# toolstile MCP server

> Audits MCP server configurations for plaintext secrets, risky settings, and insecure permissions across various AI agents.

- Repository: https://github.com/toolstile/cli
- Page: https://hostedmcp.org/servers/toolstile/cli
- Transport: stdio
- Stars: 0
- License: MIT

## Install

### Claude Code

```sh
claude mcp add cli -- npx -y toolstile
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "cli": {
      "command": "npx",
      "args": [
        "-y",
        "toolstile"
      ]
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "cli": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "toolstile"
      ]
    }
  }
}
```

### VS Code CLI

```sh
code --add-mcp '{"name":"cli","type":"stdio","command":"npx","args":["-y","toolstile"]}'
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "cli": {
      "command": "npx",
      "args": [
        "-y",
        "toolstile"
      ]
    }
  }
}
```

### Codex

```sh
codex mcp add cli -- npx -y toolstile
```

### Codex config.toml (`~/.codex/config.toml`)

```toml
[mcp_servers.cli]
command = "npx"
args = ["-y", "toolstile"]
```

### Gemini CLI

```sh
gemini mcp add -s user cli npx -- -y toolstile
```

### Gemini settings.json (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "cli": {
      "command": "npx",
      "args": [
        "-y",
        "toolstile"
      ]
    }
  }
}
```

## FAQ

### Does the audit send my data to a server?

No, the audit only reads local config files, makes no network requests, and collects no telemetry.

### Which AI clients does toolstile support?

It supports Claude Code, Claude Desktop, Cursor, Codex, VS Code, Windsurf, Devin Desktop, Gemini CLI, and Cline.

### Does it store my secret values?

No, the tool never prints, stores, or sends secret values.