Create Starter MCP server

Read from the package source without running it. The installed server may list more.

• add_component

  Lift a starter's CI/CD layer into an EXISTING repo without re-scaffolding — the remediation half of the audit loop (audit_security/audit_release diagnose; this installs the missing files from the matching starter). Components: ci (.github/workflows/ci.yml), security (codeql.yml + SECURITY.md), dependabot (dependabot.yml + auto-merge), maintenance (stale + weekly health check), or all. DRY-RUN BY D

• audit_cd

  Check whether the local repo's version has been published to its destination registries (npm, PyPI, Open VSX, VS Marketplace, AMO, GitHub Releases). Makes outbound HTTPS requests to public registry APIs; never mutates. Reports per-destination drift (in-sync / needs-publish / local-stale / not-found).

• audit_instructionswrite action

  Check local instruction discovery, source topology, exact duplicates/overlap, owner decisions and previous-run delta. Read-only by default; update_state explicitly saves the baseline, never source instructions. No semantic or safety enforcement.

• audit_release

  Audit a local repo for release-readiness against the Starter Series quality bar. Detects matched starter, CHANGELOG drift vs merged PRs, version-bump status, and publish-workflow presence. Read-only; never mutates the repo.

• audit_security

  Audit a local repo for baseline security CI hygiene against the Starter Series quality bar: gitleaks, CodeQL, dependency audit, license check, --ignore-scripts, Dependabot, secret-scanning hints, claude-code-security-review Action, and claude-security-guidance.md. Read-only.

• create_projectwrite action

  Scaffold a new project from a Starter Series template

• generate_launch_proof_reportwrite action

  Run audit_release, audit_cd, audit_security, and audit_instructions together, then return a client-ready Markdown Launch Proof Report. Read-only by default; set write=true to write launch-proof-report.md or output_path inside the target repo.

• list_templates

  List all available Starter Series project templates

• seed_security_guidance

  Generate a starter `claude-security-guidance.md` at the repo root, tailored to the detected Starter Series template. The file is consumed in-session by Anthropic's Claude Code Security Guidance Plugin (released 2026-05-26) as a guard while Claude writes code. Use `force: true` to overwrite an existing file.

• Code scan49 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 4 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Create Starter: common questions

Is Create Starter MCP server safe?

Yes, by our scan: it is graded A (91/100). Read the Create Starter safety report

How do I install Create Starter?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Create Starter need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Create Starter maintained?

The last commit was 4 days ago (2026-09-16). The latest release is v0.5.3.

What can I use instead of Create Starter?

Servers from other publishers that do the same job: Sanity MCP server, ContextStream MCP Server and Google Surf MCP server. Compare all Create Starter alternatives.