Back to Browse

Env Contract MCP Server

Developer ToolsLow Risk9.0MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local value-free environment contract and configuration drift inspection. Tools include inspect...

About

Local value-free environment contract and configuration drift inspection. Tools include inspect...

Security Report

9.0
Low Risk9.0Low Risk

Valid MCP server (3 strong, 3 medium validity signals). 1 known CVE in dependencies (0 critical, 1 high severity) Package registry verified. Imported from the Official MCP Registry.

5 files analyzed · 2 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

database

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-mrfentmen-env-contract-mcp": {
      "args": [
        "-y",
        "env-contract-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

env-contract-mcp

Env Contract is a local MCP tool for finding configuration drift before a project fails at runtime. It compares variable names declared in .env.example and dotenv files with likely environment references in source and config files.

Tool

  • inspect_contract: report declared names, referenced names, missing names, unused names, and the files where they occur.

Safety

  • Reads local project files only; it never fetches URLs.
  • Never reads or emits environment values. Only names and bounded file paths are returned.
  • Ignores node_modules, build output, coverage, and Git internals.
  • Caps file count, file size, recursion depth, and output.
  • Matching is heuristic and is not a replacement for a build, deployment check, or secret scanner.

Set ENV_CONTRACT_ROOT to bound analysis to a workspace root. It defaults to the parent of the MCP package when launched normally.

Run

npm install
npm run build
node dist/index.js

Reviews

No reviews yet

Be the first to review this server!