How do I use Publish Control?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Publish Control run a full publish security scan on this repo and show my score" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Publish Control

by EthYusuf

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

🛡️ Publish Control

Pre-publish security & code quality analysis MCP server for AI coding assistants (Google Antigravity, Cursor, Claude Desktop, Codex).

Publish Control, yapay zeka kodlama asistanları ile geliştirilen projeleri yayına almadan önce 17 farklı güvenlik ve mimari kategorisinde otomatik analizden geçiren, açık kaynaklı bir Model Context Protocol (MCP) sunucusudur.

🎯 17 Güvenlik & Kalite Denetim Modülü

AI asistanınıza /publish-control yazdığınızda sistem aşağıdaki 17 kontrolü eşzamanlı çalıştırır:

No	Modül	İkon	Açıklama	Seviye
1	Secrets Detection	🔑	AWS, Stripe, GitHub, JWT, Google API anahtarları ve Shannon entropi analizi	`CRITICAL`
2	Environment Security	📁	`.env` dosyalarının gitignore durumu, açıkta kalan anahtarlar ve fallback riskleri	`CRITICAL` / `HIGH`
3	Injection Protection	💉	SQL string concat, NoSQL (`$where`), komut çalıştırma (`exec`), XSS kontrolleri	`CRITICAL` / `HIGH`
4	Auth & Authorization	🔒	JWT `none` algoritması, zayıf hashler (MD5/SHA1), yetkisiz Express rotaları	`CRITICAL` / `HIGH`
5	Server Config Audit	🌐	`0.0.0.0` dinleme, açık debug bayrakları, eksik Helmet koruması	`HIGH` / `MEDIUM`
6	CORS Misconfiguration	🛡️	Wildcard (`*`) origin, `credentials: true` çakışması	`HIGH` / `CRITICAL`
7	HTTPS / TLS Security	🔐	`rejectUnauthorized: false`, düz HTTP dış istekleri	`CRITICAL` / `HIGH`
8	Path Traversal	📂	`path.join`/`fs` çağrılarında kullanıcı girdisiyle dizin dışına çıkma	`CRITICAL`
9	SSRF Detection	🌍	Kullanıcı kontrollü URL istekleri, `169.254.169.254` bulut metadata sızıntısı	`CRITICAL` / `HIGH`
10	Docker Security	🐳	`USER root`, `:latest` tag, `privileged: true`, `.dockerignore` denetimi	`HIGH` / `MEDIUM`
11	Dependency Audit	📦	Eksik lockfile (`package-lock.json`), wildcard (`*`) versiyonlar, riskli paketler	`HIGH` / `MEDIUM`
12	Rate Limiting	⚡	Brute-force ve DoS risklerine karşı rate limiter koruma eksikliği	`MEDIUM` / `HIGH`
13	File Permissions	🗂️	`chmod 777` kullanımı, filtresiz dosya yükleme (multer)	`HIGH` / `MEDIUM`
14	Error Handling	❌	Stack trace sızıntısı, istemciye çiğ hata objesi dönülmesi	`MEDIUM`
15	Sensitive Logging	📝	`console.log` ile şifre, token ve request body yazdırılması	`MEDIUM` / `HIGH`
16	Security Config	🔧	Eksik `httpOnly` çerez bayrakları, TypeScript strict mod eksikliği	`MEDIUM` / `HIGH`
17	Code Quality Hygiene	📊	`@ts-ignore` aşırılığı, çözülmemiş güvenlik TODO/FIXME notları, `any` kirliliği	`LOW` / `MEDIUM`

Related MCP server: Security-Use MCP Server

🛠️ Sunulan MCP Araçları (Tools)

publish_control: 17 kategoride tam tarama yapar, 0-100 güvenlik skoru ve görsel Markdown raporu üretir.
publish_control_quick: Sadece en kritik güvenlik açıklarını (Secrets, Env, Injection, Auth, Server) hızla inceler.
publish_control_fix: Tespit edilen herhangi bir bulgunun ID'sine (ör. SEC-001, INJ-002) göre kod düzeltme ve refactor önerisi verir.

🚀 Hızlı Başlangıç

1. Kurulum & Derleme

git clone https://github.com/EthYusuf/publish-control.git
cd publish-control
npm install
npm run build

2. İstemcinize MCP Konfigürasyonunu Ekleyin

Google Antigravity

~/.gemini/config/mcp_config.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>/dist/index.js"]
    }
  }
}

Cursor IDE

~/.cursor/mcp.json veya .cursor/mcp.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>/dist/index.js"]
    }
  }
}

Claude Desktop

%APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>\\dist\\index.js"]
    }
  }
}

🧪 Testleri Çalıştırma

npm test

📄 Lisans

Bu proje MIT Lisansı altında lisanslanmıştır.

