kitsune-mcp

shapeshift

Mount MCP servers at runtime without restart. Replace or remove servers, filter tools, and apply sandboxing with Docker.

Instructions

Mount an MCP server's tools at runtime. Empty server_id unmounts.

shapeshift('mcp-server-time') # mount (community sources cage by default) shapeshift('id', tools=['only_this']) # lean — mount only listed tools shapeshift('id', sandbox=False) # opt out of the default Docker cage shapeshift('id', sandbox=True) # force the cage (hard-fail if no Docker) shapeshift() # unmount + kill process

sandbox: None (default) cages low-trust npm/PyPI/github sources in Docker when it's available (best-effort — runs uncaged with a nudge if not); True forces the cage; False opts out. source: auto|local|smithery|official. confirm=True for community sources.

Input Schema

TableJSON Schema

Name	Required	Default
`keep`	No
`tools`	No
`source`	No	auto
`confirm`	No
`sandbox`	No
`server_id`	No
`server_args`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.21.0Jul 24, 2026

addedInput schema / properties / sandbox

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Sandbox"
+}

Changed7 schema fields changedv0.20.3May 16, 2026

removedInput schema / properties / confirm / description

Removed value: -"Bypass the community-trust gate after reviewing the server. Required for npm/github/glama-via-github sources unless KITSUNE_TRUST=community is set in the environment."

removedInput schema / properties / keep / description

Removed value: -"On unmount (empty server_id), keep the subprocess in the pool for fast re-attach. Default False — fully cleans up on unmount."

removedInput schema / properties / server_args / description

Removed value: -"Extra CLI arguments appended to the server's install command — e.g. ['/private/tmp'] to scope the filesystem server to a directory."

removedInput schema / properties / server_id / description

Removed value: -"Server identifier to mount — npm package, PyPI package, registry slug, or full HTTP(S) URL. Leave empty to unmount the current form. Examples: 'mcp-server-time', '@modelcontextprotocol/server-filesystem', 'https://api.example.com/mcp'."

removedInput schema / properties / source / description

Removed value: -"Registry/install source preference. 'auto' picks the best available; 'local' forces npx/uvx install (downloads + runs locally); 'smithery' requires SMITHERY_API_KEY; 'official' restricts to the verified MCP registry."

removedInput schema / properties / source / examples

Removed value: -[
-  "auto",
-  "local",
-  "smithery",
-  "official"
-]

removedInput schema / properties / tools / description

Removed value: -"Optional allowlist of tool names to mount — load only these instead of the full toolset. Use to keep context lean when a server exposes many tools you don't need."

Changed7 schema fields changedv0.20.2May 16, 2026

addedInput schema / properties / confirm / description

Added value: +"Bypass the community-trust gate after reviewing the server. Required for npm/github/glama-via-github sources unless KITSUNE_TRUST=community is set in the environment."

addedInput schema / properties / keep / description

Added value: +"On unmount (empty server_id), keep the subprocess in the pool for fast re-attach. Default False — fully cleans up on unmount."

addedInput schema / properties / server_args / description

Added value: +"Extra CLI arguments appended to the server's install command — e.g. ['/private/tmp'] to scope the filesystem server to a directory."

addedInput schema / properties / server_id / description

Added value: +"Server identifier to mount — npm package, PyPI package, registry slug, or full HTTP(S) URL. Leave empty to unmount the current form. Examples: 'mcp-server-time', '@modelcontextprotocol/server-filesystem', 'https://api.example.com/mcp'."

addedInput schema / properties / source / description

Added value: +"Registry/install source preference. 'auto' picks the best available; 'local' forces npx/uvx install (downloads + runs locally); 'smithery' requires SMITHERY_API_KEY; 'official' restricts to the verified MCP registry."

addedInput schema / properties / source / examples

Added value: +[
+  "auto",
+  "local",
+  "smithery",
+  "official"
+]

addedInput schema / properties / tools / description

Added value: +"Optional allowlist of tool names to mount — load only these instead of the full toolset. Use to keep context lean when a server exposes many tools you don't need."

First observedv0.20.1May 14, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains sandbox behavior in detail (best-effort, force, opt-out), the confirm parameter for community sources, and the unmounting process. It does not elaborate on potential side effects like process termination beyond unmounting, but coverage is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with code-like examples and clear sections. It is somewhat lengthy but each line adds value. Could be slightly more concise without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 parameters, no required, 0% schema coverage), the description is highly complete. It covers main functionality, parameter behaviors, and example usages. An output schema exists, so return values are not required in the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description adds substantial meaning beyond the schema. It explains the key parameters: server_id (empty unmounts), sandbox (None default, True forces, False opts out), source (auto|local|smithery|official), confirm (for community sources), and tools (via examples). This is comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Mount an MCP server's tools at runtime.' It provides specific verb+resource actions, including mounting, unmounting, and various configurations. The examples distinguish it from sibling tools like reload, search, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit examples of when to use different options (e.g., mounting with specific tools, sandbox modes, unmounting). It does not explicitly state when not to use the tool, but the context is clear enough to infer appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server