Server data from the Official MCP Registry
Aggregate local script portability risks without exposing script text or project names. Tools...
About
Aggregate local script portability risks without exposing script text or project names. Tools...
Security Report
Shebang Sherpa is a well-designed, security-conscious MCP server that performs local script portability audits without exposing sensitive data. The code demonstrates strong defensive practices: it explicitly avoids executing scripts, skips sensitive files (.env, credentials, keys), strips all identifying information from output, and enforces filesystem boundaries via path validation. Minor code quality observations exist (broad exception handling, limited input validation on project path), but these do not materially impact security given the server's read-only, data-free design. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.
6 files analyzed · 5 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-mrfentmen-shebang-sherpa-mcp": {
"args": [
"-y",
"shebang-sherpa-mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
shebang-sherpa-mcp
Shebang Sherpa is a local portability audit for scripts that work on one laptop and mysteriously fail on another. It scans bounded script candidates and reports aggregate interpreter categories, executable-bit coverage, and coarse portability warnings.
Tool
inspect_script_portability: scan a local project without executing scripts.
The result can flag machine-specific interpreter paths, legacy interpreter names, absolute system interpreters, executable files without shebangs, and scripts missing the executable bit. It never returns paths, script text, project names, dependency names, command arguments, or environment values.
Safety
- Reads files only. It never executes a script, shell, package manager, hook, or launcher.
- Skips Git metadata, dependency folders, build output, coverage, and common caches.
- Uses a bounded file count and file size.
- Confines the project to
SHEBANG_SHERPA_ROOT. - This is a portability heuristic, not a shell parser or security scanner.
Run
npm install
npm run build
node dist/index.js
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Paperclip
Freeby Paperclipai · Developer Tools
Trending hip-hop artist momentum scores across four cultural dimensions.
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.