MCP SERVERMount another MCP server's tools in the middle of a session, use them, then drop them — no config edit, no client restart.
LABSCO SUMMARY
The publisher says this outright: the floor is about 1,774 tokens a turn and it is additive, so this earns its place for servers you never configured, the one you are writing right now, and community packages you want to try without wiring them into mcp.json forever. reload is the piece a developer will reach for most — edit the code, reload, call, session intact. On safety, take the publisher's own boundary rather than the headline: the Docker cage engages only when Docker is present and only for community sources, confirm=True is something the model itself can set rather than a human approval gate, and a TOFU pin fixes a version rather than a content hash. Their conclusion is the right one — supervised developer use, not unattended runs holding production admin or billing credentials.
A runtime MCP proxy: one always-on entry in your client config that reaches the rest of the ecosystem. search finds a server across seven registries, shapeshift(id) mounts its tools into the current turn, and shapeshift() with no argument drops them again. The same loop doubles as a REPL for a server you are writing — connect, edit, reload, call — without the session dying in between.
Python 3.12+. Install with pip install kitsune-mcp, uvx kitsune-mcp for an isolated environment, or npx kitsune-mcp which delegates to uvx, then add one entry to the client config with the command kitsune-mcp. Node and npx are needed for npm-based servers, uvx for PyPI-based ones. SMITHERY_API_KEY is optional and opens the hosted Smithery servers; the other registries need no auth. Docker is optional but load-bearing: community npm, PyPI and GitHub mounts cage in a hardened container by default when Docker is on PATH — no host filesystem, --cap-drop ALL, read-only rootfs, RAM and PID caps, credentials forwarded by name only. A community mount requires confirm=True, and TOFU version pins live in ~/.kitsune/pins.json. Credentials sit at mode 0600 with OAuth 2.1, PKCE S256 and dynamic client registration. A cold mount takes roughly 1-15 seconds. MIT.
One command — pip install kitsune-mcp
USE CASES
Find it across the registries, mount just the one tool you need, call it, and unmount — the session and everything else in it stay up throughout.
Start it under an alias, edit the code, and reload in one call — which replaces the release-connect-remount dance and the stale-process trap that comes with it.
Mount it with explicit confirmation and let it run caged in Docker with no host filesystem, then drop it. The version you ran is pinned, so a later publish cannot quietly replace it.
Set the environment variable or run the server's OAuth from inside the session, check what a server still needs, and revoke it again when you are done.
One call searches, picks, infers the arguments and runs it. Give it a server hint when you know the id, because without one the pick is a guess.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
authCheck or set credentials. ALL_CAPS = env var; server-id = creds check or OAuth.
auth('GITHUB_TOKEN', 'ghp_...') # save env var auth('GITHUB_TOKEN') # check if set auth('server-id') # show creds needed / run OAuth auth('server-id', 'logout') # revoke OAuth tokens
autosearch → pick server → infer args → call. Use when you don't know which server to use.
auto('what time in Tokyo') auto('list issues on acme/api', server_hint='github')
callInvoke a tool on an MCP server. Returns the tool's response as text.
Routes through the warm pooled transport when a server is shapeshifted; otherwise spins up a transient transport for the given server_id. Records the call in session stats. Long responses (HTML, large outputs) are truncated with a continuation note.
Use when: the tool name and target server are known. Avoid when: discovery is needed — auto() does search → pick → call in one step.
call('get_current_time', arguments={'timezone': 'UTC'}) # after shapeshift call('list_directory', '@mcp/server-fs', {'path': '/tmp'}) # ad-hoc one-shot
connectStart a persistent server. command: server_id or shell cmd (e.g. 'uvx voice-mode'). name: alias for release().
releaseKill a persistent connection by name.
reloadReload a persistent connection after editing its code — the MCP REPL in one call.
reload('dev') # release the stale process, start fresh code, remount live
Replaces the manual release() + connect() + shapeshift() cycle and removes the "connect() handed back the old process" footgun (it always releases first). name is the alias you gave connect().
searchDiscover MCP servers across registries — the entry point to mounting.
Returns a ranked list of server_ids with name, description, source, and credential-readiness status. Records discovered servers in session so status() can summarize them. Reports per-registry failures inline rather than failing the whole call.
Use when: you need to find a server matching a capability before mounting. Avoid when: the server_id is already known — go straight to shapeshift() or inspect().
search('web search') # find candidates search('postgres', compare=True) # side-by-side token-cost table search('vector db', registry='smithery')
registry: all|official|mcpregistry|glama|npm|smithery|pypi
shapeshiftMount an MCP server's tools at runtime. Empty server_id unmounts.
shapeshift('mcp-server-time') # mount (community sources cage by default) shapeshift('id', tools=['only_this']) # lean — mount only listed tools shapeshift('id', sandbox=False) # opt out of the default Docker cage shapeshift('id', sandbox=True) # force the cage (hard-fail if no Docker) shapeshift() # unmount + kill process
sandbox: None (default) cages low-trust npm/PyPI/github sources in Docker when it's available (best-effort — runs uncaged with a nudge if not); True forces the cage; False opts out. source: auto|local|smithery|official. confirm=True for community sources.
statusShow Kitsune runtime state: providers, current form, connections, token stats.
BEFORE YOU INSTALL
9 tools when we connected. KITSUNE_TOOLS=all or the kitsune-forge entrypoint adds the forge tools, KITSUNE_TOOLS also accepts a subset, and shapeshift mounts other servers' tools mid-session.
Python 3.12+
All 7 documented clients run the server on your machine.
CONTEXT COST
Rated by the size of the 9 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
pip install kitsune-mcp{
"mcpServers": {
"kitsune": {
"command": "kitsune-mcp"
}
}
}MCP servers
lucky-aeon
cameroncooke
neilopet
Coding-Dev-Tools