A lightweight mcp to prevent poisoning CVE (CVE-2025-54136), researchers hijacking Claude Code/Copilot/Gemini via prompt injection, and hundreds of MCP servers exposed with zero auth, this mcp protects the individual developer's laptop, where most MCP servers actually run.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 47aeedc · analyzer v33 · 4d ago
danger signals1
- committed secret Anthropic key Sushank05-mcp-doorman-47aeedc/tests/redact.test.ts :51
sk-ant…(37 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 23
filesystem 5
- fs Sushank05-mcp-doorman-47aeedc/src/audit.ts :12
import { appendFile, mkdir } from "node:fs/promises"; - fs Sushank05-mcp-doorman-47aeedc/src/cli.ts :11
import { existsSync, writeFileSync } from "node:fs"; - fs Sushank05-mcp-doorman-47aeedc/src/config.ts :9
import { readFileSync } from "node:fs"; - fs Sushank05-mcp-doorman-47aeedc/src/pinning.ts :17
import { mkdirSync, readFileSync, writeFileSync } from "node:fs"; - fs (weak) Sushank05-mcp-doorman-47aeedc/tests/gateway.e2e.test.ts :10
import { existsSync, rmSync } from "node:fs";
install hooks 1
- prepublishOnly Sushank05-mcp-doorman-47aeedc/package.json :25
npm run build && npm run test
declared dependencies 6
- @modelcontextprotocol/sdk@^1.29.0
- zod@^4.4.3
- @types/node@^26.1.0
- tsx@^4.23.0
- typescript@^6.0.3
- vitest@^4.1.10