Craft Anything MCP

95/100
Last tested 2026-11-05 (Fresh: tested within 30 days) Working (tool call tested 2026-11-05) No key needed for the tools we called

No advisories in range for tested 0.3.0 (checked 2026-11-09)

Security review: not tested

Score = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. Methodology

  • Install20/20
  • Handshake30/30
  • Maintenance25/25
  • Docs10/15
  • License10/10

Tested craft-anything v0.3.0 (Linux x86_64 release binary from GitHub release v0.3.0, SHA-256 checked against the release's own SHA256SUMS.txt, so not an independent check), started as `craft-anything-cli mcp`. Repo storytold/craft-anything (Apache-2.0) created 2026-10-31, 12,401 GitHub stars when tested. Its 29 tools listed without credentials (more toolsets load on demand). Real calls (no LLM, no credentials, no target loaded): core_session_show, list_toolsets and core_targets_list. No binary or app was analysed, so the analysis toolsets were not tested.
Tool-call test (2026-11-05, direct MCP stdio client, no LLM): pass. 3 of 3 read-only session calls passed. No target was analysed. Evidence: local test run, Nov 5, 2026.

Transport (tested 2026-11-05): stdio

Tested version: 0.3.0 · tested 2026-11-05

Token cost (estimate): approx. 5389 tokens, cl100k estimate (29 tools, measured 2026-11-11, version 0.3.0). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.

Permissions: 8 read, 21 write (state-changing), 0 unclassified · Auth: none · Rate limit: unknown · Pricing unit: unknown

Auth: none. Rate limit: unknown. Pricing unit: unknown.

  • assets_image_generate — write (state-changing)
  • assets_model_generate — write (state-changing)
  • core_action_approve — write (state-changing)
  • core_brief_write — write (state-changing)
  • core_evidence_browse — write (state-changing)
  • core_evidence_export — write (state-changing)
  • core_evidence_import — write (state-changing)
  • core_evidence_show — read
  • core_finding_record — write (state-changing)
  • core_handoff_write — write (state-changing)
  • core_hypothesis_record — write (state-changing)
  • core_hypothesis_update — write (state-changing)
  • core_investigation_show — read
  • core_journal_read — read
  • core_person_ask — write (state-changing)
  • core_plan_update — write (state-changing)
  • core_report_save — write (state-changing)
  • core_report_write — write (state-changing)
  • core_session_show — read
  • core_target_close — write (state-changing)
  • core_target_select — write (state-changing)
  • core_targets_list — read
  • core_unknown_add — write (state-changing)
  • core_unknown_edit — write (state-changing)
  • core_unknown_verify — read
  • core_unknowns_show — read
  • enable_toolset — write (state-changing)
  • list_toolsets — read
  • rebuild_check — write (state-changing)

handshake and tools listed without a recorded key or OAuth

Score 95/100 · Tools 29 · Token cost approx. 5,389 tokens · Compare · Last tested 2026-11-05 · Version tested 0.3.0 · Package storytold/craft-anything · Repo storytold/craft-anything

Summary: Craft Anything MCP completed an MCP handshake without credentials and exposed 29 tools.

Evidence summary

Handshake
pass
Tools listed
29
Context cost
approx. 5389 tokens, cl100k estimate (29 tools, measured 2026-11-11, version 0.3.0; an estimate) ranking · add up your servers' context cost
API key
No key needed for the tools we called
Tested
2026-11-05

Test results

TestResultPointsEvidence
installpass20download craft-anything-0.3.0-linux-x86_64.tar.gz from GitHub release v0.3.0 (storytold/craft-anything, published 2026-11-02), sha256 674ec59ffbdaefbd577917e07c9d464562043b275a3889ba4f60239a12f03d53 matched the release SHA256SUMS.txt, extract (prebuilt binary, Linux) succeeded in 2s.
handshakepass30MCP initialize + tools/list over stdio succeeded with no credentials; 29 tools listed in 0.0s.
maintenancepass25Repo pushed 0 days before test; 12,401 GitHub stars.
docspartial10README over 3,000 chars; install instructions present. Check of the package's own README (README.md from repo storytold/craft-anything main (raw.githubusercontent.com, 2026-11-05)).
licensepass10Apache-2.0 (OSI-approved).

