Kitsune

GitHub Actions

Hot-reload for MCP servers: edit your tool, reload(), call it again in the same session. Plus mount any of 130,000+ community servers mid-session across 7 registries, caged in Docker. No client restar

Devops Developer Tools

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "kitsune-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add kitsune-mcp -- npx -y kitsune-mcp@0.22.4

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "kitsune-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.22.4
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Overview

About Kitsune

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Kitsune?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Kitsune need an API key?

No required environment variable is listed on this record.

What transport does Kitsune use?

Kitsune runs locally over stdio.

When was Kitsune last checked?

Last checked 2026-10-28. Hot-reload for MCP servers: edit your tool, reload(), call it again in the same session. Plus mount any of 130,000+ community servers mid-session across 7 registries, caged in Docker. No client restarts.

From the publisher

Documentation

Why

Your agent edits an MCP tool, but the client still runs the old process. Someone has to restart it before the agent can test the fix.

With Kitsune, connect, call and reload are tools. The agent runs the whole loop itself:

connect("uvx --from . my-mcp-server", name="dev")  # start your server
shapeshift("dev")  # its tools appear in the client
call("summarize", arguments={"url": "https://example.com"})

# … the agent (or you) edits the tool …

reload("dev")  # restart on fresh code, remount
call("summarize", arguments={"url": "https://example.com"})  # new code, same session

It also mounts any of 130,000+ servers from 7 registries mid-session, caged in Docker.

Try it: hot-reload tutorial · examples/demo-hot-reload/

Install

Claude Code

claude mcp add -s user kitsune -- uvx kitsune-mcp

Any other client (Claude Desktop, Cursor, Windsurf, Cline, Zed, …):

{
  "mcpServers": {
    "kitsune": { "command": "uvx", "args": ["kitsune-mcp"] }
  }
}

Also on PyPI (pip install kitsune-mcp, then "command": "kitsune-mcp") and npm (npx kitsune-mcp, delegates to uvx).

Requirements: Python 3.12+ · uv · node/npx for npm-based servers · Docker optional, used to cage community servers.

Three things it does

	Loop	What you get
MCP REPL	`connect` → `shapeshift` → edit → `reload` → `call`	Iterate on your own server without restarting the client
Long-tail reach	`search` → `shapeshift` → `call` → `shapeshift()`	Use a server once without adding it to your config forever
Try before you trust	`confirm=True` + Docker cage + version pins	Run community npm/PyPI code contained, not as your user

Borrow a server you never configured

search("web scraping")
shapeshift("firecrawl", tools=["scrape_url"])  # mount one tool, not the whole server
call("scrape_url", arguments={"url": "https://example.com"})
shapeshift()  # drop it, session stays up

Try a community package, caged

search("pdf", registry="glama")
shapeshift("mcp-pdf-tools", confirm=True)  # npm/PyPI run in hardened Docker when available
call("extract_text", arguments={"path": "report.pdf"})
shapeshift()

Add credentials mid-session

auth("BRAVE_API_KEY", "sk-...")  # saved to ~/.kitsune/.env, no restart
shapeshift("brave", tools=["brave_web_search"])

Full live walkthrough: docs/demo-realtime.md.

When to use it, when not to

Use Kitsune when…	Skip it when…
You're building an MCP server and want an edit/reload loop	You only use 1–3 trusted servers (configure them natively)
A task needs a server that isn't in your config	Every turn hits the same server (keep it always-on)
You want to evaluate community MCP code without installing it for good	You want lower token use: the base cost is ~1,774 tokens/turn, and modern clients already defer tool schemas
Your MCP config is crowded (GATEWAY)	You need a sub-second first call (cold mount takes ~1–15 s)

How it works

shapeshift(server_id) picks a transport (stdio, HTTP+SSE, WebSocket, Docker), connects, reads tools/list, and registers each tool as a native tool with the server's real schema. The client receives notifications/tools/list_changed and sees first-class tools, with no wrapper in between. shapeshift() with no argument removes them and closes the connection.

search() covers the official servers repo, the MCP Registry, Glama, npm, PyPI, GitHub (github:owner/repo) and Smithery (hosted servers, free API key).

Tools

Default profile: 9 tools, ~1,774 tokens/turn (measured with python examples/benchmark.py).

