MCP.Market

Create Starter MCP server

by starter-series·io.github.starter-series/create-starter·v0.5.3·2 stars
No reviews yet

Scaffold Starter Series projects and check release, deployment, security, and agent instructions.

A91/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A91/100

full report

Adoption
Growing

2 stars43 downloads/wk

Reviews

Write one

Nobody has reviewed Create Starter yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Create Starter tools (9, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • add_component

    Lift a starter's CI/CD layer into an EXISTING repo without re-scaffolding — the remediation half of the audit loop (audit_security/audit_release diagnose; this installs the missing files from the matching starter). Components: ci (.github/workflows/ci.yml), security (codeql.yml + SECURITY.md), dependabot (dependabot.yml + auto-merge), maintenance (stale + weekly health check), or all. DRY-RUN BY D

  • audit_cd

    Check whether the local repo's version has been published to its destination registries (npm, PyPI, Open VSX, VS Marketplace, AMO, GitHub Releases). Makes outbound HTTPS requests to public registry APIs; never mutates. Reports per-destination drift (in-sync / needs-publish / local-stale / not-found).

  • audit_instructionswrite action

    Check local instruction discovery, source topology, exact duplicates/overlap, owner decisions and previous-run delta. Read-only by default; update_state explicitly saves the baseline, never source instructions. No semantic or safety enforcement.

  • audit_release

    Audit a local repo for release-readiness against the Starter Series quality bar. Detects matched starter, CHANGELOG drift vs merged PRs, version-bump status, and publish-workflow presence. Read-only; never mutates the repo.

  • audit_security

    Audit a local repo for baseline security CI hygiene against the Starter Series quality bar: gitleaks, CodeQL, dependency audit, license check, --ignore-scripts, Dependabot, secret-scanning hints, claude-code-security-review Action, and claude-security-guidance.md. Read-only.

  • create_projectwrite action

    Scaffold a new project from a Starter Series template

  • generate_launch_proof_reportwrite action

    Run audit_release, audit_cd, audit_security, and audit_instructions together, then return a client-ready Markdown Launch Proof Report. Read-only by default; set write=true to write launch-proof-report.md or output_path inside the target repo.

  • list_templates

    List all available Starter Series project templates

  • seed_security_guidance

    Generate a starter `claude-security-guidance.md` at the repo root, tailored to the detected Starter Series template. The file is consumed in-session by Anthropic's Claude Code Security Guidance Plugin (released 2026-05-26) as a guard while Claude writes code. Use `force: true` to overwrite an existing file.

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

no findings
  • Code scan49 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 8 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 91/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Create Starter compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
91/100
higher than 88% of 4,460 AI and agents servers
Tools
9
the typical AI and agents server has 6
Tools that change things
33%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
2
more than 65% of 2,711 AI and agents servers
Downloads a week
43
more than 35% of 1,538 AI and agents servers with a package

What its tools let an agent do: 5 read · 3 create · 1 change

Install Create Starter in Claude Code, Cursor or VS Code

Runs npx -y starter-series on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add create-starter -- npx -y starter-series
Add to Cursor

What the publisher says

From the Create Starter repository's README, as published. We do not edit it. Read it on GitHub

create-starter

Scaffold and audit Starter Series projects — MCP server, Claude Code skill, and CLI in one package.

Part of: Human-Controlled AI Systems — scaffolding is the easy half. What keeps a shipped repo trustworthy is the audit primitives (audit, audit-cd, audit-security) verifying release, CD, and CI security hygiene against a known bar — gating each merge instead of asking a human to re-check by hand.

Korean documentation is maintained under docs/ko/README.md; the root README stays English-only.

Security checks inspect local workflow definitions and referenced starter-series/.github policy, including composite actions and invoked scripts. Evidence includes source paths and content hashes. Unreadable or unsupported reusable workflows are reported as unverified; this checks configuration, not the latest Actions run or a live vulnerability scan.

