@fraziym/mcp

The fastest, most secure MCP toolbelt server. 74 tools (files · shell · web · code · git · axodex · memory) behind one process that cold-starts in ~0.3 s and idles at ~65 MB — with a second, smaller MCP surface on top: the router/*, fix/* and brain/* gateway endpoints.

Ships dual-era MCP: protocol 2026-07-28 (stateless, per-request _meta, server/discover) plus legacy initialize-based clients (Claude Desktop, Cursor, Zed, …) over stdio or Streamable HTTP. Every claim below is reproducible — the harnesses and raw artifacts live in this repo (bench · prove · fuzz, test/, catalog.json).

Verified performance

One line to run it:

npx -y @fraziym/mcp serve   # stdio MCP server, 74 tools (+ --router-tools for the gateway)

npm run bench:competitors (medians of 3 runs, warm npx cache, Windows 11, Node 24 — 2026-10-19; raw artifact: docs/bench-2026-10-19.json):

Cold tools/list is answered from a build-time catalog (catalog.json) — no provider SDK or tool class is imported until its family is first called. Self-startup varies 187–299 ms across runs on this machine; npx competitors are 2–3× slower on a cold cache. Run it yourself: npm run bench -- --competitors --json.

Cross-checked against an independent dataset (TechFuelHQ, Windows 11, 2026-08-19, warm caches, 11 popular servers): the same server family measures 0.55–1.9 s ready and 178–422 MB RSS there — so on both methodologies @fraziym/mcp is the fastest and lightest general-purpose MCP server measured to date, with 74 tools in a single process where the benchmarked field needs 5–8 servers (~962 MB for a five-server stack) to cover less.

Related MCP server: lnwjud

Verified correctness & security

YawLabs residual (both are environment/design, not protocol defects, and reported by the suite as optional):

• security-tls-required — fails only when serving plain http:// on loopback for local tests; put TLS in front (reverse proxy/tunnel) for remote use.

• security-oauth-metadata — the check wants a non-empty authorization_servers array. We do publish RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource (with WWW-Authenticate: Bearer resource_metadata="…" on 401) but run static bearer tokens, not OAuth: advertising an authorization server we don't have would be dishonest, so authorization_servers is [].

Official MCP conformance suite (server suite ships for 2025-11-25; 30 scenarios): 8 passed / 22 failed, zero regressions, where the pass set covers everything this server implements — initialize, ping, logging/setLevel, tools/list, tools/call (text + error), and both DNS-rebinding checks. The remaining scenarios exercise resources, prompts, completions, sampling, elicitation, progress/content/logging fixture tools and SSE stream fixtures — features a stateless 2026-07-28 toolbelt server intentionally does not expose (sampling/elicitation were replaced by MRTR in that revision). No fake test_* fixtures were added to game the suite.

Security engineering (details in SECURITY.md): workspace jail with realpath containment, path-arg caps published as maxLength: 4096 in every schema and enforced before dispatch (-32602), 2 MiB argument cap, output truncation, secret-redacted audit log, and the 2026 header/identity checks (-32020 mismatches, -32022 version). HTTP mode binds 127.0.0.1 by default, validates Origin (DNS-rebinding), disables sessions, is POST-only, supports --token bearer auth, and rate-limits tools/call per client (burst 30, 15/s; --rate-limit N|off). This closes the known 2025–2026 MCP CVE classes by construction: filesystem traversal (CVE-2025-53109/53110), git args as flags/options injection (CVE-2025-68143/44/45), unvalidated redirect/OAuth in proxies (CVE-2025-6514), and 0.0.0.0 dashboard exposure à la Grafana MCP.

Groups

axonizTools breakdown (72): files 7 · shell 2 · web 2 · code 4 · git 10 (full, incl. push/pull/stash) · axodex 7 · computer 7 · memory 20 (UnifiedMemory: KV + palace + KG + diary) · misc 3 (get_time, done, absolute_query) · agent-runtime 10 (swarm_spawn, shadow_step, war_room, goal_*) — these last ten return explicit [ERROR] … requires the axoniz agent runtime strings until axoniz exports goals/swarm standalone. Read-only tools publish MCP annotations (readOnlyHint/destructiveHint/openWorldHint) and tools/list stays catalog-static: the default server always advertises exactly 74.

