Preflight shipped

Someone shared a tool on GitHub. Is it safe to install?

A single-file CLI that reads a GitHub project — or the curl | bash line straight off its README — and tells you in plain English what it does to your Mac, before you run it. Built for the MCP-server gap: you paste a config blob, npx runs someone's server, and nothing ever reviewed it. Preflight flags code that runs the moment you install, anything reaching for your keys, and anything that phones home.

• Checks whole GitHub repos or raw install one-liners, straight from the URL
• Three plain-English verdicts: looks fine / worth a look / don't run this
• MCP-server aware — catches install-time code execution before you ever use the tool
• Zero dependencies, one Python file, brew install jcsuen/tap/preflight