Currently implemented

  • CLI — package and binary identity are starter-series; npx starter-series my-package --template npm-package scaffolds one of 6 public templates with Zod-validated input, atomic rename on success, retry + timeout + 50 MB download cap.
  • MCP server — nine stdio tools: listtemplates, createproject, auditrelease, auditcd, auditsecurity, auditinstructions, generatelaunchproofreport, seedsecurityguidance, addcomponent. One binary chooses the mode by argv (positional -> CLI, none -> MCP stdio).
  • Claude Desktop extension — .mcpb bundle on every release; drag onto the Claude Desktop settings window.
  • Claude Code plugin + skill — /plugin install create-starter@starter-series ships the MCP server and the conversational create skill together.
  • MCP Registry metadata — io.github.starter-series/create-starter; registry submission is gated on the unscoped npm package being live and tarball-verified.
  • auditrelease** — detects matched starter, version vs last-tag drift, CHANGELOG drift vs merged PRs (git log ..HEAD), publish-workflow kind (release-please / publish-on-tag / auto-release).
  • auditcd** — probes npm, PyPI, Open VSX, VS Marketplace, AMO, GitHub Releases for per-destination publish drift (in-sync / needs-publish / local-stale / not-found / unsupported).
  • auditsecurity** — checks 9 items: 8 core CI primitives (gitleaks with pin check, CodeQL, dependency audit, license check, --ignore-scripts, Dependabot grouped, secret-scanning hint, claude-code-security-review Action) plus the optional repo-author claude-security-guidance.md. The 8 core checks gate the HARDENED verdict; this repo passes 8/8 core.
  • auditinstructions / audit-instructions** — reviews agent instruction files (AGENTS.md, CLAUDE.md, GEMINI.md, Copilot instructions) for exact same-file duplicates, cross-file surface overlap, and keyword-based risk reminders. Duplicate/overlap findings need review; keyword risk summaries are advisory only and not exhaustive safety or semantic drift detection.
  • proof-report / generatelaunchproofreport** — runs release, CD, security, and instruction-review audits together and writes a client-ready Launch Proof Report. This is the monetizable handoff surface: evidence first, no "certified" claim, exit code 1 unless the repo is actually launch-ready.
  • addcomponent — the remediation half of the audit loop: lifts a starter's CI/CD layer (ci / security / dependabot / maintenance / all) into an existing* repo without re-scaffolding. Dry-run by default with a per-file plan (create / identical / skip-exists / overwrite); refuses a dirty git tree unless forced; never touches app code or secrets-bearing CD workflows. The dry-run plan doubles as a drift report against the starter.
  • Graduation guide — docs/graduation-from-vibe-coding.md (+ Korean): five-step path from Lovable/Bolt/v0 exports to GitHub Actions + a real deploy target, using the release/CD/security audit

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Create Starter: common questions

Is Create Starter MCP server safe?
Yes, by our scan: it is graded A (91/100). Read the Create Starter safety report
How do I install Create Starter?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Create Starter need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Create Starter maintained?
The last commit was 28 days ago (2026-10-07). The latest release is v0.5.3.
What can I use instead of Create Starter?
Servers from other publishers that do the same job: HOL Guard MCP server, Kiln MCP server and Vibe Check MCP server.
How does Create Starter compare with other AI and agents MCP servers?
safety score 91/100 (higher than 88% of 4,460 AI and agents servers); tools 9 (the typical AI and agents server has 6); tools that change things 33% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Create Starter

Same job from other publishers: the closest match first, then the best rated.

  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Kiln
    Spawn an object into existence: describe it, and your agent designs it, checks it, and 3D prints it.
    B
  • Vibe Check
    Metacognitive AI agent oversight: adaptive CPI interrupts for alignment, reflection and safety
    B
  • Shellward
    AI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.
    A
  • Agent Security Scanner
    Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
    C