MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
Drift inferred · capture-to-capture
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
- HIGH code analysis flagged hidden prompt content in getmcpm/cli
transport stdio
verified
reported
listed in the official MCP registry counts 9 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
mcpm_audit
-
mcpm_doctor
-
mcpm_info
-
mcpm_install
-
mcpm_list
-
mcpm_remove
-
mcpm_search
-
mcpm_setup
-
mcpm_up
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 9d199e8 · analyzer v33 · 3h ago
skills & prompt files 1
- hidden: agent-rules: tag-smuggling getmcpm-cli-9d199e8/CLAUDE.md :609
smuggled ascii: "gbsct"
danger signals9
- suspicious endpoint 93.184.216.34 getmcpm-cli-9d199e8/src/__tests__/registry/publish-client.test.ts :180
expect(() => validateRegistryUrl("https://93.184.216.34")).not.toThrow(); - suspicious endpoint 100.63.255.255 getmcpm-cli-9d199e8/src/__tests__/registry/publish-client.test.ts :181
expect(() => validateRegistryUrl("https://100.63.255.255")).not.toThrow(); - suspicious endpoint 100.128.0.1 getmcpm-cli-9d199e8/src/__tests__/registry/publish-client.test.ts :182
expect(() => validateRegistryUrl("https://100.128.0.1")).not.toThrow(); - suspicious endpoint 169.254.169.254 (cloud metadata) getmcpm-cli-9d199e8/src/registry/registry.test.ts :987
expect(() => new RegistryClient({ baseUrl: "https://169.254.169.254" })).toThrow( - committed secret GitHub token getmcpm-cli-9d199e8/src/guard/__tests__/fixtures/mcptox/attacks/credential-egress-github-pat.json :14
ghp_A1…(40 chars, redacted) - committed secret private key getmcpm-cli-9d199e8/src/guard/__tests__/fixtures/mcptox/attacks/credential-egress-private-key.json :14
PEM private key block (redacted) - committed secret GitHub token getmcpm-cli-9d199e8/src/guard/__tests__/patterns.test.ts :612
ghp_A1…(40 chars, redacted) - committed secret GitLab token getmcpm-cli-9d199e8/src/guard/__tests__/patterns.test.ts :690
glpat-…(53 chars, redacted) - committed secret Anthropic key getmcpm-cli-9d199e8/src/guard/__tests__/patterns.test.ts :1067
sk-ant…(91 chars, redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 264
filesystem 67
- fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/diff.test.ts :6
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/export.test.ts :8
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/lock-integrity.test.ts :20
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/lock-provenance.test.ts :15
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/lock.test.ts :8
import { writeFile, mkdir, readFile } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/publish.test.ts :9
import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/secrets-write.test.ts :8
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/up-frozen.test.ts :23
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/up-integrity.test.ts :23
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/up-shadow.test.ts :22
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/up-unguarded.test.ts :16
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/commands/up.test.ts :9
import { writeFile, mkdtemp } from "fs/promises";
show 28 more
- fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/base-read-proto-name.test.ts :34
import { readFile, lstat } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/base-read-validation.test.ts :24
import { readFile, writeFile, rename, mkdir, unlink, lstat } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/claude-code.test.ts :26
import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/claude-desktop.test.ts :19
import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/cursor.test.ts :19
import { readFile, writeFile, rename, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/gemini-cli.test.ts :26
import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/vscode.test.ts :18
import { readFile, writeFile, rename, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/windsurf.test.ts :18
import { readFile, writeFile, rename, lstat, unlink } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/adapters/write-safety.test.ts :16
import { mkdtemp, mkdir, readFile, writeFile, symlink, rm, lstat } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/config/detector.test.ts :22
import { access } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/engines-invariant.test.ts :50
import { existsSync, readFileSync, realpathSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/package-metadata-caps.test.ts :16
import { readFileSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/server/handlers-up.test.ts :17
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/smoke/cli-smoke.test.ts :18
import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/stack/schema.test.ts :13
import { writeFile, mkdtemp } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/store/atomic.test.ts :21
import { mkdtemp, readFile, writeFile, symlink, rm, lstat, mkdir } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/store/keychain-master-key.test.ts :18
import { readFile, rm } from "node:fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/__tests__/store/store.test.ts :27
import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/commands/doctor.ts :19
import { access } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/commands/export.ts :230
import { writeFile as fsWriteFile } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/commands/lock.ts :483
import { writeFile } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/commands/publish/manifest.ts :6
import { readFile } from "node:fs/promises"; - fs getmcpm-cli-9d199e8/src/commands/verify.ts :323
import { access } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/config/adapters/base.ts :11
import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises"; - fs getmcpm-cli-9d199e8/src/config/detector.ts :6
import { access } from "fs/promises"; - fs (weak) getmcpm-cli-9d199e8/src/guard/__tests__/cli-cleanup.test.ts :10
import { mkdtempSync, rmSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/guard/__tests__/cli-confine.test.ts :9
import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync } from "node:fs"; - fs (weak) getmcpm-cli-9d199e8/src/guard/__tests__/cli-enable-dry-run.test.ts :12
import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
27 more not shown — this panel samples each group; the count above is the real total.
