MCP.Market

HAL MCP server

by DeanWard·io.github.DeanWard/HAL·v1.0.14·38 stars
No reviews yet

HAL (HTTP API Layer) - An MCP server that provides HTTP API capabilities to Large Language Models

B75/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
Growing

38 stars79 downloads/wk

Reviews

Write one

Nobody has reviewed HAL yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

HAL tools (13, 4 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • docs_components

    Get a complete list of all available presentation components and their descriptions

  • docs_endpoints

    Get all available API endpoints and their documentation

  • docs_example

    Get a complete example of how to structure presentation data

  • docs_schemas

    Get all available data schemas and their structure

  • docs_search

    Search through the API documentation, schemas, components, and examples. Returns relevant matches based on your query.

  • http-deletewrite action

    Make an HTTP DELETE request to a specified URL with optional headers. Supports secret substitution using {secrets.key} syntax in URL and headers where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-get

    Make an HTTP GET request to a specified URL. Supports secret substitution using {secrets.key} syntax where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-head

    Make an HTTP HEAD request to a specified URL with optional headers (returns only headers, no body). Supports secret substitution using {secrets.key} syntax in URL and headers where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-options

    Make an HTTP OPTIONS request to a specified URL to check available methods and headers. Supports secret substitution using {secrets.key} syntax in URL and headers where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-patchwrite action

    Make an HTTP PATCH request to a specified URL with optional body and headers. Supports secret substitution using {secrets.key} syntax in URL, headers, and body where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-postwrite action

    Make an HTTP POST request to a specified URL with optional body and headers. Supports secret substitution using {secrets.key} syntax in URL, headers, and body where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • http-putwrite action

    Make an HTTP PUT request to a specified URL with optional body and headers. Supports secret substitution using {secrets.key} syntax in URL, headers, and body where 'key' corresponds to HAL_SECRET_KEY environment variables.

  • list-secrets

    Get a list of available secret keys that can be used with {secrets.key} syntax. Only shows the key names, never the actual secret values.

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 345 days ago4/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How HAL compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 45% of 48,255 servers
Tools
13
the typical server has 7
Tools that change things
31%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
38
more than 93% of 28,688 servers
Downloads a week
79
more than 57% of 12,191 servers with a package

What its tools let an agent do: 9 read · 4 change

Install HAL in Claude Code, Cursor or VS Code

Runs npx -y hal-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add HAL -- npx -y hal-mcp
Add to Cursor

What the publisher says

From the HAL repository's README, as published. We do not edit it. Read it on GitHub

HAL (HTTP API Layer)

HAL is a Model Context Protocol (MCP) server that provides HTTP API capabilities to Large Language Models. It allows LLMs to make HTTP requests and interact with web APIs through a secure, controlled interface. HAL can also automatically generate tools from OpenAPI/Swagger specifications for seamless API integration.

Documentation

Complete Documentation →

Visit our comprehensive documentation site for detailed guides, examples, and API reference.

Features

  • HTTP GET/POST/PUT/PATCH/DELETE/OPTIONS/HEAD Requests: Fetch and send data to any HTTP endpoint
  • Secure Secret Management: Environment-based secrets with {secrets.key} substitution and automatic redaction
  • Swagger/OpenAPI Integration: Automatically generate tools from API specifications
  • Built-in Documentation: Self-documenting API reference
  • Secure: Runs in isolated environment with controlled access
  • Fast: Built with TypeScript and optimized for performance

Usage

HAL is designed to work with MCP-compatible clients. Here are some examples:

Basic Usage (Claude Desktop)

Add HAL to your Claude Desktop configuration (npx will automatically install and run HAL):

{
  "mcpServers": {
    "hal": {
      "command": "npx",
      "args": ["hal-mcp"]
    }
  }
}

With Swagger/OpenAPI Integration and Secrets

To enable automatic tool generation from an OpenAPI specification and use secrets:

{
  "mcpServers": {
    "hal": {
      "command": "npx",
      "args": ["hal-mcp"],
      "env": {
        "HAL_SWAGGER_FILE": "/path/to/your/openapi.json",
        "HAL_API_BASE_URL": "https://api.example.com",
        "HAL_SECRET_API_KEY": "your-secret-api-key",
        "HAL_SECRET_USERNAME": "your-username",
        "HAL_SECRET_PASSWORD": "your-password"
      }
    }
  }
}

URL-based Configuration

You can also load OpenAPI specs directly from URLs:

{
  "mcpServers": {
    "hal": {
      "command": "npx",
      "args": ["hal-mcp"],
      "env": {
        "HAL_SWAGGER_FILE": "/swagger/v1/swagger.json",
        "HAL_API_BASE_URL": "http://localhost:5065",
        "HAL_SECRET_API_KEY": "your-secret-api-key"
      }
    }
  }
}

Direct Usage

# Start the HAL server with default tools
npx hal-mcp

# Or with Swagger/OpenAPI integration
HAL_SWAGGER_FILE=/path/to/api.yaml HAL_API_BASE_URL=https://api.example.com npx hal-mcp

# Or load from URL
HAL_SWAGGER_FILE=/swagger/v1/swagger.json HAL_API_BASE_URL=http://localhost:5065 npx hal-mcp

Configuration

HAL supports the following environment variables:

  • HALSWAGGERFILE: Path or URL to OpenAPI/Swagger specification file (JSON or YAML format). Can be:
  • Local file path: /path/to/api.yaml
  • Full URL: https://api.example.com/swagger.json
  • Relative path: /swagger/v1/swagger.json (combined with HALAPIBASE_URL)
  • HALAPIBASE_URL: Base URL for API requests (overrides the servers specified in the OpenAPI spec)
  • HALSECRET: Secret values for secure substitution in requests (e.g., HALSECRETTOKEN=abc123)
  • HALALLOW: URL restrictions for namespaced secrets (e.g., HALALLOWMICROSOFT="https://azure.microsoft.com/*")
  • HALWHITELISTURLS: Comma-separated list of URL patterns that are allowed (if set, only these URLs are permitted)
  • HALBLACKLISTURLS: Comma-separated list of URL patterns that are blocked (if set, these URLs are denied)

Secret Management

HAL provides secure secret management to keep sensitive information like API keys, tokens, and passwords out of the conversation while still allowing the AI to use them in HTTP requests.

How It Works

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

HAL: common questions

Is HAL MCP server safe?
Mostly: it is graded B (75/100). Read the HAL safety report
How do I install HAL?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does HAL need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is HAL maintained?
The last commit was 378 days ago (2025-10-22). The latest release is v1.0.14.
How does HAL compare with other MCP servers?
safety score 75/100 (higher than 45% of 48,255 servers); tools 13 (the typical server has 7); tools that change things 31% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.