StackPrism

StackPrism MCP server for Claude Code, Cursor and Codex

Your coding agent’s knowledge stops at its training date. Connect it to StackPrism and it can read the build brief for your stack, check a package against today’s vulnerability and end-of-life data before installing it, and ask Prism Agent about the architecture.

Server URL
https://stackprism.ai/api/mcp
Transport
Streamable HTTP
Auth
Authorization: Bearer sp_…

Connect your agent

  1. Create an access token

    Tokens belong to your StackPrism account, so your agent sees your projects. It takes a free account; the token is shown once.

    Create a token

  2. Add StackPrism to your agent

    Pick your agent and run its setup. Replace <YOUR_TOKEN> with your token.

    Run this once in a terminal. Add --scope user to use StackPrism in every project, not just this folder.

    Add the server

    claude mcp add --transport http stackprism https://stackprism.ai/api/mcp --header "Authorization: Bearer <YOUR_TOKEN>"

    Check it with claude mcp list, or /mcp inside a session.

What your agent can do

16 tools. The 13 that read and check your stack are deterministic and cost nothing; the 3 that think use your AI allowance.

Free, no AI cost

  • list_projectsLists your StackPrism projects, so the agent can find the one it’s working on.
  • get_projectEvery component, connection and hosting boundary of a project.
  • get_build_briefThe full build brief: the stack in build order, how it connects, install commands, env vars and a production checklist.
  • get_env_templateA ready-to-save .env.example for the stack, with secrets marked server-only.
  • get_improvementsOpen fixes and the production checklist, with what you’ve already ticked off.
  • check_stackChecks a package version or technology before it’s added: CVEs, CISA’s exploited list, end of life, licence, deprecation.
  • get_stack_healthRuns Stack Pulse on a project, including every pinned dependency when the repo is linked.
  • find_alternativesAlternatives to a technology, with pros, cons and use cases.
  • get_blast_radiusWhat stops or degrades if one part goes down, and ways to soften it.
  • export_diagramThe diagram as Mermaid for a README, as graph JSON, or as a FINOS CALM document.
  • get_historyEvery recorded change to the architecture: what changed, when and who made it.
  • get_repo_timelineThe commits that changed dependencies or infrastructure in a linked repo, as plain lines.
  • apply_changeSaves a change you approved from propose_change as a new diagram version, recorded in History.

Uses your AI allowance

  • ask_prism_agentAsks Prism Agent about a project. It checks live data first and cites its sources, and can investigate a linked repo.
  • propose_changePlans a change to the architecture and returns the diff for you to approve. Nothing changes yet.
  • design_stackDesigns a new stack from an idea and your constraints, and saves it as a project.

There are also two ready-made prompts, build_this_stack and investigate_breakage, and each project’s brief, diagram and health can be read as a resource.

Things to ask once it’s connected

  • “Use StackPrism to get the build brief for <project> and build it step by step.”
  • “Before you add a package, check it with StackPrism.”
  • “Check my package.json dependencies with StackPrism and tell me what to upgrade first.”
  • “What breaks if Stripe goes down? Use StackPrism’s blast radius for <project>.”
  • “Ask Prism Agent why checkout started failing this week.”

How your data is handled

  • Tokens are stored as a hash

    A token is shown once. StackPrism keeps only its SHA-256 hash, so its database can’t give a working token away. Revoke a token at /connect and it stops working straight away.

  • Only your data

    Every query is filtered by the account the token belongs to. Asking for someone else’s project gets “Project not found”, the same answer as a project that doesn’t exist.

  • Read-only on GitHub

    Repo tools only read repos you linked to a project, on the linked branch. StackPrism never pushes commits, opens pull requests or changes settings, and your GitHub token never leaves its servers.

  • No code kept

    Package checks send names and versions, never source code. StackPrism doesn’t store your code: repo files Prism Agent reads for an answer go to the AI model and are discarded.

  • Data, not instructions

    The server tells agents that anything it returns from repos, diagrams or third-party sources is data to weigh, not instructions to follow.

  • Limits and plain errors

    Each account gets 60 requests a minute. Failures come back as short messages, never stack traces or tokens.

Questions

Which agents and MCP clients does it work with?

Claude Code, Codex and Cursor have setup steps above. Any client that speaks Streamable HTTP and can send an Authorization header works with the same URL. For clients that only start local servers, the mcp-remote bridge (needs Node) connects them; it’s under Other.

Does it use OAuth?

No. You create a personal access token at /connect and your agent sends it as a bearer token. Make one per machine or agent (up to 10), so you can revoke them separately.

Is it free?

The tools that read and check your stack cost nothing. ask_prism_agent, propose_change and design_stack use your account’s monthly AI allowance, the same one the app uses: roughly 100 Prism Agent messages a month on the free plan, or 10 times that on Pro ($19.99 a month). You need a free account to create a token.

Can my agent see my private repos?

Only repos you connected through GitHub and linked to a StackPrism project, and only to read them: the repo timeline, and Prism Agent’s investigations into when something broke. Everything else works from your diagrams.

Can the agent change my architecture without asking?

Changes take two calls. propose_change returns the diff and a signed plan token; apply_change saves exactly that plan, refuses if the diagram changed in between, and records it in History. The server tells agents to show you the diff and wait for your OK first.

Where does the token live on my machine?

Claude Code keeps it in its MCP config. Codex reads it from the STACKPRISM_TOKEN environment variable, so it never sits in a config file. Cursor keeps it in mcp.json, which should stay out of git.