crosspad-mcp-server (CrossPad/crosspad-mcp) is an MCP server listed on the M8ven Trust Index. It scores 89 out of 100, grade B. It declares 48 tools. The publisher has proved control of what we score (Verified Publisher). It is connected through the M8ven GitHub App, so the listing is re-checked on every push.

B
Emerging
89/100

crosspad-mcp-server

MCP server that gives Claude Code full control over the CrossPad development workflow — build, test, manage app packages, interact with the simulator, search code across repos — all from natural language.

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code VerifiedSandbox Verified⚡ Live Monitored

every push re-verified

Who stands behind it

gmail.com (@CrossPad) · Verified Publisher

Source: Glama

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
48 tools verified — handlers match their declared behaviour
14 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
Are you the publisher? Confirm or correct these findings.
// tools this server exposes48 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

crosspad_build
crosspad_run

[PC] Launch the built simulator binary in the background. Returns pid + exe_path. Refuses to spawn a duplicate if one is already responding on the TCP control port (use force=true to override). Fails if binary not built — call crosspad_build first. Currently PC-only (IDF firmware doesn't run on the

crosspad_kill

[PC sim] Stop the running PC simulator. Identifies the process by /proc/<pid>/exe match against the built binary (Linux) or pgrep -x basename (macOS/Windows), sends SIGTERM, waits up to 3s, then SIGKILL stragglers. Returns killed PIDs and whether anything still answers on the TCP control port. Curre

crosspad_check

[PC] Health check for a build — detects stale exe, new sources missing from build system, dirty submodules. Use before crosspad_build to decide if rebuild needed. Currently PC-only.

crosspad_log
crosspad_devices

[ESP HW] List all connected USB serial devices. Identifies CrossPad devices separately and tags each with `kind`: 'esp-native' (rev <2.0, ESP32-S3 native USB, VID 0x303a/PID 0x3456) or 'stm-bridge' (rev 2.0, STM32 composite CDC+MIDI bridge, VID 0x0483/PID 0x5740 — STM programs the ESP over LPUART2).

crosspad_trace
crosspad_test_run

[PC] Build and run the Catch2 test suite for crosspad-pc. PREFER THIS over invoking the test binary directly — configures cmake with BUILD_TESTING=ON, parses Catch2 output into passed/failed counts and errors, supports filter and list_only. Pass `labels` to run the GUI harness instead: those cases l

crosspad_screenshot
crosspad_input
crosspad_stats

[PC sim] Read runtime statistics from the running PC simulator: pad state, capabilities, heap, registered apps, active pad logic.

crosspad_settings_get

[PC sim] Read settings from the running simulator.

crosspad_settings_set

[PC sim] Write a single setting on the running simulator.

crosspad_repo_status

Git status across ALL detected CrossPad repos in one call: branch, HEAD, dirty files, submodule sync state. PREFER THIS over running `git status` per repo — handles the 5-repo monorepo layout in one shot.

crosspad_repo_diff

Show submodule drift in a parent repo (crosspad-pc or platform-idf): commits ahead/behind pinned, changed files, uncommitted work. Use to inspect dev-mode work before pinning.

crosspad_submodule_update

Update a submodule in a parent repo to the latest commit on a tracking branch (git fetch + checkout origin/<branch> + stage). Destructive: discards local commits in the submodule that aren't on the remote branch.

crosspad_commit

Commit staged changes in a specific CrossPad repo. PREFER THIS over raw `git commit` — handles repo aliases (idf/pc/arduino/core/gui), refuses on merge conflicts, uses 0600 tempfiles for messages (no shell-quoting issues with quotes/newlines/backticks), and never pushes. Stages files[] first if supp

crosspad_search_symbols

Search for symbol DEFINITIONS (classes, functions, macros, enums, typedefs) across CrossPad repos via git grep. PREFER THIS over raw `grep -r` or `git grep` — it filters to definitions only (skips call sites/declarations), classifies kind, and aggregates across all repos automatically. Substring mat

crosspad_list_interfaces

List all crosspad-core interfaces (I*-prefixed classes in crosspad-core/include/crosspad/).

crosspad_interface_implementations

Find all classes implementing a given interface across CrossPad repos. Returns className, file path, platform. Use crosspad_list_interfaces first if you don't know exact names.

crosspad_capabilities

List platform capability flags (Capability enum) and which capabilities each platform sets.

crosspad_list_apps_source

List apps registered via REGISTER_APP() macro by scanning source files. Different from crosspad_apps_list (which reads the package registry).

crosspad_apps_list

List apps from the crosspad-apps registry, aggregating installation status across all detected platform repos. Reads JSON; no Python required. Different from crosspad_list_apps_source (which scans REGISTER_APP() in source code).

crosspad_apps_install

Install an app from the crosspad-apps registry as a git submodule. Requires gh CLI authenticated. Delegates to <repo>/{tools|scripts}/app_manager.py.

crosspad_apps_remove

Remove an installed app submodule from a platform repo. Delegates to app_manager.py.

crosspad_apps_update
crosspad_apps_sync

Sync a platform's apps.json manifest with existing submodules (rebuild manifest from disk state).

crosspad_apps
crosspad_architecture

The crosspad-core abstraction layer, three ways. action=interfaces lists the I*-prefixed interfaces in crosspad-core/include/crosspad/. action=implementations finds every class implementing one, across all repos, with the platform it belongs to (run action=interfaces first if you do not know the exa

crosspad_audio_route
crosspad_capture

[ESP HW] Record what the CrossPad is playing, through its own UAC2 endpoint — one cable, no external interface. start returns a cap_N handle and records in the background so you can drive the pads meanwhile; stop returns the WAV as a link with peak/rms dBFS, overruns and whether the take was silent.

