MCP server

A local, stdio MCP server that exposes the same read-only /api/v1/* queries as the CLI, as MCP tools an agent can call directly. It runs on your own machine, the same way the CLI does. It is not a hosted service, and there is no remote Wirecheck MCP endpoint. It never scans, infers relationships, or computes impact itself; every answer comes from the same server the web UI and CLI already use.

Install and authenticate

Not yet published to the npm registry; install from the repository, the same as the CLI. If you've already run wirecheck auth login, the MCP server reuses that same saved token at ~/.wirecheck/config.json, with no separate sign-in step. Otherwise, set WIRECHECK_TOKEN in the MCP client's own server configuration (generate a token from Settings > CLI access tokens).

install

git clone https://github.com/kev-er/wirecheck.git
cd wirecheck && npm install

Configure your MCP client

Add a stdio server entry pointing at mcp/wirecheck-mcp.mjs in the cloned repository. For Claude Code, this goes in .mcp.json (project-scoped) or via claude mcp add; for Claude Desktop, in its claude_desktop_config.json. Both read the same shape:

.mcp.json

{
  "mcpServers": {
    "wirecheck": {
      "command": "node",
      "args": ["/absolute/path/to/wirecheck/mcp/wirecheck-mcp.mjs"],
      "env": {
        "WIRECHECK_TOKEN": "wc_..."
      }
    }
  }
}

Omit the env.WIRECHECK_TOKEN entry if you've already authenticated via wirecheck auth login, and the server falls back to the saved config file. Restart the client after editing this file so it picks up the new server.

Tools

Tool	Answers
wirecheck_status	Organization, signed-in user, and connected repositories
wirecheck_preflight	What depends on this, right now, before I touch it?
wirecheck_context	One bundle: identity, owner, lifecycle, impact, evidence, retirement status
wirecheck_evidence	Why does Wirecheck believe this exists?
wirecheck_impact	Known/unknown consumers of a dependency for a given operation
wirecheck_compare	What changed between two scans?
wirecheck_verify_retirement	After a rescan, does anything still reference this?
wirecheck_retirement_candidates	Which components have no known consumers across scans?
wirecheck_retirement_inspect	Status and evidence for one retirement candidate
wirecheck_timeline	Real, timestamped history for a component
wirecheck_baseline	Get, set, or clear a repository's saved baseline scan
wirecheck_drift	What changed since the baseline was set?
wirecheck_simulate	What would happen if I made this change? (never persists)
wirecheck_change_plan	Create, view, or transition a tracked Change Plan

Most tools are read-only. wirecheck_verify_retirement only writes when called with record: true (same --record behavior as the CLI). wirecheck_baseline writes for its set/clear actions. wirecheck_change_plan writes for its create/transition actions. Each tool's own description says which. See the CLI reference for the full field shapes each tool returns.

Design notes

Local and stdio only. There is no hosted or remote Wirecheck MCP server; this process runs on your machine and makes the same HTTPS calls to wirecheck.dev (or WIRECHECK_API_URL) that the CLI does.
If a query fails or returns no answer, the tool call fails with that error. It never synthesizes a plausible-looking result.
Shares config and auth with the CLI (same ~/.wirecheck/config.json, same WIRECHECK_TOKEN); there is no separate MCP-specific auth mechanism.

Limits

The underlying v1 API caps each organization's token to 90 requests per minute across every tool here (a separate guardrail from the daily scan-creation limit). A tool call that hits it comes back as a normal tool error with a wait time, not a crash.

See using Wirecheck with Claude Code for the CLAUDE.md-based workflow this complements.