Tool	Role
`connect(command, name)`	Start a persistent local server, e.g. the one you're developing
`reload(name)`	Release, restart on fresh code, remount, in one call
`release(name)`	Stop a persistent server
`search(query, registry?)`	Search 7 registries
`shapeshift(server_id?, tools=[…])`	Mount a server's tools (all or a subset); no argument drops them
`call(tool_name, arguments)`	Call a tool; the server is inferred when mounted
`auth(var_or_server, value?)`	Set an env key or run an OAuth 2.1 browser flow
`auto(task, server_hint=)`	Search, mount and call in one step
`status()`	Current form, connection pool, session stats

KITSUNE_TOOLS=all (or the kitsune-forge command) adds developer tools: inspect (schemas, credential check, token cost), test (quality score 0–100), bench (p50/p95 latency), compare, prewarm, craft, setup, and more. See docs/tools.md. Companion skills for Claude Code: kitsune-dev, kitsune-improve.

Safety, in short

Community sources need consent. npm, PyPI and GitHub servers require confirm=True. The model can set that flag itself, so real approval belongs in your client's tool-approval UI.
connect() runs the command it is given, as your user, with no consent gate and no cage. It is meant for your own code. Approve connect calls in your client before the agent runs them.
Community packages run in a Docker cage by default when Docker is installed: no host filesystem, --cap-drop ALL, read-only root, memory and PID limits. Credentials are passed by name, never in argv.
Version pins (TOFU). A later malicious publish doesn't silently replace a version you already ran.
Opt-in action guard. A ~/.kitsune/policy.json checks every downstream call against allow/ask/deny rules, path roots and a host allowlist. ask goes to you through MCP elicitation.
Install commands are validated and launched without a shell. fetch() blocks private hosts and re-checks every redirect.

Don't run it unattended with production admin, billing or security credentials. The full model, including what it does not protect against: docs/safety.md.

Configuration: env and .env lookup, tool profiles, sandbox and trust settings, Smithery, GATEWAY, mount patterns
Performance: cold/warm latency and token cost compared with always-on servers
Transports · Compatibility · Agent patterns · Worked scenarios

Why "Kitsune"?

In Japanese folklore the kitsune (狐) is known for what it can become: it borrows a form, uses that power, casts it off and returns to itself. That is the product loop.

I am not Japanese, and I use this name with the highest respect for the mythology and culture it comes from. The parallel felt too precise to ignore.

Contributing

make dev     # install with dev dependencies
make test    # pytest
make lint    # ruff

Issues and PRs welcome: github.com/kaiser-data/kitsune-mcp · CHANGELOG.md

MIT License · Python 3.12+ · Built on FastMCP

Kitsune

GitHub Actions

Devops Developer Tools

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "kitsune-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add kitsune-mcp -- npx -y kitsune-mcp@0.22.4

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "kitsune-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.22.4
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Overview

About Kitsune

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Kitsune?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Kitsune need an API key?

No required environment variable is listed on this record.

What transport does Kitsune use?

Kitsune runs locally over stdio.

When was Kitsune last checked?

From the publisher

Documentation

Why

Your agent edits an MCP tool, but the client still runs the old process. Someone has to restart it before the agent can test the fix.

With Kitsune, connect, call and reload are tools. The agent runs the whole loop itself:

connect("uvx --from . my-mcp-server", name="dev")  # start your server
shapeshift("dev")  # its tools appear in the client
call("summarize", arguments={"url": "https://example.com"})

# … the agent (or you) edits the tool …

reload("dev")  # restart on fresh code, remount
call("summarize", arguments={"url": "https://example.com"})  # new code, same session

It also mounts any of 130,000+ servers from 7 registries mid-session, caged in Docker.

Try it: hot-reload tutorial · examples/demo-hot-reload/

Install

Claude Code

claude mcp add -s user kitsune -- uvx kitsune-mcp

Any other client (Claude Desktop, Cursor, Windsurf, Cline, Zed, …):

{
  "mcpServers": {
    "kitsune": { "command": "uvx", "args": ["kitsune-mcp"] }
  }
}

Also on PyPI (pip install kitsune-mcp, then "command": "kitsune-mcp") and npm (npx kitsune-mcp, delegates to uvx).

Requirements: Python 3.12+ · uv · node/npx for npm-based servers · Docker optional, used to cage community servers.

