What do I need to use Read-only MCP Wrapper?

The folder; File types; The client; Runtime; Anything inside the folder that must never be served.

Is Read-only MCP Wrapper free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

Read-only MCP Wrapper

Q: How do I know the Read-only MCP Wrapper output is good?

The skill verifies itself against its own quality checks: Exactly three tools are exposed, each with `readOnlyHint: true`; The server contains no write, delete, rename, network or child-process calls; Nothing but protocol messages is written to stdout; Traversal with `..` and symlinks pointing outside the folder are both refused.

🔵 Stable🕐 updated 2026-10-04 ✅ 3.5/5 🔷 SkillSpec L3 pm-oss-launch

Use when asked to expose a folder of notes or docs to Claude or another AI client, build an MCP server over Markdown or JSON files, let an agent read my knowledge base safely, or wrap documentation as MCP tools. Produces a read-only MCP server over a folder of Markdown or JSON files: server code using stdio transport, tool definitions, a client configuration snippet, and a safety section confirming no write, delete or network tools are exposed. To design an MCP server for a whole product, use mcp-server-spec.

▶ Run it free — no key needed 📝 Grade your existing draft 📱 Use as an app View SKILL.md ↗ What changed

🗣 Say this to your agent

“Make an MCP server so Claude can read my Obsidian notes, read-only.”“Expose this docs folder to Cursor as MCP tools.”“Build a safe MCP server over a folder of JSON files.”“I want my agent to search our specs but never change them.”

What to give it

▸The folder — to serve, and roughly how many files and how large

▸File types — Markdown, JSON, or both (other types are excluded by default)

▸The client — Claude Code, Claude Desktop, Cursor, or another MCP client

▸Runtime — Node is the default; ask if the user needs Python instead

▸Anything inside the folder that must never be served — (drafts, private notes), to exclude by path

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Exactly three tools are exposed, each with `readOnlyHint: true`

✓The server contains no write, delete, rename, network or child-process calls

✓Nothing but protocol messages is written to stdout

✓Traversal with `..` and symlinks pointing outside the folder are both refused

✓Only allow-listed extensions under the size cap are served

✓Error messages never reveal the absolute path of the served folder

✓The client snippet uses absolute paths and the exact command for the named client

✓The test script covers every refusal case listed above

⚠️ What it refuses to do

**"Just one write tool."** The moment an agent can write, the safety story changes; build a separate server for that.

**`console.log` for debugging.** It corrupts the stdio protocol; log to stderr.

**Checking paths with string prefixes only.** `startsWith(root)` without `realpath` lets symlinks escape.

**Serving everything in the folder.** Allow-list file types; keys and `.env` files live in the same trees as docs.

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y -p pm-claude-skills pm-claude-skills-mcp

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="readonly-mcp-wrapper"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

Read-only MCP Wrapper is one of 1307 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog