Electron MCP Server

@yawlabs/electron-mcp

Make your AI assistant actually good at Electron. 18 tools for the stuff AI models hallucinate about: context isolation, preload bridges, fuses, CSP, signing, auto-updates, breaking changes between majors, and the 20 official security recommendations.

This is not a runtime debugger. It is a development-intelligence layer that turns "write me some Electron code" from hit-or-miss into correct-on-the-first-try.

Built and maintained by Yaw Labs.

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

Why this one?

Other Electron MCP servers give your model a shell and hope. This one doesn't.

• IPC that isn't a security hole — electronscaffoldipc_channel generates main handler + typed preload bridge + contextBridge exposure + renderer usage in one call. No nodeIntegration: true, no direct ipcRenderer on window.
• The official security recommendations, enforced — electronauditsecurity checks your BrowserWindow config, preload scripts, and CSP against 19 of the 20 items from electronjs.org/docs/latest/tutorial/security that can be verified from static inputs. (The 20th, session permission handling, needs runtime context and is flagged in the report footer.) Not a vibe check.
• Version-aware migration — electronmigrateversion knows the breaking changes from v28 through v41 and tells you exactly what will break when you bump. electroncheckdeprecated_apis scans your code for APIs that were removed.
• Build errors, explained — electrondiagnosebuild_error parses electron-builder/forge output and identifies root causes: Apple signing, Windows code signing, native module rebuilds, ASAR packaging, entitlements, path quoting.
• Modern production hardening — electronconfigurefuses generates the @electron/fuses block for disabling unused runtime features (cookie encryption, Node CLI flags, legacy load behaviour). electronconfigurecsp generates a CSP that actually works with your bundler and framework instead of blocking your own assets.
• Knowledge freshness is declared, not assumed — every response includes a Knowledge last verified YYYY-MM-DD (Electron vN stable) footer. Call electronknowledgeversion to get the metadata directly. If your Electron is newer than the footer, the tool tells you.
• Read-only, no side effects — every tool declares readOnlyHint, destructiveHint: false, idempotentHint: true, so MCP clients can skip confirmation. The tools never touch your filesystem, never run code, never call exec.
• Zero runtime dependencies — ships as a single bundled file. No 5-minute node_modules install, no electron or electron-builder installed as dependencies to inflate your project. The published package's dependencies is {}; Dependabot alerts on this repo are against devDependencies. Most of that surface (the MCP SDK's HTTP transport: hono, express, ip-address, qs) is not in the bundle — this server uses stdio only — but fast-uri, which the SDK's default JSON Schema validator (ajv) needs, is inlined into dist/index.js, so an advisory against it is cleared by a new release, not by reinstalling.

Shortened. The full README is on GitHub.