crosspad_analyze

Offline analysis of a WAV — touches no hardware. onset: did the hits land, and when (pass the times you played as `expected`)? click: are there glitches in the render? silence: is this path dead? multitone: does the loopback reproduce the tones? velocity: does loudness track velocity monotonically?

crosspad_cdc

[ESP HW] Typed CDC control verbs (main/hil_control.cpp) through the crosspad-hil daemon. verb=app {list|start name|stop|destroy|self_close|versions}, kit {list|status|load kit_id}, pad {press idx vel|release idx|pressure idx val|stats [reset]|notes|info idx}, enc {rotate delta|press [ms]|group|focus

crosspad_console

[ESP HW] STM32-bridge console (boot log, panics, PerfMon) through the crosspad-hil daemon. open → con_N handle (DTR/RTS deasserted so opening never reboots the board; reset=true pulses reset explicitly); read {since_seq, wait_ms, match, limit} → {lines: [[seq, line]], next_seq, lines_lost}; expect {

crosspad_docs_search

Search the ecosystem's prose (crosspad-docs, the BSP guides, the bundled skill pages) and return the matching sections rather than whole pages. Use it for 'how does X work' and 'why does the board do Y' questions — the hardware traps, the app lifecycle, the audio routing and the HIL workflow are wri

crosspad_doctor

Environment doctor. Host checks: hil_python interpreter, crosspad-hil version vs the one this server needs, platform-idf root, ESP-IDF env, crosspad-pc root, per-rev build dirs and firmware age, simulator binary staleness. Daemon checks merged in: udev/dialout, port locks (holder PID + purpose), rtm

crosspad_flash
crosspad_hil_run
crosspad_midi
crosspad_snapshot

[ESP HW | PC sim] One-call state snapshot (~300 tokens): apps {running, available}, ui {focus {ref,label}, group [{ref,label}], drawer, theme, app}, kit, leds, pads, mem, ble, console counters. Refs `e<i>` are ENC_GROUP indices for crosspad_ui focus — any UI action invalidates them and the next snap

crosspad_stimulus

[ESP HW] Drive the pads: a rate across a pad set, or a pattern with real timings ({t_ms, pad, vel, gate_ms}) — use the pattern to play something. Runs in the background behind a stim_N handle so you can record or read state meanwhile. status reports what was sent, the PAD_STATS delta the device actu

crosspad_ble

[ESP HW] Use this machine's Bluetooth radio to talk to the CrossPad's BLE MIDI: scan, connect, send notes into it, listen to what it sends out, and measure the round-trip. It matches the board by the address the board itself reports and refuses to guess between look-alikes. Needs the `ble` extra ins

crosspad_diagnose_crash

[ESP HW] One call, the whole evidence set for a panic: reset reason, the panic registers, the backtrace decoded to source lines against the ELF of the build that is actually flashed, the heap after the restart, and the surrounding console lines as a link. Point it at a log file, at an open console h

crosspad_symbol

Compiler-backed symbol intelligence via clangd over the project's compile_commands.json. Answers what a grep cannot: `references` (who actually calls this), `implementations` (what overrides this virtual), `hover` (resolved type plus the doc comment), `call_hierarchy` (incoming callers), `definition

crosspad_task

Poll, wait on, cancel or list long-running crosspad tasks (build, flash, hil_run, capture, stimulus, submodule_update). Task handles are task_<n>; results are kept 1 h after completion. Use this when your client does not support the MCP tasks capability.

crosspad_toolsets
crosspad_ui

[ESP HW] Drive the device UI by snapshot refs. focus ref=e<i> moves the encoder focus to that group entry (ENC_GROUP + ENC_FOCUS → ENC_ROTATE by the delta); press = encoder click; rotate delta; back = the app's own Back (APP_SELF_CLOSE); start_app name; stop_app (APP_STOP, rebuilds the launcher). Ev

crosspad_usb_mode
// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowvitest@4.1.3GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCROSSPAD_ARDUINO_ROOT
configCROSSPAD_CORE_ROOT
configCROSSPAD_GIT_DIR
configCROSSPAD_GUI_ROOT
configCROSSPAD_HIL_PYTHON
configCROSSPAD_IDF_ROOT
configCROSSPAD_PC_ROOT
configCROSSPAD_PROBE_SERIAL
configCROSSPAD_REMOTE_HOST
configCROSSPAD_REMOTE_PORT
configCROSSPAD_STM_ROOT
configCROSSPAD_TRACE_OPEN_FALLBACK_MS
configCROSSPAD_TRACE_UI_OPEN
configIDF_PATH
configVCPKG_ROOT
configVCVARSALL
configXDG_CONFIG_HOME
// quality suggestions

openWorldHint matches behaviour

1 tool claims openWorldHint=false but make outbound HTTP — crosspad_symbol → textDocument/definition (line 293)

Either flip openWorldHint to true (acknowledging external reach) or refactor the handler to avoid outbound HTTP. If the only network calls are to a known fixed endpoint that you consider part of the tool itself, document that and keep openWorldHint=false; otherwise true is honest.

Tool test coverage

38/48 tools referenced in tests (79%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

9 calls in production code run through a shell (src/utils/device.ts:73, src/utils/device.ts:192, src/utils/device.ts:276)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/crosspad/crosspad-mcp)](https://m8ven.ai/mcp/crosspad/crosspad-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 202d3bc36541fa5d723bda86fe48cbb5865c0a58
code hash: d3f145d63cafcef82e9a3358ff41ebaae17ac29b397f6e425e43e72277aff053
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client