Is create-mcp-kit safe?
An interactive CLI for scaffolding ready-to-develop MCP servers and clients in TypeScript or JavaScript.
If an AI agent using this server were tricked, the damage it could do through this server is limited.
Why: no high-reach capabilities found.
What it can do
No commands, file changes, browser control or database access found in its code.
Tools it offers your AI (1):
- search_documents
Code patterns worth reviewing
Automated pattern matches in the published package. Some are expected for this kind of server, and some may be false positives — they are pointers for review, not confirmed vulnerabilities.
Command injection risk
The agent appears to pass input into a shell or command execution path.
template/server-js/src/data/documents.js:40
Install it pinned
{
"mcpServers": {
"create-mcp-kit": {
"command": "npx",
"args": ["-y", "create-mcp-kit@1.0.4"]
}
}
}Check your whole MCP setup
Agent Verify checks the servers in your Claude, Cursor and VS Code config — including whole-drive access and keys stored in plain text.
Maintain create-mcp-kit?
Show users you've thought about access: add the badge below. If something here is wrong or you've released a fix, ask for a re-scan — we update pages on request.
[](https://aimodularity.com/agentverify/mcp/create-mcp-kit/)
Agent Verify reads the package published on npm as text — it is never installed or run. Ratings describe capability, not intent, and are an automated, evidence-based check, not a guarantee. Scanner 2.0.0.