The publisher says this outright: the floor is about 1,774 tokens a turn and it is additive, so this earns its place for servers you never configured, the one you are writing right now, and community packages you want to try without wiring them into mcp.json forever. reload is the piece a developer will reach for most — edit the code, reload, call, session intact. On safety, take the publisher's own boundary rather than the headline: the Docker cage engages only when Docker is present and only for community sources, confirm=True is something the model itself can set rather than a human approval gate, and a TOFU pin fixes a version rather than a content hash. Their conclusion is the right one — supervised developer use, not unattended runs holding production admin or billing credentials.
A runtime MCP proxy: one always-on entry in your client config that reaches the rest of the ecosystem. search finds a server across seven registries, shapeshift(id) mounts its tools into the current turn, and shapeshift() with no argument drops them again. The same loop doubles as a REPL for a server you are writing — connect, edit, reload, call — without the session dying in between.
- search ranks servers across the official list, registry.modelcontextprotocol.io, Glama, npm, PyPI, GitHub and Smithery, returning ids with name, description, source and credential-readiness, and reporting per-registry failures inline instead of silently dropping them
- shapeshift mounts a server's tools at runtime; tools=['only_this'] mounts a single tool rather than the whole surface, and an empty call unmounts
- call invokes a tool on a mounted or transient server, routing through the warm pooled transport when one is already mounted
- auto does search, pick, infer arguments and call in one step — pass server_hint when you know the id, since without it the pick is best-effort
- connect starts a persistent server from a server id or a shell command under an alias, release kills it, and reload does release, connect and remount in a single call — the edit loop for a server you are writing
- auth handles credentials mid-session: an ALL_CAPS name saves or checks an environment variable, a server id shows what that server needs or runs its OAuth, and auth(id, 'logout') revokes
- status reports providers, the current mounted form, live connections and token stats
- At rest the profile is 9 tools and about 1,774 tokens per turn — the standing cost of having it connected
Python 3.12+. Install with pip install kitsune-mcp, uvx kitsune-mcp for an isolated environment, or npx kitsune-mcp which delegates to uvx, then add one entry to the client config with the command kitsune-mcp. Node and npx are needed for npm-based servers, uvx for PyPI-based ones. SMITHERY_API_KEY is optional and opens the hosted Smithery servers; the other registries need no auth. Docker is optional but load-bearing: community npm, PyPI and GitHub mounts cage in a hardened container by default when Docker is on PATH — no host filesystem, --cap-drop ALL, read-only rootfs, RAM and PID caps, credentials forwarded by name only. A community mount requires confirm=True, and TOFU version pins live in ~/.kitsune/pins.json. Credentials sit at mode 0600 with OAuth 2.1, PKCE S256 and dynamic client registration. A cold mount takes roughly 1-15 seconds. MIT.
One command — uvx kitsune-mcp