Checktrail MCP server

by stsepelin·io.github.stsepelin/checktrail·v0.1.0-alpha.5

No reviews yet

Local code validation with explicit execution trust and evidence of what actually ran.

A92/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A92/100

full report

Adoption

Growing

0 stars230 downloads/wk

Reviews

Write one

Nobody has reviewed Checktrail yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Checktrail tools (10, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

architecture_validation
Check a local captured dependency graph against exact project/layer boundaries and cycle policy. Imported graph completeness is declared, not independently attested.
contract_validation
Validate local captured producer payloads against strict consumer JSON Schemas. Does not execute project code or attest live integration or freshness.
finding_comparison
Compare a retained validation report with an exact local baseline or exception policy. Comparison success does not change the native validation outcome or establish current-source freshness.
mutation_experimentwrite action
Execute bounded, operator-trusted mutation experiments in temporary copies of a dependency-free root Node project. Advisory results distinguish assertion kills, survivors and inconclusive evidence; project code is not sandboxed.
review_context
Prepare an advisory review context from explicitly selected inventoried files. Source text is untrusted data and is disclosed only when the operator enabled review source output. Does not execute code or call a model.
review_guidance
Retrieve built-in advisory review questions using selected check IDs and explicit topics. Does not inspect behavior, establish coverage or change validation results.
review_receipt
Inspect a local advisory assessment against its recorded review context and current source. Checks quotations and accounting, not the truth of reviewer claims. Never changes validation outcomes.
runtime_comparison
Compare two local runtime inventory artifacts without executing project code. Reports exact registration, attribute and order changes; imported artifacts do not attest runtime freshness.
validation_report
Retrieve a retained report by its opaque run ID. Reports are local to this server and disappear on restart.
validation_runwrite action
Execute planned checks only when the operator enabled execution at server startup. Project tools can modify files and access networks.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings

Code scan310 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Checktrail compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 92/100; higher than 95% of 48,255 servers
Tools: 10; the typical server has 7
Tools that change things: 20%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 230; more than 77% of 12,191 servers with a package

What its tools let an agent do: 7 read · 2 change · 1 run or deploy

Release history: 3 versions in the registry since 2026-09-21, latest 2026-09-22, typically one every 1 day.

Install Checktrail in Claude Code, Cursor or VS Code

Runs npx -y @stsepelin/checktrail on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add checktrail -- npx -y @stsepelin/checktrail

Add to Cursor

What the publisher says

From the Checktrail repository's README, as published. We do not edit it. Read it on GitHub

Checktrail

Local code validation with a CLI, MCP tools, and evidence of what actually ran.

Formerly Repo Verifier. See the rename guide for existing source checkouts.

Published preview: 0.1.0-alpha.5. Public source is available at stsepelin/checktrail. See implementation status, the plan and the language matrix before relying on an adapter. Installation covers the CLI, Claude Code and Codex. Agent skills provides setup, validation and review workflows installable with npx skills add stsepelin/checktrail. Project setup covers init, doctor and MCP configuration generator. Release preparation records publication and verification gates. The milestone audit separates implemented profiles from open acceptance work; client checks record actual application coverage. Public adoption records the published package on five pinned libraries, including setup friction and compatibility gaps. Alpha.3 fixes the recorded TypeScript 4.9.5 incompatibility. The setup scope guide explains language, documentation and workflow coverage. Alpha.5 adds named Go build-tag profiles with per-check exclusions. Its release record includes package, client and upgrade/rollback verification.

The hosted matrix passed at release commit 832a044 on Linux and macOS. The exact npm tarball and fresh CLI/MCP installations were verified. The MCP Registry entry is active; execution remains disabled by default.

Checktrail discovers projects, plans registered checks, invokes native tools when explicitly trusted, and reports results without turning skipped or empty checks into success. The same engine serves developers, CI and MCP clients.

The optional library task store retains local validation results across restarts. A library worker adds native execution, polling and cancellation. MCP reports still use memory; standard Tasks integration remains pending.

Try the local checkout

Requires Node.js 22 or newer. Execution currently targets macOS and Linux.

npm ci --ignore-scripts
npm run build
node dist/src/cli.js plan --root examples/javascript --detailed
node dist/src/cli.js run --root examples/javascript --trust-project --detailed

plan and inspect read files without executing project code. run requires --trust-project: tests, compiler plugins and project configuration can execute code with your user privileges. This is not a sandbox.

Successful commands return JSON except help/version; input errors use stderr. Exit codes:

A passing run applies to the selected checks and scope only. PHP syntax passing does not imply its application tests passed. Unknown frameworks and empty plans are incomplete. A source change during validation prevents an aggregate pass.

Initial adapters

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Checktrail: common questions

Is Checktrail MCP server safe?: Yes, by our scan: it is graded A (92/100). Read the Checktrail safety report
How do I install Checktrail?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Checktrail need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Checktrail maintained?: The last commit was 4 days ago (2026-10-31). The latest release is v0.1.0-alpha.5.
How does Checktrail compare with other MCP servers?: safety score 92/100 (higher than 95% of 48,255 servers); tools 10 (the typical server has 7); tools that change things 20% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.