AgentArmorHQ
Sign in

critical

MCP server · npm · graded 2026-10-26Source linked

Extract & inline critical-path CSS — two engines, automatic routing, agent-native.

No outside reports on file

This tool processes external web content and modifies local files, so use it only on trusted websites and review all changes before deploying, especially if running through automated agents.

Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Critical helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachLocal or standard API callsLOW
  • CredentialsNo API token requiredLOW
  • Package sourcenpm (critical)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y critical

All setup options ↓

Check this skillWatch it in my stackCompareAdd to allowlistREADME badgeView project

About Critical

This tool extracts the CSS that a website actually uses when it first loads (called 'critical-path CSS') and puts it directly into the HTML so pages display faster. It can work with two different CSS processing engines and may be set up to work automatically with AI agents.

Who it’s for

Web developers and build tool operators who want to speed up initial page rendering. May appeal to teams running automated site optimization through AI agents.

Alternatives

  • Penthouse: Another critical CSS extraction tool with similar goals and wider community use.
  • PurgeCSS: Removes unused CSS but doesn't specifically inline critical-path styles.
  • CriterionCSS: A simpler inline critical CSS processor with minimal dependencies.

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README for installation and configuration details specific to your environment.

Why this grade

DD — High risk signals

Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

32/100
Weekly npm downloads
28.5k
Listing last refreshed
2026-10-29

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Security reports

No reports found for this package in our research (last checked 2026-10-29).

Check a specific version →

Risks to watch for

  • Runs code from web pages: When analyzing sites, this tool will download and process HTML and CSS files from the internet, executing any code in those files. A malicious website could send harmful instructions that the tool processes.
  • Can modify file outputs: The tool writes new CSS directly into HTML files in your project. If misconfigured, it might corrupt or overwrite project files you didn't intend to change.
  • Unclear automatic routing: The description mentions 'automatic routing' and 'agent-native' behavior, which is vague. Without clear documentation, AI agents using this might take unexpected actions on your codebase.
  • Dependency on external tools: The tool relies on other CSS engines which themselves could have security issues or unexpected behaviors.
  • No verification of extracted CSS: There's no indication the tool validates whether extracted CSS is safe or complete before inlining it into your HTML.

How to lower the risk

Least-privilege permissions

  • Run only with access to specific project directories, not your entire system.
  • Don't give the tool write access to directories beyond the intended output folder.

Network isolation

  • Only allow it to access websites you explicitly trust and control.
  • Consider running it in an isolated environment if testing unknown sites.

Monitoring

  • Review all file changes the tool makes before committing them to version control.
  • Log what URLs and sites the tool processes for audit purposes.

Red flags to watch for

  • Unexpected files being created or deleted in your project.
  • Strange CSS content appearing in your HTML that you didn't request.
  • The tool attempting to access network locations or credentials.

Questions

How do I install Critical?

Run npx -y critical in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.

Are there security reports about Critical?

No reports found for this package in our research (last checked 2026-10-29). Critical currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include runs code from web pages, can modify file outputs, unclear automatic routing.

Is Critical actively maintained?

Critical has 28.5k weekly npm downloads. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues before pinning it in production.

What are alternatives to Critical?

Notable alternatives to Critical include Penthouse (Another critical CSS extraction tool with similar goals and wider community use), PurgeCSS (Removes unused CSS but doesn't specifically inline critical-path styles), CriterionCSS (A simpler inline critical CSS processor with minimal dependencies). You can also compare Critical side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Critical? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade D for Critical

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Critical](https://agentarmorhq.com/api/badge/critical)](https://agentarmorhq.com/skills/critical)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/critical"><img src="https://agentarmorhq.com/api/badge/critical" alt="AgentArmorHQ Risk Grade for Critical" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "critical"

Share with your security lead

Need sign-off to use critical? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: critical
- **Listing URL:** https://agentarmorhq.com/skills/critical
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** npm (critical)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts critical`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Install command
npm install critical
Est. context load
~500 tokens / turn (~3 tool schemas, 0.25% of 200k context)
Popularity
28.5k weekly npm downloads
Last updated
2026-10-29
Last graded
2026-10-26

Community

Discussions for Critical

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Critical helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude