OpenArtifact MCP server
Commit Nov 13, 2026Connects coding agents like Claude Code and Cursor to an OpenArtifact registry to manage dependencies, find artifacts, and configure package managers.
Also known as openartifact/openartifact-agent-plugin
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Nov 13, 2026
- License
- AGPL-3.0
What is OpenArtifact MCP?
OpenArtifact connects coding agents like Claude Code and Cursor to an OpenArtifact registry to manage dependencies, find artifacts, and configure package managers.
Summary generated from the project's README
About OpenArtifact MCP server
Connecting coding agents like Claude Code and Cursor to an OpenArtifact registry allows developers to manage dependencies and find artifacts directly within their development environment. This plugin enables agents to interact with an OpenArtifact server by using a server URL and an API token, which can be a read-only token for increased security. The setup is designed to be read-only, ensuring the agent follows registry rules without attempting to bypass configurations or fall back to public registries.
Developers use specific tools to automate their workflows. The configure-project tool points package managers like npm, pip, Go, and Cargo to the repository using setup snippets. The check-dependency tool verifies if a version meets curation rules, age requirements, or license policies before installation. Users can also find packages or images via find-artifact and use explain-install-failure to understand why a 403 or 404 error occurred, receiving a specific reason and a fix that respects registry constraints.
What you can do with it
- 1Configure package manager settingsAsk your agent to point npm or pip to your private OpenArtifact repository without hardcoding tokens into your project files.
- 2Verify dependency complianceHave the agent check if a specific package version satisfies your organization's curation rules and license policies before adding it.
- 3Locate specific registry artifactsSearch for packages or images across repositories using names, project properties, or specific statuses like approved.
- 4Debug registry access errorsRequest an explanation for a failed installation to understand which registry rule caused a 403 or 404 error.
Written from the project's README. Every use case is checked against a quote from it.
README
View on GitHubOpenArtifact agent plugin
Use your OpenArtifact registry from a coding agent. The plugin connects the agent to OpenArtifact's MCP server and teaches it four things:
| Skill | What the agent does |
|---|---|
configure-project |
Points Composer, npm, pip, Go, Cargo and other package managers at your OpenArtifact repository, from the server's own setup snippets, without writing a token into the project |
check-dependency |
Before adding or upgrading a dependency, checks that the registry will serve that version (curation rules, minimum age, quarantine, license policy) and picks one it will |
find-artifact |
Finds packages, files and images across the repositories you can read: by name, by project, by your role in a project ("shared with me") or by property (prop:status=approved), and gives the version list and download URL |
explain-install-failure |
Turns a 403 or 404 from the registry into the reason (with the rule, or when the version unlocks) and a fix that respects it |
The plugin is read-only: it only calls OpenArtifact's read tools, and the agent is told never to work around the registry (no public-registry fallback, no disabled config).
Requirements
- An OpenArtifact server with MCP enabled (
MCP_ENABLED=true, andBASE_URLset to the address clients reach). See MCP server. - An API token. A read-only token is enough and recommended.
Claude Code
claude plugin marketplace add openartifact/openartifact-agent-plugin
claude plugin install openartifact@openartifact
Claude Code asks for the server URL and the token when the plugin is enabled; the token is kept in secure storage. To change them later, run /plugin configure openartifact@openartifact inside Claude Code.
Cursor
The plugin also carries a Cursor manifest (.cursor-plugin/plugin.json, mcp.json). Cursor takes the server URL (OA_URL) and the token (API_TOKEN) as plugin variables, which a team administrator sets in the Cursor dashboard under Plugins → Configure.
Development
Install from a local checkout and set the options (claude plugin configure only works on an installed plugin, so --plugin-dir alone cannot supply them):
claude plugin marketplace add .
claude plugin install openartifact@openartifact
claude mcp list # after the options are set: plugin:openartifact:openartifact ... ✔ Connected
Set the options with /plugin configure openartifact@openartifact inside Claude Code: it prompts for them and keeps the token in secure storage. claude plugin configure openartifact@openartifact on its own only lists them.
For automation, pipe the options in from variables your secret store fills, so the token never appears on a command line or in shell history:
jq -n --arg url "$OA_URL" --arg token "$OA_TOKEN" '{server_url: $url, api_token: $token}' \
| claude plugin configure openartifact@openartifact --values-stdin
Check the manifests with python3 scripts/check-plugin.py (what CI runs, with REUSE and workflow lint) and claude plugin validate .. To keep a test away from your own Claude Code setup, run these with CLAUDE_CONFIG_DIR pointing to an empty directory.
Privacy
The plugin sends requests only to the OpenArtifact server you configure, with the token you give it. It has no server of its own, collects nothing and sends nothing anywhere else. What your OpenArtifact server logs is governed by whoever runs it.
License
AGPL-3.0-or-later, the license of OpenArtifact. See LICENSES.
OpenArtifact MCP questions
What can the agent do with this plugin?
The agent can configure project package managers, check dependency availability against curation rules, find artifacts by various properties, and explain installation failures.
Is the plugin read-write or read-only?
The plugin is read-only and only calls the read tools of the OpenArtifact server.
How does the plugin handle privacy?
The plugin only sends requests to your configured OpenArtifact server and does not collect or send data anywhere else.