Three things it does

	Loop	What you get
MCP REPL	`connect` → `shapeshift` → edit → `reload` → `call`	Iterate on your own server without restarting the client
Long-tail reach	`search` → `shapeshift` → `call` → `shapeshift()`	Use a server once without adding it to your config forever
Try before you trust	`confirm=True` + Docker cage + version pins	Run community npm/PyPI code contained, not as your user

Borrow a server you never configured

search("web scraping")
shapeshift("firecrawl", tools=["scrape_url"])  # mount one tool, not the whole server
call("scrape_url", arguments={"url": "https://example.com"})
shapeshift()  # drop it, session stays up

Try a community package, caged

search("pdf", registry="glama")
shapeshift("mcp-pdf-tools", confirm=True)  # npm/PyPI run in hardened Docker when available
call("extract_text", arguments={"path": "report.pdf"})
shapeshift()

Add credentials mid-session

auth("BRAVE_API_KEY", "sk-...")  # saved to ~/.kitsune/.env, no restart
shapeshift("brave", tools=["brave_web_search"])

Full live walkthrough: docs/demo-realtime.md.

When to use it, when not to

Use Kitsune when…	Skip it when…
You're building an MCP server and want an edit/reload loop	You only use 1–3 trusted servers (configure them natively)
A task needs a server that isn't in your config	Every turn hits the same server (keep it always-on)
You want to evaluate community MCP code without installing it for good	You want lower token use: the base cost is ~1,774 tokens/turn, and modern clients already defer tool schemas
Your MCP config is crowded (GATEWAY)	You need a sub-second first call (cold mount takes ~1–15 s)

How it works

search() covers the official servers repo, the MCP Registry, Glama, npm, PyPI, GitHub (github:owner/repo) and Smithery (hosted servers, free API key).

Tools

Default profile: 9 tools, ~1,774 tokens/turn (measured with python examples/benchmark.py).

Tool	Role
`connect(command, name)`	Start a persistent local server, e.g. the one you're developing
`reload(name)`	Release, restart on fresh code, remount, in one call
`release(name)`	Stop a persistent server
`search(query, registry?)`	Search 7 registries
`shapeshift(server_id?, tools=[…])`	Mount a server's tools (all or a subset); no argument drops them
`call(tool_name, arguments)`	Call a tool; the server is inferred when mounted
`auth(var_or_server, value?)`	Set an env key or run an OAuth 2.1 browser flow
`auto(task, server_hint=)`	Search, mount and call in one step
`status()`	Current form, connection pool, session stats

Safety, in short

Community sources need consent. npm, PyPI and GitHub servers require confirm=True. The model can set that flag itself, so real approval belongs in your client's tool-approval UI.
connect() runs the command it is given, as your user, with no consent gate and no cage. It is meant for your own code. Approve connect calls in your client before the agent runs them.
Community packages run in a Docker cage by default when Docker is installed: no host filesystem, --cap-drop ALL, read-only root, memory and PID limits. Credentials are passed by name, never in argv.
Version pins (TOFU). A later malicious publish doesn't silently replace a version you already ran.
Opt-in action guard. A ~/.kitsune/policy.json checks every downstream call against allow/ask/deny rules, path roots and a host allowlist. ask goes to you through MCP elicitation.
Install commands are validated and launched without a shell. fetch() blocks private hosts and re-checks every redirect.

Don't run it unattended with production admin, billing or security credentials. The full model, including what it does not protect against: docs/safety.md.

Configuration: env and .env lookup, tool profiles, sandbox and trust settings, Smithery, GATEWAY, mount patterns
Performance: cold/warm latency and token cost compared with always-on servers
Transports · Compatibility · Agent patterns · Worked scenarios

Why "Kitsune"?

In Japanese folklore the kitsune (狐) is known for what it can become: it borrows a form, uses that power, casts it off and returns to itself. That is the product loop.

I am not Japanese, and I use this name with the highest respect for the mythology and culture it comes from. The parallel felt too precise to ignore.

Contributing

make dev     # install with dev dependencies
make test    # pytest
make lint    # ruff

Issues and PRs welcome: github.com/kaiser-data/kitsune-mcp · CHANGELOG.md

MIT License · Python 3.12+ · Built on FastMCP

Add this server

Host a copy with our keys and logs.

Server facts

About Kitsune

Tools

Questions

How do I install Kitsune?

Does Kitsune need an API key?

What transport does Kitsune use?

When was Kitsune last checked?

Documentation

Why

Install

Three things it does

Borrow a server you never configured

Try a community package, caged

Add credentials mid-session

When to use it, when not to

How it works

Tools

Safety, in short

More

Why "Kitsune"?

Contributing

Add this server

Host a copy with our keys and logs.

Server facts

About Kitsune

Tools

Questions

How do I install Kitsune?

Does Kitsune need an API key?

What transport does Kitsune use?

When was Kitsune last checked?

Documentation

Why

Install

Three things it does

Borrow a server you never configured

Try a community package, caged

Add credentials mid-session

When to use it, when not to

How it works

Tools

Safety, in short

More

Why "Kitsune"?

Contributing