mcpField
N
nervous-system

nervous-system

Local
github.com/levelsofselfSecurity4Updated 15w ago
Repository

About nervous-system

nervous-system is an MCP server for deterministic linting of MCP server configurations and reference material on seven governance rules. It suits people reviewing configuration safety; its offline audit returns findings, severities, and a score.

Key features

  1. 01Offline configuration linting
  2. 02Severity-tagged findings and score
  3. 03Checks secrets, wrappers, and package pins
  4. 04Preflight checks against a configured file list
  5. 05Read-only governance references

Use cases

  1. 01Review an MCP configuration for risky settings
  2. 02Check protected files before a change

MCP support

Exposes configuration audit, preflight, and reference tools to MCP clients. The `get_*` tools return text; they do not perform enforcement actions.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "levelsofself-nervous-system": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-nervous-system"
      ]
    }
  }
}
Run commandnpx -y mcp-nervous-system

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmmcp-nervous-system1.12.1

Tools

12

Saved tool list · updated 2w ago

This tool takes no parameters.

Details

From the project README

Nervous System

Deterministic governance lint for MCP server configurations, plus reference tooling for the 7 rules.

What each tool actually does

ToolDoes real work?
audit_mcp_configYes. Deterministic lint, zero dependencies, fully offline, never throws. Checks inline secrets in env, shell wrappers, unpinned packages, auto-install flags, broad filesystem scopes, non-TLS remote transports, unpinned docker tags. Returns findings with severities and a 0-100 score.
check_preflightYes, when configured. Reads protected_files_list from nervous-system.config.json or NERVOUS_SYSTEM_PROTECTED_LIST. With no list it says so rather than guessing. If the list is unreadable it FAILS CLOSED.
get_* (everything else)No. They return text: the framework, templates, instructions. That is why they are named get_.

Install

npx mcp-nervous-system

Free local tool: audit_mcp_config

Pass your config as config (object) or config_json (string), e.g. the contents of claude_desktop_config.json. Returns findings with severities and a 0-100 score.

Hosted API (pay-per-call, x402, USDC on Base)

The write-capable toolset runs server-side and is not in this package.

  • POST https://api.100levelup.com/x402/audit-mcp - governance lint ($0.05 USDC)
  • GET https://api.100levelup.com/x402/verify-audit - audit-chain verification ($0.005 USDC)

Discovery: /openapi.json and /llms.txt.

2.0.0 breaking changes

  • emergency_kill_switch -> get_kill_switch_instructions. It never stopped anything.
  • verify_audit_chain -> get_audit_verification_instructions. It never verified a chain.
  • dispatch_to_llm -> get_dispatch_command. It never dispatched.
  • check_preflight no longer matches hardcoded filenames from the author's own server. It reads your list.
  • Hardcoded fleet counts and violation totals removed from get_origin_story. A number baked into a package is a fossil the moment it ships.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.