Napkin MCP Server

mcp-servers

Source-available MCP servers by Mindstone. Works with any MCP host — Claude Desktop, Cursor, Rebel, and others.

Browse all 35 connectors with their version, auth model, and tool count at the catalogue site (regenerated from each connector's STATUS.json on every push).

Connectors

Quick Start

Each server builds independently:

cd connectors/<name>
npm install
npm run build

Or run directly via npx (once published):

npx -y @mindstone/mcp-server-zendesk

Moving from @mindstone-engineering/? Every server has been republished under the shorter @mindstone/ npm scope. The legacy @mindstone-engineering/mcp-server-* packages still install but are marked deprecated. See MIGRATION.md for the consumer one-liner and the deprecation timeline.

See each server's README for configuration and host setup instructions. Some connectors require additional environment variables to opt into specific behaviour (e.g. QB_ALLOW_PROD_WRITES for QuickBooks production writes, MCP_WORKSPACE_PATH for sandboxed file reads, BROWSER_AUTOMATION_ALLOW_EVAL for browser-automation script eval) — see the per-connector READMEs for the full list.

Security & Hardening

This monorepo follows a defence-in-depth posture for tool-call hosts. Highlights include:

• Workflow safety. GitHub Actions workflows are env-fy'd against script injection (CWE-94), every action is pinned to a commit SHA (kept current by Dependabot), and each job is granted a least-privilege permissions: block. Publish is split into a build job (does the install/test/pack with no publish credentials) and a publish job (downloads the packed tarball, runs only npm publish --ignore-scripts --provenance under OIDC trusted publishing, gated by the npm-publish environment). The publish job invokes NO third-party JS — tsc, vitest, lifecycle scripts, etc. all run upstream, away from id-token: write. See docs/security/AUDIT_FOX-3319_tanstack_supply_chain.md for the supply-chain threat model and docs/security/BRANCH_PROTECTION.md for required GitHub settings.
• Release-age cool-down. The repo-level .npmrc sets min-release-age=7 (days), so CI refuses to install dependency versions published in the last week. This blocks the "same-day malicious re-publish" path that ships post-npm audit-clean PRs into a release tag.
• Reproducible release tarballs. Releases are currently published manually under the @mindstone/ npm scope from a wave-lead's machine, behind a human approval gate (see docs/PUBLISH_APPROVAL_PROCESS.md). Provenance attestations are not produced for manual publishes, but the tarball shasum is human-verifiable: check out mindstone/mcp-servers at the release tag and run npm pack — the resulting tarball must match the one on the npm registry. See MIGRATION.md for the consumer verification one-liner.
• OpenSSF Scorecard. The repo runs the OpenSSF Scorecard weekly via .github/workflows/scorecard.yml. The report is generated by a third party from the source tree, so every claim above (action pinning, branch protection, token usage, dependency hygiene) is independently checked rather than just asserted here. The current score is shown by the badge at the top of this README.

Recommendations for consumers

These connectors are published as plain npm packages. The strongest single thing you can do to protect yourself from a future supply-chain compromise of any npm package (these or otherwise) is to use a client that does not run lifecycle scripts by default:

• pnpm (pnpm install / pnpm dlx) — does not execute postinstall/prepare hooks unless explicitly allowlisted via onlyBuiltDependencies. pnpm v11+ also defaults to a 24-hour minimumReleaseAge cool-down.
• bun (bunx) — same default, no lifecycle scripts unless allowlisted.
• npm — if you must use npm, set min-release-age=7 and ignore-scripts=true in your global ~/.npmrc. Requires npm v11.10+ for min-release-age.

None of our published packages need postinstall to function, so disabling lifecycle scripts in your installer of choice is safe.

• Untrusted-content envelopes. External content from email, helpdesk, and ticketing systems (email-imap, freshdesk, zendesk) is wrapped in <untrusted-content source="..."> envelopes with close-tag breakout escaping, so an LLM host can recognise and refuse instruction-injection attempts.
• Workspace sandboxing. File-uploading connectors (nano-banana, pandadoc, elevenlabs) constrain reads to MCP_WORKSPACE_PATH (or os.tmpdir()) with canonical-prefix containment that handles symlinked roots like /tmp → /private/tmp.
• Secure-by-default writes. Production-impacting writes (QuickBooks invoices/bills/customers/vendors) require an explicit QB_ALLOW_PROD_WRITES=1 opt-in env var; outreach prospect-enrolment and mixmax sequence-recipient tools carry destructiveHint: true so hosts surface confirmation prompts.
• SSRF & path traversal. Download connectors (napkin, runway) enforce host allow-lists, manual-redirect handling, and symlink-safe write paths under a configurable root.
• Loopback OAuth bind. Connectors with local OAuth callback servers (salesforce, outreach) hard-code 127.0.0.1, ignoring any MCP_OAUTH_BIND_HOST override.
• E.164 validation. Outbound phone-call tools (retell-ai) reject non-E.164 numbers before any upstream API call.

For per-connector security notes, see each connector's README.

To report a vulnerability, please see SECURITY.md.

Licence

Each connector is licensed under FSL-1.1-MIT — see the LICENSE file in each connector directory for details.