Local Phylax MCP

The local server runs as a child process of your editor or desktop client and talks to it over stdio. Nothing listens on a port, so no other process on the machine can reach it.

Why stdio and not a local HTTP port

The MCP specification recommends stdio for local servers precisely because it limits access to the one client that spawned the process. A server on localhost is reachable by every other process on your machine, and by any web page that can be made to resolve a hostname to 127.0.0.1. If you must use HTTP locally, require an authorization token or a Unix domain socket.

Install

npm install -g @phyi/cli
phylax --version

Add it to your client

The command is always the same. Only the file you put it in changes.

Claude Desktop

claude_desktop_config.json

{
  "mcpServers": {
    "phylax": {
      "command": "phylax",
      "args": ["mcp", "serve"],
      "env": {
        "PHYLAX_API_TOKEN": "${PHYLAX_API_TOKEN}"
      }
    }
  }
}

Platform	Location
macOS	~/Library/Application Support/Claude/claude_desktop_config.json
Windows	%APPDATA%\Claude\claude_desktop_config.json
Linux	~/.config/Claude/claude_desktop_config.json

Restart the client after editing. Configuration is read at launch.

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "phylax": {
      "command": "phylax",
      "args": ["mcp", "serve"],
      "env": {
        "PHYLAX_API_TOKEN": "${PHYLAX_API_TOKEN}"
      }
    }
  }
}

Use .cursor/mcp.json inside a project to scope the server to that project instead of every workspace you open.

VS Code

.vscode/mcp.json

{
  "servers": {
    "phylax": {
      "type": "stdio",
      "command": "phylax",
      "args": ["mcp", "serve"],
      "env": {
        "PHYLAX_API_TOKEN": "${env:PHYLAX_API_TOKEN}"
      }
    }
  }
}

Committing this file shares the server with everyone on the repository. The token stays in each developer’s environment, which is the point of referencing it rather than inlining it.

Reference the token, do not paste it

"${PHYLAX_API_TOKEN}" expands from your environment at launch. A literal token in this file is a secret sitting in a config that gets committed, screen-shared and synced between machines. Read commands work without a token at all, so start without one.

What the server exposes

Once connected, the assistant can call these without leaving the conversation.

Tool	Purpose
verify_package	Return a verdict for one package reference.
verify_mcp_server	Return a verdict for another MCP server before you enable it.
get_attestation	Fetch the signed attestation behind a verdict.
check_policy	Evaluate an artifact against your organization’s policy.

Confirm it is running

Ask the assistant to verify something with a known answer:

Use Phylax to verify pkg:npm/express@4.18.2 and tell me the verdict.

If the tool never gets called, the client did not start the server. Run the command yourself to see the error the client swallowed:

phylax mcp serve

Read the command before you approve it

Any client offering one-click MCP setup must show you the exact command it is about to run, untruncated, because that command executes on your machine with your privileges. Treat a truncated or obfuscated command in an install link the same way you would treat a curl | sh from a stranger.

Local or remote

Use local when the token stays on one machine and you want no network hop. Use Remote Phylax MCP when a team shares one configuration, or when the client cannot spawn processes.

Related guides

See MCP Servers for what Phylax checks and the threat model behind it.