validate

A command that checks code against applicable MCP standards, which are rules for building MCP-based software, and reports compliance issues.

In plain words
What is it for?
Validate selected files or projects, choose standards and severity levels, ignore matching paths, export results as text, JSON, JUnit, or SARIF, and preview or apply automatic fixes.
Why use it?
It helps find standards violations and possible fixes before they cause review or integration problems.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/williamzujkowski/mcp-standards-server/validate
Clone the repo
git clone --depth 1 https://github.com/williamzujkowski/mcp-standards-server
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,612 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02612
Opus 5 $0.00000 $0.01306
Sonnet 5 $0.00000 $0.00522
Haiku 4.5 $0.00000 $0.00261

Measured 2d ago against content hash a6c0a59b8b20, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

validate scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

const response = await fetch(url);
docs/cli/commands/validate.md · 488 lines

How it starts

The opening of the file, as written. The whole thing — 488 lines — stays where its author put it; the contents beside it link to each section on GitHub.

validate Command

Validate code against MCP standards.

Synopsis

mcp-standards validate [options] [path...]

Description

The validate command checks your code against applicable standards, providing detailed feedback on compliance issues, suggestions for improvement, and automated fixes where possible.

Options

--standards <file>

Use specific standards file or query result.

mcp-standards validate --standards standards.json

--auto-detect

Automatically detect applicable standards (default).

mcp-standards validate --auto-detect

--fix

Automatically fix issues where possible.

mcp-standards validate --fix

--dry-run

Show what would be fixed without making changes.

mcp-standards validate --fix --dry-run

--format <format>

Output format (text, json, junit, sarif).

mcp-standards validate --format junit

--severity <level>

Minimum severity level to report (error, warning, info).

mcp-standards validate --severity warning

--ignore <pattern>

Ignore files matching pattern.

mcp-standards validate --ignore "*.test.js" --ignore "dist/*"

--config <file>

Use custom validation configuration.

mcp-standards validate --config .mcp-validate.yaml

--parallel <n>

Number of parallel validation workers.

mcp-standards validate --parallel 4

--fail-on <level>

Exit with error code if issues found at level.

mcp-standards validate --fail-on error

Examples

Basic Validation

mcp-standards validate src/

Output:

Detecting project context...
Project Type: web-application
Frameworks: react, tailwind
Languages: javascript, typescript

Loading applicable standards...
✓ React 18 Patterns
✓ TypeScript Best Practices
✓ Web Accessibility Standards
✓ JavaScript ES2025 Standards

Validating files...
[████████████████████] 100% | 45/45 files

Results:
========

src/components/Button.tsx
  Line 15: ERROR - Missing accessible label
    Standard: wcag-2.2-accessibility
    Rule: interactive-elements-labels
    
    <button onClick={handleClick}>
      {icon}
    </button>
    
    Fix: Add aria-label or visible text content
    
  Line 23: WARNING - Using deprecated pattern
    Standard: react-18-patterns
    Rule: no-default-props
    
    Button.defaultProps = { size: 'medium' }
    
    Fix: Use default parameters in function signature

src/api/client.js
  Line 8: WARNING - Missing error boundary
    Standard: javascript-error-handling
    Rule: async-error-handling
    
    async function fetchData(url) {
      const response = await fetch(url);
      return response.json();
    }
    
    Fix: Add try-catch block or .catch() handler

src/styles/global.css
  Line 145: INFO - Consider using CSS custom properties
    Standard: modern-css-architecture
    Rule: prefer-custom-properties
    
    .theme-dark { background: #000; color: #fff; }
    
    Suggestion: Use CSS variables for theme values

Summary:
  Files scanned: 45
  Issues found: 12
    Errors: 3
    Warnings: 7
    Info: 2
  
  Standards applied: 4
  Time: 2.34s

Exit code: 1 (errors found)

Read the full file on GitHub · 488 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 488 lines · 0 tokens per session scan A a6c0a59b8b20

Subscribe to this mod's changes

validate is a command published in the GitHub repository williamzujkowski/mcp-standards-server (3 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,612 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.