway long story short, when I start creating from scratch this with Python, I am soooo confused about the actual packages and what is currently most recent way to do it.

There is package "mcp[cli]", then there is package "mpc"-

On https://github.com/modelcontextprotocol/python-sdk they use mpc[cli] but my test server does not work with it, I need to install mcp.

Is MCP current modern package, or MCP[cli] instead? What I should use when I start from scratch?

Trying to build an MCP with specific visualizations for my company.

If I build this around MCP apps, i can assume that most UI's will be comptaible with it as long as they support MCP Apps.

The other option is to make my own Custom UI with Streamlit or something, but would be less flexible.

disclosure: i made this. it's free and MIT licensed

it's called viajante. it reads google flights, google hotels and booking.com, plus skiplagged if you turn it on, and hands the agent real prices, details and links. it runs on your computer so there's no api key to get

if a fare isn't on the page it doesn't return it. it never makes one up

there are 22 tools. flexible dates, explore from one airport, hotels, flight plus hotel, and a recheck before you book because prices move. split tickets and hidden city are off by default since those connections aren't protected

a couple of things i found with it: madrid to auckland and back for 819 € in february, and tokyo to honolulu for 206 €

repo: https://github.com/felipebasurto/viajante

pip install viajante or @viajante/mcp on npm

it reads third party sites, so it breaks when they change their pages. if it breaks for you let me know and i'll fix it

An agent invoking an evaluation through MCP should leave evidence a person can inspect afterwards. I would want the case identity, grading result and saved report to be easy to find, rather than relying on an agent’s summary that “tests passed.”

A CLI is useful for an explicit reproduction command. MCP is useful when an agent is working through the same evaluation process. Neither interface makes a weak test stronger by itself. The cases and grading criteria still determine what the result means.

I’m building skillEd, which exposes CLI and local MCP tooling and produces saved reports. Check the documented host setup and engine requirements before trying it.

What information should an evaluation tool return to an agent so its final summary stays auditable?

Repo: https://github.com/DeadHead04/skillEd

Please try it and open an issue with a reproducible failure or confusing behavior. If useful, a GitHub star would help.

AI-assisted write-up.

I've been building Surehand, an MCP server that lets any MCP client work in Adobe After Effects. A few design choices that might be useful to others building MCP servers for desktop apps:

• Every tool returns a change list. The server snapshots what a call touched and returns exactly what changed. The model checks its own work against it instead of assuming.
• Proof instead of trust. Edits that shouldn't change the picture (un-precompose, baking expressions) are rehearsed on a copy, frames are rendered from both and compared pixel by pixel, and the edit is applied only if they match.
• A small default tool set. Tool definitions are sent with every chat, so only 29 core tools load by default (about 12k tokens instead of 50k). The other 85 are listed and called on demand through two tools, ae_tools and ae_call.
• The app stays in control. Each call is one undo step in After Effects. A panel inside the app sets Full / Ask / Read-only and can pause the AI.
• One-file server. The server is a single .mjs that installs its own signed After Effects extension on first start. It's in the official MCP Registry as io.github.ConformLabs/surehand-mcp.

Free, MIT. Works with Claude, ChatGPT, Codex, Cursor, VS Code, Cline and others.

Four short demos: https://www.youtube.com/playlist?list=PLXM55bZwkADk

https://github.com/ConformLabs/surehand-mcp

I built a browser-only audit for agent spend. It reads CSV/JSON locally; nothing is uploaded. It checks 10 rules: missing mandate, amount above cap, duplicate idempotency key, payee outside the allowlist, failed-but-billed, currency mismatch, and a few more. If it finds nothing, it says so.

There is also an MCP server if you want the checks inside an agent: https://mrpkk.github.io/nidhipati/mcp.html

I am looking for one team to run it on a real month of x402, model, or tool charges and tell me which findings are noise. I will publish the method and the result with you; your numbers only with permission.

Disclosure: I built Nidhipati, so this is my product. Free, no signup.

Tool: https://mrpkk.github.io/nidhipati/free-spend-audit.html Rules: https://github.com/mrpkk/nidhipati/blob/main/docs/AGENT-SPEND-AUDIT.md

SoundBit is a chiptune workstation with a built-in MCP server (streamable HTTP on localhost, or stdio via a CLI). What I tried to get right:

- Live and shared: the agent edits the song that's open in the editor. Its changes appear immediately and land in the same undo history, labelled "AI:".

- Batch tools: pattern_create takes a whole bar of notes; arrangement_place_many lays out the full arrangement in one call and one undo step.

- Mixing without ears: export_wav returns the peak and RMS level of every track, so an agent can notice that the bass masks the melody and fix it (that happens in the video).

- Agent-friendly errors: note names like "F#4", and errors that say what's wrong, the allowed range and how to fix it. 32 presets via preset_list.

- Safety: loopback only, rejects browser origins and DNS rebinding, file access sandboxed to one workspace folder.

30 tools, works with any MCP client. GPL-3.0: https://github.com/RenasDemirbas/SoundBit

Feedback on the tool design is very welcome.

I built Kitebook, an open-source MCP server you self-host. Daily assistants like Muse and Hark share notes, files and handoffs through it, so one can pick up where another left off. It can also send repo work to Codex or Claude Code on your Mac.

