Mcpick — Security skill for Claude Code

MCPick

[](https://viteplus.dev) [](https://vitest.dev)

Vendor-neutral MCP configuration manager with first-class Claude Code support.

MCPick helps humans and LLM agents inspect, toggle, and back up MCP server configuration across multiple AI clients. Claude Code-specific plugins, hooks, marketplaces, and cache commands remain available, but they are no longer the core product model.

Install

npm install -g mcpick
# or run without installing
npx mcpick --help

Requirements:

• Node.js 22+
• Claude Code is required only for Claude Code-specific commands
• The GitHub CLI (gh, authenticated) is required for portable skills commands; check-skills validates skills before install when available

Agent-first CLI

In non-TTY environments, MCPick shows help instead of launching the interactive TUI. This makes it safer for prompts like:

“Use mcpick to work out how to enable this MCP server.”

Start with:

npx mcpick --help
npx mcpick clients
npx mcpick list --json

MCPick redacts known secret patterns before printing output. MCP configs often contain env vars and authorization headers, so `env` and `headers` values are shown as `***` in JSON output.

MCP server mode

`npx mcpick serve` runs MCPick itself as an MCP server over stdio, so agents can manage MCP configuration through tool calls instead of shelling out to the CLI. Tools:

• Read: mcpick_list, mcpick_clients, mcpick_get, mcpick_doctor
• Mutate: mcpick_enable, mcpick_disable, mcpick_remove, mcpick_add, mcpick_add_json

Read-only/destructive annotations are set so clients can make safe decisions; secret warnings and `from_env` resolution behave the same as the CLI. Client config example:

{
	"mcp