Anthropic MCP Directory Review — Local Falcon MCP

[bryan-anthropic]

Hi from Anthropic 👋

We reviewed Local Falcon MCP for inclusion in the Anthropic MCP Directory. We found two items that need to be addressed before we can list the server.

Required

1. Credential management — We observed an OAuth client secret hardcoded in the distributed package (oauth/config.js). While the OAuth code path isn't active in STDIO mode, the credential is still exposed in plaintext to anyone who extracts the bundle. Please move this to an environment variable or server-side configuration.

2. Tool annotation accuracy — All 37 tools currently declare openWorldHint: false, but every tool makes external API calls to api.localfalcon.com. Please update to openWorldHint: true on all tools.

We're happy to re-review once these are addressed. Feel free to reach out with any questions.

[WeAreLocalFalcon]

Hi Bryan, apologies for the delayed response. Both items are addressed in v1.3.1 (deployed today):

Credential management - OAuth client secret moved to process.env.OAUTH_CLIENT_SECRET. No longer in the distributed package.
Tool annotation accuracy - All 37 tools updated to openWorldHint: true.

Ready for re-review at your convenience. Thanks for flagging these.

• David at Local Falcon

[bryan-anthropic]

Thanks David — OAuth secret removal and annotations confirmed. Local Falcon MCP is now approved for the MCP Directory. Closing this issue.