Jan Curn (@jancurn) on X

What it claims

mcpc v0.7.0, the MCP CLI client from Apify, adds the MCP Skills extension, tightens several credential-handling paths, and improves OAuth and 2026-07-28 spec compatibility. The author calls it "the most compliant MCP CLI client out there", but the post gives no comparison or test suite to back that up.

How it works

Skills verification is fail-closed. skills-list and skills-get read SKILL.md and its supporting files, then check each one against the skill manifest by size and SHA-256. If the content doesn't match, mcpc refuses to print it. A tampered or truncated skill file produces no output, not a warning next to the content. Scripts or agents piping skills-get output should handle that empty or failed case.

The security changes as stated:

• During auto-discovery, a repo-local .mcp.json can no longer read environment variables. The example given is a cloned repo exfiltrating $GITHUB_TOKEN. If you relied on env-var interpolation in a project-local .mcp.json, expect it to stop working in auto-discovery.
• Refresh tokens are sent only to the auth server you logged in to.
• On Windows, login URLs no longer open through cmd.exe.

Other fixes the summary does not mention:

• Windows logins now work with any token size.
• x402 payment receipts are supported.
• OAuth sessions stay alive longer.

How to use it

$ npm i -g @apify/mcpc

The post says the project is close to 1,000 GitHub stars and credits more than a dozen new contributors and bug reporters.

Limits

This is an announcement post. It links a full changelog but does not include it, so breaking changes, migration notes, the exact skills-list/skills-get syntax, and supported Node versions are not stated. It names no licence beyond "open-source" in the catalog summary. Check the changelog before upgrading, especially if you use a .mcp.json that depends on env vars.