Local-model readiness

Token cost (estimate): approx. 5389 tokens, cl100k estimate for 29 tools · about 66% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

Not tested

Small-model task runs: Not yet tested.

What we tested and what we didn't

Tested on 2026-11-05

  • Install from the registry
  • We connected with no credentials and asked for its tool list: it listed 29 tools (Method details: MCP initialize then tools/list)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)
  • Token cost (estimate)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

Known security issues

Checked on 2026-11-09 for version 0.3.0 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.

No published advisories found in OSV and GitHub advisories for github.com/storytold/craft-anything 0.3.0 as of 2026-11-09. This is not a security audit.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

Unchanged since the previous snapshot (latest 2026-11-11).

Snapshot hash (fingerprint of the tool list)

6edbd5b10ae4: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.

Feeds: RSS · JSON.

Raw test record (JSON)
{
  "name": "storytold/craft-anything",
  "version": "0.3.0",
  "registry": "github-release",
  "status": "working",
  "tested": "2026-11-05",
  "tools_count": 29,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`download craft-anything-0.3.0-linux-x86_64.tar.gz from GitHub release v0.3.0 (storytold/craft-anything, published 2026-11-02), sha256 674ec59ffbdaefbd577917e07c9d464562043b275a3889ba4f60239a12f03d53 matched the release SHA256SUMS.txt, extract` (prebuilt binary, Linux) succeeded in 2s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 29 tools listed in 0.0s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 12,401 GitHub stars."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Check of the package's own README (README.md from repo storytold/craft-anything main (raw.githubusercontent.com, 2026-11-05))."
    ],
    "license": [
      "pass",
      10,
      "Apache-2.0 (OSI-approved)."
    ]
  }
}

Install

craft-anything mcp

Tools listed

assets_image_generate, assets_model_generate, core_action_approve, core_brief_write, core_evidence_browse, core_evidence_export, core_evidence_import, core_evidence_show, core_finding_record, core_handoff_write, core_hypothesis_record, core_hypothesis_update, core_investigation_show, core_journal_read, core_person_ask, core_plan_update, core_report_save, core_report_write, core_session_show, core_target_close, core_target_select, core_targets_list, core_unknown_add, core_unknown_edit, core_unknown_verify, core_unknowns_show, enable_toolset, list_toolsets, rebuild_check

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "craft-anything-mcp": {
      "command": "craft-anything",
      "args": [
        "mcp"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

  1. Install. Run download craft-anything-0.3.0-linux-x86_64.tar.gz from GitHub release v0.3.0 (storytold/craft-anything, published 2026-11-02), sha256 674ec59ffbdaefbd577917e07c9d464562043b275a3889ba4f60239a12f03d53 matched the release SHA256SUMS.txt, extract (prebuilt binary). This is the exact command we ran on 2026-11-05.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools (29 in our test).
{
  "mcpServers": {
    "craft-anything-mcp": {
      "command": "craft-anything",
      "args": [
        "mcp"
      ]
    }
  }
}

Test history

Follow this server (RSS) · Monthly changelog

Related: Best dev MCP servers

FAQ

Is Craft Anything MCP deprecated?

No. storytold/craft-anything was not deprecated or archived when we last tested it on 2026-11-05.

What replaces Craft Anything MCP?

Nothing; Craft Anything MCP is not deprecated as of 2026-11-05.

Does Craft Anything MCP need an API key?

No. It completed an MCP handshake with no credentials and listed 29 tools.

Embed the badge

TestedMCP: 95/100, tested 2026-11-05

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue