Install & downloads

Five surfaces. The CLI is the engine; everything else is a way of reaching it.

1 · The CLI — PyPI

The engine. Everything else on this page depends on it being installed.

uv tool install --force mcpgawk      # recommended: isolated, always on PATH
pipx install --force mcpgawk         # same idea, if you already use pipx
python3 -m pip install --user --upgrade mcpgawk   # anywhere Python 3.10+ is; fix PATH yourself

pypi.org/project/mcpgawk · Apache-2.0 · free forever, no account.

Which one? uv tool install if you have uv: it isolates the package and puts the binary somewhere already on your PATH, which is the single most common install problem. Plain pip install into a system Python is the most likely to end in command not found.

2 · VS Code — Marketplace

The fleet, in the sidebar. It shells out to the CLI on your machine and renders what comes back; it is a view, not a second engine.

code --install-extension gawk-dev.mcpgawk

Extension ID gawk-dev.mcpgawk. Requires the CLI above.

3 · VSCodium, Cursor, Windsurf and friends — Open VSX

The same extension, published to the registry those editors use instead of the Microsoft one.

codium --install-extension gawk-dev.mcpgawk

open-vsx.org/extension/gawk-dev/mcpgawk.

Open VSX download counts include registry mirroring and are not a usage number. We do not quote them as traction, and neither should you.

4 · CI — the GitHub Action

Gate a merge on what an MCP server actually is, in the pipeline rather than on a laptop.

- uses: gawk-dev/mcpgawk/action@main
  with:
    fail-on-flagged: true

Exit codes are the contract: 0 clean, 1 findings, 4 incomplete. Fail the build on 4 as well as 1 — a run that could not finish is not a pass.

5 · As an MCP server — so your agent can ask

Installing the CLI also installs mcpgawk-mcp, which exposes two read-only tools (scan_mcp_fleet, scan_mcp_server) so an agent can check this machine's scanner before trusting a server.

claude mcp add mcpgawk -- mcpgawk-mcp

It is read-only and blocks nothing by itself. Call-time blocking is the guard hook (Quickstart step 3), and it refuses to launch stdio servers unless the caller asks.

Keeping it current

mcpgawk --version
uv tool install --force mcpgawk     # or: pipx install --force mcpgawk

The extension and the CLI are released in lockstep on the same version number. A mismatch is worth reporting.