# Duck Framework MCP (remote · duckframework.com)

Official Duck Framework MCP server for AI-assisted development and project scaffolding.

- Trust score: 67/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `duckframework.com`: 67/100 (this document), [markdown](https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework.md), [page](https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework)

## Channel facts

- Endpoint: `https://duckframework.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 14/100
  - TLS not yet verified: we couldn't open a connection to check the certificate.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS not yet verified: we couldn't read the response headers to check for it.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but we couldn't connect to verify it.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 5 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Duck Framework MCP server?

Duck Framework MCP is a hosted endpoint at https://duckframework.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http duckframework-duckframework-mcp 'https://duckframework.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "duckframework-duckframework-mcp": {
      "url": "https://duckframework.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "duckframework-duckframework-mcp": {
      "type": "http",
      "url": "https://duckframework.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.duckframework-duckframework-mcp]
url = "https://duckframework.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "duckframework-duckframework-mcp": {
      "type": "remote",
      "url": "https://duckframework.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add duckframework-duckframework-mcp --url 'https://duckframework.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  duckframework-duckframework-mcp:
    url: "https://duckframework.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "duckframework-duckframework-mcp": {
      "Transport": "http",
      "Url": "https://duckframework.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add duckframework-duckframework-mcp -t streamable-http -u 'https://duckframework.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "duckframework-duckframework-mcp": {
      "type": "http",
      "url": "https://duckframework.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 67, 0)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] HSTS header: fail → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.40 → unverified
- [security regression] TLS certificate: pass → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-11-04 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 65, +1)

- [security regression] HSTS header: unverified → fail
- [security improvement] Injection markers: unverified → pass
- [security improvement] TLS certificate: unverified → pass
- [security improvement] Transport: fail → pass
- [security] Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 13 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Endpoint reachability: unreachable → reachable
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Stability: unverified → 0.30

### 2026-10-31 (score 64, 0)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] Stability: 0.23 → unverified
- [security regression] HSTS header: fail → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] TLS certificate: pass → unverified
- [security regression] Transport: pass → fail
- [security] Authorization: Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-10-29 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 62, +1)

- [functional improvement] Stability: unverified → 0.03

## MCP tools (13)

### `fetch_ai_guide` (~62 tokens)

Fetch an official Duck Framework AI guide.
Use this after get_ai_guides() to retrieve the full guide content for
AI-assisted Duck Framework development.
Always read the relevant guide before generating code instead of relying
on memory.

Input parameters:

- `guide` (string, required)

### `get_ai_guides` (~40 tokens)

List available Duck Framework AI guides.
Use this to discover available guides before fetching one with
fetch_ai_guide().
Returns guide identifiers and their descriptions.

### `get_blueprint_locations` (~36 tokens)

Explain where Duck Framework blueprints can be located.
Describes the supported blueprint layouts and when each organization
approach is appropriate.

### `get_blueprint_structure` (~53 tokens)

Return the standard internal structure of a Duck Framework blueprint.
Use this before generating a new blueprint or adding files to an existing
one to understand where components, pages, templates, automations, and
views belong.

### `get_component_api` (~80 tokens)

Look up a built-in Duck Framework component API.
Returns the confirmed import path, container type, and supported keyword
arguments for a component without requiring the full HTML components guide
to be loaded.
Use this before using any component that has not already been confirmed.
Returns close-name suggestions when the component does not exist.

Input parameters:

- `component_name` (string, required)

### `get_project_structure` (~34 tokens)

Return the standard Duck Framework project directory structure.
Use this before creating or modifying projects to understand where files
and directories belong.

### `lint_component_code` (~96 tokens)

Check Duck Framework component or page code for common mistakes.
Detects known patterns such as incorrect component imports, invalid page
imports, incorrect Heading usage, leading-underscore method names, and
separator comments.
This is a pattern check for known issues, not a complete correctness
validator. An empty result only means no known issues were detected.
Run this on generated component code before presenting it as final.

Input parameters:

- `code` (string, required)

### `list_doc_categories` (~39 tokens)

List all Duck Framework documentation categories and their pages.
Use this when browsing available documentation without a specific
search query.

Input parameters:

- `version` (string)

### `plan_feature` (~62 tokens)

Analyze a Duck Framework feature request and create an implementation plan.
Returns relevant documentation to read and a suggested order of operations
before writing code. Use this before implementing non-trivial Duck
Framework features.

Input parameters:

- `request` (string, required)
- `version` (string)

### `reindex_docs` (~71 tokens)

Rebuild the Duck Framework documentation index.
Crawls the live documentation sitemap for a given version and merges
the result in: curated tags/summary/category are preserved, new pages
are added, and pages no longer in the sitemap are removed.
Requires the admin scope.

Input parameters:

- `version` (string)

### `scaffold_blueprint` (~111 tokens)

Scaffold a new Duck Framework blueprint.
Generates a blueprint structure containing blueprint.py, views.py, and
optional UI, template, and static directories following the documented
Duck blueprint conventions.
Returns generated file contents and the settings configuration needed to
register the blueprint. This tool does not write files.

Input parameters:

- `blueprint_name` (string, required)
- `enable_static_dir` (string)
- `enable_template_dir` (string)
- `prepend_name_to_urls` (string)
- `urlpatterns` (string)

### `scaffold_project` (~89 tokens)

Scaffold a new Duck Framework project.
Returns the required CLI commands and generated file contents for
supported features with confirmed APIs. Unsupported features return
documentation guidance instead of generated code to avoid guessing
framework APIs.
This tool does not write files. It only returns generated content for the
calling client to add to the user's project directory.

Input parameters:

- `features` (string)
- `project_name` (string, required)

### `search_docs` (~75 tokens)

Fuzzy-search the Duck Framework documentation.
Use this whenever the correct documentation page for a feature is
unknown. Returns ranked matches containing title, URL, category,
summary, and relevance score.

Input parameters:

- `category` (string)
- `query` (string, required)
- `top_k` (string)
- `version` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework#diagnostics

## Score history

- 2026-11-05: 67
- 2026-11-04: 67
- 2026-11-03: 66
- 2026-11-02: 66
- 2026-11-01: 65
- 2026-10-31: 64
- 2026-10-30: 64
- 2026-10-29: 64
- 2026-10-28: 63
- 2026-10-27: 63
- 2026-10-26: 63
- 2026-10-25: 62
- 2026-10-24: 62
- 2026-10-23: 61

## Common questions

### What is the Duck Framework MCP server?

Duck Framework MCP is listed in the public MCP registry as io.github.duckframework/duckframework-mcp. Official Duck Framework MCP server for AI-assisted development and project scaffolding. This page covers its hosted endpoint (https://duckframework.com/mcp).

### Is the Duck Framework MCP server safe to use?

Duck Framework MCP scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Duck Framework MCP server expose?

Duck Framework MCP exposes 13 tools: fetch_ai_guide, get_ai_guides, get_blueprint_locations, get_blueprint_structure, get_component_api, and 8 more. Their descriptions and schemas cost roughly 848 tokens of context every time the server is loaded.

### Does the Duck Framework MCP server require authentication?

Its publisher declares no required credentials for Duck Framework MCP. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the Duck Framework MCP server still maintained?

Duck Framework MCP is still listed in the MCP registry, though our most recent checks did not reach this channel. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://duckframework.com/mcp
- Repository: https://github.com/duckframework/duck
- Website: https://duckframework.com/
- Changelog RSS feed: https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework.xml
- Changelog JSON feed: https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework.json
- HTML version of this page: https://verifymcp.io/servers/duckframework-duckframework-mcp/duckframework