MCP server for interactive user feedback in AI-assisted development, featuring dual interface support (Web UI and Desktop Application) with intelligent environment detection and cross-platform compatibility.
Listed on its own since 2026-09-26. Until then it was part of ifeedback-mcp, where its earlier checks remain.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-feedback-enhanced","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Feedback Enhanced **🌐 Language / 語言切換:** **English** | [繁體中文](README.zh-TW.md) | [简体中文](README.zh-CN.md) **Original Author:** [Fábio Ferreira](https://x.com/fabiomlferreira) | [Original Project](https://github.com/noopstudios/interactive-feedback-mcp) ⭐ **Enhanced Fork:** [Minidoracat](https://github.com/Minidoracat) **UI Design Reference:** [sanshao85/mcp-feedback-collector](https://github.com/sanshao85/mcp-feedback-collector) > ## 📢 Maintenance Status (2026-08) > > The project is maintained again. **Please upgrade to v2.6.1** — it fixes a command execution vulnerability: > > ```bash > uvx mcp-feedback-enhanced@latest > ``` > > **What changed in v2.6.1:** > - 🔒 **Command execution removed** — fixes [#219](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/219) (unauthenticated WebSocket could execute arbitrary programs). The old blocklist only caught shell metacharacters, but since execution used `shell=False` metacharacters were never the risk — `cat`, `curl`, `wget`, `python` passed straight through, and auto-command was **enabled by default**. The feature is gone for good. See [SECURITY.md](SECURITY.md). > - 🔒 **Cross-Site WebSocket Hijacking fixed** (reported privately as `GHSA-cmr5-gpm3-79vf`, `GHSA-2wx7-r4rh-f663`): browsers are not restricted by the same-origin policy when opening a WebSocket, so a malicious page could make your browser connect to the local `/ws`. `Origin` is now validated before `accept()`, and cross-origin attempts are rejected with 403. > - 🐛 Fixed the Starlette breaking change that made the Web UI return 500 ([#213](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/213), [#217](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/217), [#221](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/221), [#228](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/228)). > - 🐛 Fixed image serialization ([#154](https://github.com/Minidoracat/mcp-feedback-enhanced/issues/154) and related) …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.