godmode-mcp

MCP server for getgodmode.dev. Browse the Godmode catalogue, install the free Lite skill, and install paid skills into ~/.claude/skills/ — all from inside Claude Code or Claude Desktop.

Install

Pin the exact version (supply-chain safety):

claude mcp add --transport stdio \
  --env GODMODE_MCP_TOKEN=<your-token> \
  godmode -- npx -y [email protected]

Or add to claude_desktop_config.json:

{
  "mcpServers": {
    "godmode": {
      "command": "npx",
      "args": ["-y", "[email protected]"],
      "env": {
        "GODMODE_MCP_TOKEN": "<your-token>"
      }
    }
  }
}

Windows native (cmd.exe wrapper):

claude mcp add --transport stdio \
  --env GODMODE_MCP_TOKEN=<your-token> \
  godmode -- cmd /c npx -y [email protected]

Get your token at getgodmode.dev/account.html → MCP Access panel. Free-tier tools (godmode_list_products, godmode_install_lite) work without a token.

Tools

| Tool | Auth | Purpose | |------|------|---------| | godmode_list_products | — | List the full catalogue (slug, version, price, blurb). | | godmode_get_product(slug) | — | Fetch full details for one product. | | godmode_open_pricing() | — | Return the pricing page URL so the user can click to buy. | | godmode_install_lite() | — | Install the free Godmode Lite skill to ~/.claude/skills/godmode-lite/. | | godmode_list_owned_skills() | Token | List products tied to your active purchases. | | godmode_install_skill(slug) | Token for paid | Verify entitlement, download the skill, install it safely. |

How installs are made safe

• Downloads stream to a .part file and are renamed atomically.
• Every downloaded zip is verified against a server-signed sha256.
• Zip extractor is hardened against zip-slip, zip-bombs, symlinks, hard-links, control characters, Windows-reserved filenames, and absolute paths.
• Existing skill directories are backed up to <slug>.bak-<timestamp>/ before install (pass overwrite: true to skip the backup).
• A per-slug lockfile prevents two concurrent installs from racing on the same target.
• Staging lives under ~/.claude/skills/.staging/ so the final rename() is atomic on the same filesystem.
• All outbound requests are locked to the getgodmode.dev host allowlist and reject HTTP redirects cross-origin.
• The server writes only JSON-RPC to stdout; all logging goes to stderr with Bearer-token redaction. The token is read once and then removed from process.env so child processes can't inherit it.

Environment variables

| Var | Required | Default | Purpose | |-----|----------|---------|---------| | GODMODE_MCP_TOKEN | For paid tools | — | Bearer token from your account page. | | GODMODE_API_BASE | No | https://getgodmode.dev | Override for staging. | | GODMODE_MCP_DEBUG | No | — | Set to 1 for verbose stderr logs. | | NODE_EXTRA_CA_CERTS | Corporate only | — | If you're behind an MITM proxy with a private CA. |

Development

git clone <this repo>
cd godmode-site/mcp
npm install
npm test          # 22 unit tests (validators + zip safety)
npm run typecheck
npm run build     # emits build/index.js with shebang + exec bit
npm start         # runs the compiled server

License

MIT.