Available Tools

3 tools

publish_controlB

Projedeki tüm kodları 17 farklı güvenlik kategorisinde analiz eder. Hardcoded secrets, env güvenliği, server açıkları, SQL/NoSQL injection, authentication, dependency güvenliği, Docker, CORS, SSRF, path traversal, HTTPS/TLS, rate limiting, dosya izinleri, error handling, logging, güvenlik konfigürasyonu ve kod kalitesi kontrolleri yapar. Yayına almadan önce kapsamlı güvenlik raporu üretir.

Inputs: projectPath (required), severity, categories.

publish_control_fixA

Belirli bir güvenlik bulgusu için detaylı düzeltme önerileri ve kod örnekleri üretir. Önce publish_control ile tarama yapın, ardından bulgu ID'si ile düzeltme önerisi alın.

Inputs: findingId (required), projectPath (required).

publish_control_quickA

Sadece CRITICAL ve HIGH seviye kontrolleri çalıştırır. Secrets, env exposure, injection ve auth gibi en kritik kontrolleri yapar. Hızlı güvenlik değerlendirmesi için kullanılır.

Inputs: projectPath (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored 2026-10-25 16:40 across 3 tools

Disambiguation4/5

The three tools have distinct roles: a full 17-category scan, a critical/high-only fast scan, and a per-finding remediation helper. The only mild overlap is between publish_control and publish_control_quick, but the descriptions make the scope difference (comprehensive vs CRITICAL/HIGH only) explicit.

Naming Consistency4/5

All tools share a single predictable prefix ('publish_control') with consistent snake_case suffixes (_quick, _fix). The base tool carries no verb, so the pattern is more 'namespace + variant' than verb_noun, but it is internally consistent and readable.

Tool Count4/5

Three tools cover the realistic modes of a pre-deploy security gate: full audit, fast check, and fix guidance. It is on the lean side but each tool has a clear reason to exist rather than being redundant padding.

Completeness3/5

The scan-to-fix lifecycle is present, but there is no standalone way to list or re-query findings, filter by category or severity, export/report results, or suppress/baseline known issues. publish_control_fix also has a hard dependency on finding IDs that only appear in scan output, creating a potential dead end.

Maintenance

ActivityMaintained

ResponsivenessOutdated data

Resources

Related MCP Connectors

SafeWeave
dev.safeweave
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Code Analysis Penetration Testing Security
16
https://mcp.safeweave.dev/mcp
Opzyai Pro
com.opzyai
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Code Analysis Penetration Testing Security
2
https://www.opzyai.com/api/mcp/pro/mcp
FlawPilot
com.flawpilot
Scan websites and code for security, performance and SEO issues from your AI assistant.
Penetration Testing Code Analysis Testing & QA Tools
1
https://mcp.flawpilot.com/mcp
Frogeye Security ScannerA
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
https://mcp.frogeye.ai/mcp

Related MCP Servers

Security MCP Server
Security Code Analysis Testing & QA Tools
michoo
A
license
Not graded
quality
D
maintenance
Enables security scanning of codebases through integrated tools for secret detection, SCA, SAST, and DAST vulnerabilities, with AI-powered remediation suggestions based on findings.
Updated 5 months ago (2026-06-10 21:59 UTC)
MIT
Security-Use MCP Server
Security Testing & QA Tools Developer Tools
security-use
A
license
A
quality
D
maintenance
Enables AI assistants to scan project dependencies and Infrastructure as Code files for security vulnerabilities and misconfigurations. It also provides automated fixing capabilities to remediate identified security issues.
Updated 8 months ago (2026-03-01 13:30 UTC)
18
3
MIT
Cybrium MCP Serverofficial
Penetration Testing Code Analysis
cybrium-ai
A
license
Not graded
quality
C
maintenance
Provides AI coding assistants with real-time security scanning superpowers, including SAST, secrets detection, dependency CVE scanning, and web vulnerability assessment.
Updated 2 months ago (2026-09-01 04:11 UTC)
24 npm
Apache 2.0
CodeMore MCP Server
Code Analysis Developer Tools
abhinavteja123
A
license
Not graded
quality
C
maintenance
Enables AI agents to scan code for security and quality issues and receive machine-readable reports with suggested fixes and verification criteria.
Updated 4 months ago (2026-07-18 16:29 UTC)
83 npm
2
MIT