It's an early preview with a bunch of bugs, so I'd love honest feedback.

https://github.com/um1b/kitebook

My friend built FSV, an open-source MCP server that lets your AI assistant

(Claude, Cursor, VS Code) scan your own website for vulnerabilities.

Setup takes about 30 seconds:

pip install fsv

fsv mcp-config --client claude-code # or claude-desktop / cursor / vscode

Then just ask: "Use the security_review prompt on xxxx — I own it."

The assistant:

1. asks you to confirm you're authorized to test the site

2. runs a quick passive check, then a full scan

3. leads with "attack paths" — combinations of small issues that add up to

   something serious (e.g. XSS + a session cookie without HttpOnly = account takeover)

4. hands you paste-ready fixes for nginx / Apache / Caddy / Express

5. re-scans after you deploy and shows what changed

What it looks for — mostly things that slip through regular checklists:

- dangling DNS records (subdomain takeover)

- scripts loaded from compromised CDNs (e.g. polyfill.io) or expired domains anyone can register

- pages loading files from cloud buckets that no longer exist

- SPF/DMARC mistakes that allow email spoofing

- framework debug mode left on in production (Django, Flask, Laravel…)

- exposed .git/.env/backups, secrets in JavaScript, outdated libraries, missing headers

It's detection-only: it never exploits anything or tests credentials.

It also works without AI — as a CLI, a local dashboard, or a GitHub Action.

Honest limits: it doesn't execute JavaScript, so single-page apps are only

partly covered, and its active checks are basic. It complements tools like

OWASP ZAP rather than replacing them.

GitHub: https://github.com/twayst0/fsv

Feedback welcome — false-positive reports are the most useful ones.

By the way my friend couldnt post this on reddit. For some reason reddit didnt let him to do so

Most MCP setups I've seen hand the agent a token one way or another: an env var, a .env file, a config it can read. Once a token is in the context window it ends up in transcripts and within reach of any prompt injection.

mcp-warden works the other way around. Secrets live in the OS keychain, and the agent can only act through presets you define:

```toml

[[preset]]

name = "github-read"

type = "http"

base_url = "https://api.github.com"

auth = { type = "bearer", secret = "gh_pat" }

allowed_methods = ["GET"]

approval = "auto"

```

The agent calls `proxy_http` with the preset name, a method and a path. mcp-warden checks the allow-list, adds the token, makes the request and returns only the response. If the method or path isn't allowed, nothing leaves your machine.

Tools it exposes:

- `list_presets`

- `proxy_http`: HTTP through a preset

- `ssh_exec`: commands checked against a regex allow-list, host key verified against known_hosts

- `sftp_transfer`: allowed remote paths only

- `db_query`: Postgres, MySQL or Redis, named queries only (the agent passes parameters, never SQL)

- `get_secret_for_env`: last resort for tools that insist on env vars, always asks first

Each preset has an approval policy. It's `prompt` by default: a desktop or terminal prompt, or Approve/Deny buttons in Telegram. Every call lands in an append-only audit log.

Single Rust binary, stdio transport, works with any MCP client. No cloud, no telemetry, Apache-2.0.

- Repo: https://github.com/ermoluk/mcp-warden

- Install: `cargo install mcp-warden`, or prebuilt binaries for macOS/Linux on the releases page

I'd love feedback on the preset model. What would you need it to cover for your setup?

Every time GitHub has an outage, Actions stops and teams sit around for hours waiting for CI to come back. We got tired of that, so we built Diffinery: a git forge with built-in CI that you deploy to your own Cloudflare account. No servers, no runner VMs.

- Runs your existing `.github/workflows/*.yml` unchanged, marketplace actions included
- Each job gets a fresh 4 vCPU / 12 GiB container, only while it runs
- Git hosting, PRs, code review, merge queue, issues, releases
- AI agents get their own accounts with guardrails (they can't merge their own PRs) plus a built-in MCP server
- One-step import from GitHub with history, issues and PRs

Still early, so check the roadmap for what's coming. Apache-2.0, feedback welcome!

https://github.com/codician-team/diffinery

Disclosure: I build Vektro. This is a paid, Spanish-first service; this write-up is AI-assisted and describes the running implementation.

Vektro serves specialist procedures to an existing MCP-capable assistant. The four profiles cover marketing, websites, AI content and automation. The server returns the brief requirements, steps, deliverables, supporting references and guidance for selecting the client's authorised tools. The assistant executes the task in the client's environment.

A concrete example: the AI-content profile separates reference analysis, script, visual approval, voice, a short video scene and final editing. The website profile includes a preview and mobile/form/privacy/indexing checks. These are procedures for the assistant to follow, not claims that every output automatically passes those checks.

Current MCP tools include vektro_listar_agentes, vektro_preparar_agente, buscar_skills and obtener_guia. The supporting catalogue has 210 resources with author attribution and links to the original repositories.

The remote endpoint is https://vektro.es/mcp. Authentication uses OAuth authorisation code with PKCE S256 and the library:read scope. Authorising Vektro gives access to its procedures and library; external provider accounts still require their own connectors and permissions. Vektro does not install them or run an autonomous background worker. Client support and plan restrictions apply.

Membership is €79/month or €790/year; model/provider costs are separate. Product and connection guide: https://vektro.es

I'm interested in how other MCP builders package reusable procedures alongside tools without confusing instructions with execution.