Back to Browse

Prepboard MCP Server

Developer ToolsModerate5.9MCP RegistryLocal
Free

Server data from the Official MCP Registry

Calaf seeds core subset (4 of 38): format, validate, import, list workspaces.

About

Calaf seeds core subset (4 of 38): format, validate, import, list workspaces.

Security Report

5.9
Moderate5.9Moderate Risk

prepboard is a small forwarding client that sends JSON-RPC tools/call requests to the documented Calaf endpoints. The public tools are unauthenticated, the account tools require a Bearer token read from CALAF_ACCESS_TOKEN, and no shell execution, dynamic code evaluation, or hardcoded secrets were found. The main points to note are that the endpoint override env vars could redirect the token to another host, and upstream results are returned verbatim to the AI client. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-prepboard": {
      "args": [
        "-y",
        "@reneturcios/prepboard"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

prepboard

prepboard is a small forwarding client for the Calaf recruiting workspace servers. It covers the seed workflow: read the seed document format, validate a seed against it, import a seed into a workspace, and list your workspaces. One binary serves a command-line interface and a stdio MCP server.

Labelled core subset — 4 of 38 tools. The original Calaf account server documents 38 tools, but only four of them have published parameter tables. prepboard builds exactly those four and omits the other 34 rather than inventing their schemas. The omitted tools are: export_seed, get_profile_schema, get_firm_profile, submit_firm_profile, log_touchpoint, update_contact, add_task, get_contacts, get_firms, log_firm_work, get_firm_work, remove_firm_work, get_applications, schedule_interview, add_application, update_application, get_tasks, complete_task, snooze_task, add_firm, update_firm, add_office, add_note, get_notes, update_note, create_workspace, rename_workspace, archive_workspace, add_template, get_templates, update_template, add_prep_question, get_prep, draft_prep_answer.

How it talks to Calaf

Calls are forwarded as JSON-RPC tools/call POSTs to the upstream MCP endpoints — this wire shape is a documented reconstruction from the public spec, and the upstream result value is returned verbatim.

  • Public seeds endpoint: https://calaf.ai/api/mcp — no auth. Serves seed-format / get_seed_format and validate-seed / validate_seed.
  • Account endpoint: https://calaf.ai/api/mcp-account — requires Authorization: Bearer <token> with the token from the CALAF_ACCESS_TOKEN environment variable. Serves import-seed / import_seed and workspaces / list_workspaces. When the token is missing, these commands fail with an error naming CALAF_ACCESS_TOKEN; they never fabricate a result.

Endpoint overrides: CALAF_MCP_URL for the public endpoint and CALAF_ACCOUNT_MCP_URL for the account endpoint.

Install

npx @reneturcios/prepboard seed-format

Or run the container image:

docker run -i ghcr.io/cloudcorprecords/prepboard

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead. Account commands inside the container need -e CALAF_ACCESS_TOKEN=....

CLI

prepboard seed-format
prepboard validate-seed '<seed-json-or-string>'
prepboard import-seed my-workspace '<seed-json-or-string>' --parts orgs,templates,prep,contacts
prepboard workspaces

prepboard --version

A <seed> argument is taken as a JSON value when it parses as an object, otherwise as a plain string seed — the Calaf seed format accepts both a string and an object form. Commands print the upstream result as JSON. Exit codes: 0 on success, 1 when a call fails (including a missing token or an upstream error), 2 for usage errors.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/prepboard mcp

MCP client configuration:

{
  "mcpServers": {
    "prepboard": {
      "command": "npx",
      "args": ["-y", "@reneturcios/prepboard", "mcp"],
      "env": {
        "CALAF_ACCESS_TOKEN": "<your Calaf access token>"
      }
    }
  }
}

The token is only needed for import_seed and list_workspaces; get_seed_format and validate_seed work with nothing configured.

Tools

ToolInputEndpointWhat it returns
get_seed_format(none)publicThe seed document format.
validate_seedseed (string or object, required)publicThe validation result for that seed.
import_seedworkspace (required), seed (string or object, required), parts (string array, optional: orgs / templates / prep / contacts)accountThe import result.
list_workspaces(none)accountThe caller's workspaces.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, no network (fake fetch fixtures)
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!