Skip to main content
Glama

x4-mcpgen

CI License

Generate production-oriented MCP server scaffolds — secure by default.

Part of the X4 ecosystem: x4-skills → x4-mcpgen → x4-sec → x4-runtime → x4-obs

30-second demo

pip install -e ".[dev]"
x4-mcpgen init weather --tools 2
cd weather
pip install -e ".[dev]"
pytest -q
x4-mcpgen validate .
x4-mcpgen test .

Related MCP server: mcpnew

Why not another template?

Most MCP starters ship with broad permissions and no tests. x4-mcpgen produces:

  • Explicit tool allow-lists (no "*")

  • Unit tests for every generated tool

  • SECURITY.md, Apache-2.0, CI workflow

  • mcp.json with stdio transport only by default

  • Dockerfile with non-root user

  • Ready for x4-sec scan

CLI

x4-mcpgen init <name> [--tools N] [--out DIR]
x4-mcpgen validate [PATH]
x4-mcpgen test [PATH]
x4-mcpgen package [PATH]
x4-mcpgen doctor

Generated layout

my-mcp/
├── src/<pkg>/
│   ├── server.py
│   └── tools/
├── tests/
├── schemas/
├── Dockerfile
├── mcp.json
├── pyproject.toml
├── README.md
├── SECURITY.md
├── LICENSE
└── .github/workflows/ci.yml

Architecture — Mermaid scope map

flowchart TD
    SPEC[Tool Definitions] --> VALID[Validate Configuration]
    VALID --> GEN[Generate MCP Project]
    GEN --> SRC[Server and Tool Modules]
    GEN --> TEST[Generated Tests]
    GEN --> POLICY[Allow-list and stdio-first Config]
    GEN --> DOCS[Security Docs and License]
    GEN --> CI[CI and Container Files]
    SRC --> CHECK[Validate and Test Generated Project]
    TEST --> CHECK
    POLICY --> CHECK
    DOCS --> CHECK
    CI --> CHECK

License

Apache-2.0

APEX Architecture Map

Status: architecture documentation; implementation and deployment claims require independent verification.

flowchart LR
  Source[Canonical tool contract] --> Normalize[Normalize names and types]
  Normalize --> Validate[Validate schema constraints]
  Validate -->|invalid| Diagnostics[Actionable schema errors]
  Validate -->|valid| Generate[Generate protocol schema artifacts]
  Generate --> Determinism{Repeat generation identical?}
  Determinism -->|no| Fail[Fail determinism test]
  Determinism -->|yes| Fixtures[Update or compare golden fixtures]
  Fixtures --> Consumer[Compile / validate sample consumer]
  Consumer --> Compat{Breaking change detected?}
  Compat -->|yes| Major[Require explicit version bump]
  Compat -->|no| Package[Package generated artifacts]
  Package --> Provenance[Record generator and input version]

Evidence note: Deterministic output, compatibility checks, and consumer validation are proposed quality gates; verify they exist before claiming code generation is production-safe.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables developers to scaffold secure-by-default MCP servers with deny-all permissions, typed tool stubs, and pre-wired audit hooks, while enforcing security posture through CI.
    4 npm
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Generates complete, runnable MCP server projects from natural-language tool descriptions, including schema, implementation, tests, README, and license. It enables AI agents to scaffold standalone MCP servers ready to install and run.
    MIT