Is Nervous System free?

Yes, Nervous System is free to use.

How do I install Nervous System?

Nervous System is a local plugin. Install it using npm package: mcp-nervous-system and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Nervous System safe to use?

Nervous System was flagged by MCP Marketplace's security scan, scoring 3.2/10 (high risk). It has 6 high or critical findings to review. Review the security report on this page carefully before installing it.

What AI apps work with Nervous System?

Nervous System uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Nervous System MCP Server

by levelsofself

Developer ToolsUse Caution3.2Local

Free

Governance for LLM agents: 7 enforced rules + read-only reference tools. Safe in any MCP client.

About

Governance for LLM agents: 7 enforced rules + read-only reference tools. Safe in any MCP client.

Security Report

3.2

Use Caution3.2High Risk

This MCP server implements behavioral governance for multi-agent LLM systems with hash-chained audit trails and kill-switch functionality. While the code demonstrates good architectural intent (audit chains, permission protocols, violation logging), it contains several security concerns that prevent a higher score: unauthenticated access to critical destructive operations (kill switch, dispatch to LLM), hardcoded default kill secret, weak permission validation, use of shell spawning with user input, missing input sanitization on dispatch tasks, and broad file I/O permissions with insufficient access controls. The server's security depends heavily on environment variable configuration that is not validated, and there is no authentication layer protecting sensitive operations. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

3 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

process_spawn

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-levelsofself-nervous-system": {
      "args": [
        "-y",
        "mcp-nervous-system"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Nervous System

Deterministic governance lint for MCP server configurations, plus reference tooling for the 7 rules.

What each tool actually does

Tool	Does real work?
`audit_mcp_config`	Yes. Deterministic lint, zero dependencies, fully offline, never throws. Checks inline secrets in env, shell wrappers, unpinned packages, auto-install flags, broad filesystem scopes, non-TLS remote transports, unpinned docker tags. Returns findings with severities and a 0-100 score.
`check_preflight`	Yes, when configured. Reads `protected_files_list` from `nervous-system.config.json` or `NERVOUS_SYSTEM_PROTECTED_LIST`. With no list it says so rather than guessing. If the list is unreadable it FAILS CLOSED.
`get_*` (everything else)	No. They return text: the framework, templates, instructions. That is why they are named `get_`.

Install

npx mcp-nervous-system

Free local tool: audit_mcp_config

Pass your config as config (object) or config_json (string), e.g. the contents of claude_desktop_config.json. Returns findings with severities and a 0-100 score.

Hosted API (pay-per-call, x402, USDC on Base)

The write-capable toolset runs server-side and is not in this package.

POST https://api.100levelup.com/x402/audit-mcp - governance lint ($0.05 USDC)
GET https://api.100levelup.com/x402/verify-audit - audit-chain verification ($0.005 USDC)

Discovery: /openapi.json and /llms.txt.

2.0.0 breaking changes

emergency_kill_switch -> get_kill_switch_instructions. It never stopped anything.
verify_audit_chain -> get_audit_verification_instructions. It never verified a chain.
dispatch_to_llm -> get_dispatch_command. It never dispatched.
check_preflight no longer matches hardcoded filenames from the author's own server. It reads your list.
Hardcoded fleet counts and violation totals removed from get_origin_story. A number baked into a package is a fossil the moment it ships.