litewrite-mcp-server
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
KevinKwank
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
litewrite_list_projectsList projects available in the Litewrite platform for a given owner (POST /api/internal/projects/list). Use this to discover a projectId before pulling or reading files. Args: - ownerId (string, optional): defaults to the LITEWRITE_OWNER_ID env var, or "default". - search (string, optional): n…
litewrite_list_filesList the files and directories in a Litewrite project (POST /api/internal/files/list). Args: - projectId (string, required): The project id (from litewrite_list_projects). - directory (string, optional): Subdirectory to list from the project root, e.g. "chapters". - recursive (boolean, option…
litewrite_read_fileRead the content of a file directly from the Litewrite server (POST /api/internal/files/read). Prefers the server copy over the local mirror; use litewrite_local_read to read the local working copy instead. Args: - projectId (string, required): The project id. - filePath (string, required): Pa…
litewrite_write_fileReplace the full content of an existing file on the Litewrite server (POST /api/internal/files/edit). For creating a brand-new file use litewrite_create_file; for binary files use litewrite_upload_file. Args: - projectId (string, required): The project id. - filePath (string, required): Path r…
litewrite_create_fileCreate a new text file (or directory) in a Litewrite project (POST /api/internal/files/create). Args: - projectId (string, required): The project id. - name (string, required): Name of the new file or folder, e.g. "notes.md". - type (string, required): "file" or "directory". - parentPath (s…
litewrite_upload_fileUpload a file to Litewrite, creating or overwriting it (POST /api/internal/files/upload). Use for binary assets (images, PDFs) where edit/create are unsuitable, or as an alternative to create. Args (provide exactly one source): - projectId (string, required): The project id. - filePath (string…
litewrite_delete_fileDelete a file (or directory) from a Litewrite project (POST /api/internal/files/delete). This is irreversible.
litewrite_rename_fileRename or move a file/folder in a Litewrite project (POST /api/internal/files/rename). Args: - projectId (string, required): The project id. - sourcePath (string, required): Current relative path. - newName (string, optional): New name (keeps the same parent). - targetPath (string, optional…
litewrite_pullMirror a Litewrite project down into a local directory (git-clone/pull style). Downloads all text files from the server into the local working copy at ~/.litewrite-mcp/<projectId> (or LITEWRITE_LOCAL_DIR), removes local files that no longer exist on the server, and records a content manifest so a l…
litewrite_pushUpload local working-copy changes back to Litewrite (git-push style). Compares the local mirror (~/.litewrite-mcp/<projectId>) against the last manifest: new/changed text files are uploaded, removed local files are deleted on the server, and the manifest is refreshed. Use litewrite_status first to…
litewrite_statusCompare the local mirror of a project with Litewrite without changing anything (git-status style). Reports which local files are added/modified/removed versus the last pull/push, and which files exist only on the remote. Use it before deciding whether to push local changes or pull remote ones. Arg…
litewrite_local_listList the files in the local mirror of a project (no network call). This is the local working copy at ~/.litewrite-mcp/<projectId> used by litewrite_pull/push/status. Args: - projectId (string, required): The project id. Returns relative file paths present on disk.
litewrite_local_readRead a file from the local mirror of a project (no network call). Unlike litewrite_read_file, this reads the on-disk local copy at ~/.litewrite-mcp/<projectId>. Args: - projectId (string, required): The project id. - filePath (string, required): Relative path in the local copy. Returns the ra…
litewrite_local_writeWrite or overwrite a file in the local mirror of a project (no network call). Changes are NOT uploaded to Litewrite until you run litewrite_push. Args: - projectId (string, required): The project id. - filePath (string, required): Relative path in the local copy. - content (string, required)…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 15 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/kevinkwank/litewrite-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check