What we shipped, what we are building, what comes next

mcp-forge generates MCP servers from an API, a website, a CLI or a codebase, then scores their quality and security. This page tracks the work in the open.

17 · Shipped 1 · In progress 17 · Planned

Protocol & security

Generated servers

Shipped

Streamable HTTP transport

Legacy SSE removed entirely.

OAuth 2.1 with PKCE

Tokens accepted in the Authorization header only, never in the URL.

Discovery and audience checks

RFC 9728 and RFC 8414 metadata, RFC 8707 audience binding.

Origin header validation

Protects local servers against DNS rebinding.

Injection hardening

Code injection (CWE-94) and command injection (CWE-78), covered by tests.

Planned

Resources and prompts

Beyond tools: the source's docs and reference data as resources, ready-made usage scenarios as prompts.

Tool annotations

readOnly, destructive, idempotent and openWorld hints, derived from the source.

Typed responses

outputSchema from API response schemas, with field filtering.

Confirmation before destructive actions

Elicitation when the client supports it, explicit confirm otherwise.

Custom instructions for the LLM

Per tool or per server, checked against tool poisoning.

Evaluator

Quality and security score

Shipped

Anchored scoring rubric

Six criteria, a justification before each score.

Real checks before scoring

Compilation, import and live security tests on the generated server.

Static analysers

Bandit, secrets in logs, ReDoS.

Planted-bug benchmark

13/24 bugs found before, 20/24 now, with zero false alarms.

Asynchronous evaluation

Provisional score first, final report when ready.

Planned

OWASP MCP Top 10 coverage

A public map of each risk against the generator and the evaluator.

Security knowledge base

MCP specification and OWASP guidance available to the evaluator.

Benchmark v3

Unseen bug types: 3/6 found today. The real generalisation figure.

Sources & languages

What can be turned into a server

Shipped

OpenAPI, GraphQL, websites, CLIs

One command per source type.

Codebases in 23 languages

A dedicated template for each language.

Planned

Regenerated example gallery

28 public examples rebuilt with the new generator and evaluator.

Parsers open to contributors

Contribution guide and issues per language, including COBOL and Fortran.

CLI & integration

pip install vulcai-mcp-forge-cli

Shipped

CLI 0.4.0

Tested on Linux, macOS and Windows, Python 3.11 and 3.12.

Pinned dependencies

Lockfile checked in CI, security updates applied.

GitLab CI template

Generate a server from a pipeline.

Planned

CLI 0.4.1

Clean JSON output for scripts and pipelines.

CI integration guide

GitHub Actions, GitLab, Jenkins, corporate proxies.

Fully offline on-premise

For air-gapped networks, with an SBOM.

MCP SDK 2.x

Migration of generated servers to the new SDK.

Platform

Hosted service

Shipped

Open beta

Free account with a beta key.

Fair-use limits

Per-account quotas and a global safeguard, so the beta stays free.

In progress

Hosted MCP server: OAuth completion

Client metadata documents and token refresh.

Planned

Sandbox

See the tools generated from your API, no sign-up needed.

Directory listings

Smithery and Glama.

Isolated evaluations

Each evaluation runs on its own, apart from generation.

Feedback and parser contributions are welcome · contact@vulcai.io