Gateway endpoints (serve --router-tools)

Custom endpoints for agent orchestration, configured via ~/.fraziym/config.json — the shared Fraziym ecosystem config (override $FRAZIYM_HOME; put the keys at the top level or under an "mcp" section so other Fraziym products can share the file). API keys come from apiKeyEnv (recommended) or inline apiKey and are never echoed — router_status reports presence, not material. Audit log and fix queue stay per-product in the machine-local FRAZIYM cache — %LOCALAPPDATA%\FRAZIYM\mcp on Windows, ~/.cache/fraziym/mcp on Linux ($FRAZIYM_MCP_HOME).

{
  "providers": [
    { "name": "openrouter", "kind": "openai", "baseUrl": "https://openrouter.ai/api/v1",
      "apiKeyEnv": "OPENROUTER_API_KEY", "models": ["anthropic/claude-sonnet-4-5"] },
    { "name": "local", "kind": "openai", "baseUrl": "http://127.0.0.1:11434/v1", "models": ["qwen3"] }
  ],
  "routing": { "default": "openrouter", "byModelPrefix": { "gpt": "openrouter" } },
  "verify": [ { "name": "test", "cmd": "npm", "args": ["test"] } ]
}

Usage

import { xorvoidTools } from "@fraziym/mcp/xorvoid";
import { axonizTools } from "@fraziym/mcp/axoniz";

const tools = axonizTools({ workspace: process.cwd() });
// optional memory isolation (defaults to axoniz's own home paths):
// axonizTools({ workspace, memoryPaths: { palace_path: "...", kg_path: "..." } })

tools.specs();                                            // OpenAI function schemas
await tools.call("file_read", { path: "src/index.ts" });  // string result
tools.has("git_push");                                    // true in axonizTools, false in xorvoidTools
tools.meta("git_push");                                   // { destructive: true, network: true }

CLI

Ships with the package as fraziym-mcp. On Windows the tarball also includes bin/fraziym-mcp.exe — a tiny launcher that runs the CLI through your installed Node, so MCP clients spawn a real exe instead of a .cmd shim:

fraziym-mcp serve [--group axoniz|xorvoid|all] [--workspace .] [--read-only] [--no-network]
                  [--allow-outside] [--no-audit] [--http] [--port 7777] [--host 127.0.0.1]
                  [--token SECRET] [--rate-limit 30|off] [--router-tools]
fraziym-mcp tools [--group ...] [--json]
fraziym-mcp call <tool> '{"arg":"value"}'
fraziym-mcp bench [--runs 3] [--competitors] [--json]
fraziym-mcp prove [--out prove-report.json] [--include-input]
fraziym-mcp fuzz [--cases 300] [--seed 1337] [--out fuzz-report.json]
fraziym-mcp doctor
fraziym-mcp install claude|cursor [--write]
fraziym-mcp version

serve speaks MCP (JSON-RPC 2.0) over stdio by default — point Claude Desktop / Cursor / Zed at it (fraziym-mcp install claude prints the ready config). Default group is all (axoniz 72 + the xorvoid extras); --read-only strips destructive tools and --no-network strips network tools. Axoniz's logger writes to stderr, so stdout stays pure protocol.

Contract

• specs() → OpenAI/OpenRouter tools array (function schemas), directly passable to chat-completions.

• call(name, args) → Promise<string>; never throws — failures come back as [ERROR] <tool>: <message> strings so an agent loop keeps going.

• meta(name) → { readOnly?, destructive?, network? } capability flags for role-scoped allowlists; served as MCP annotations.

• File/shell/git/axodex/computer handlers are scoped to workspace (jail enforced by our guard: realpath containment, arg caps); axoniz file_* tools are registered without the mcp-only patch/grep extras.

• Requires Node >= 24.

Install

npm install @fraziym/mcp

License

MIT © AKIK FARAJI