shell / exec 17
- shell (weak) getmcpm-cli-9d199e8/src/__tests__/smoke/cli-smoke.test.ts :17
import { spawnSync, execSync } from "node:child_process"; - shell (weak) getmcpm-cli-9d199e8/src/__tests__/store/os-keychain.test.ts :33
spawn(command: string, args: string[], opts: { env?: NodeJS.ProcessEnv }) { - shell getmcpm-cli-9d199e8/src/commands/doctor.ts :525
import { execFile } from "child_process"; - shell getmcpm-cli-9d199e8/src/commands/guard.ts :427
// wrap-marker integrity at spawn (previously parsed here but dropped). - shell getmcpm-cli-9d199e8/src/commands/install.ts :140
// Blocks shell metacharacters: ; | $ ` & ( ) { } < > ! ' " - shell (weak) getmcpm-cli-9d199e8/src/guard/__tests__/patterns.test.ts :899
// on a broader alternation (child_process/require(/exec(/spawn(/eval(/ - shell (weak) getmcpm-cli-9d199e8/src/guard/__tests__/relay.test.ts :16
import type { ChildProcess } from "node:child_process"; - shell getmcpm-cli-9d199e8/src/guard/cli-flag-injection-args.ts :9
* `command.split(" ")` before `spawn()` — every OTHER tool in the same codebase - shell getmcpm-cli-9d199e8/src/guard/confine/store.ts :9
* spawn (run-inner) treats an unreadable store as "profile absent" and keys the - shell getmcpm-cli-9d199e8/src/guard/relay.ts :17
import { spawn } from "node:child_process"; - shell getmcpm-cli-9d199e8/src/guard/run-inner.ts :59
* enable` time). Verified at spawn (warn-once on mismatch — see runInner). Absent - shell getmcpm-cli-9d199e8/src/guard/shell-metachar-args.ts :6
* unescaped into a shell string via `exec()`: CVE-2025-53818
show 5 more
- shell getmcpm-cli-9d199e8/src/guard/signatures.ts :58
// `require(`, `exec(`, `spawn(`, `eval(`, `new Function(` alongside the - shell (weak) getmcpm-cli-9d199e8/src/scanner/health-check.test.ts :12
// Mock child_process.spawn - shell getmcpm-cli-9d199e8/src/scanner/health-check.ts :12
import { spawn } from "node:child_process"; - shell getmcpm-cli-9d199e8/src/scanner/tier2.ts :234
const { execFile } = await import("node:child_process"); - shell getmcpm-cli-9d199e8/src/store/os-keychain.ts :26
import { spawn } from "node:child_process";
network 3
- net (weak) getmcpm-cli-9d199e8/src/guard/__tests__/patterns.test.ts :924
warns(`<div onmouseover="eval(this.getAttribute('data-payload'))" data-payload="fetch('/x')">Hover</div>`), - net getmcpm-cli-9d199e8/src/registry/publish-client.ts :117
response = await fetch(url, { - net getmcpm-cli-9d199e8/src/stack/frozen-provenance.ts :178
// Fail-open fetch (offline / endpoint error) → can't re-check → re-run.
secrets 4
- secrets (weak) getmcpm-cli-9d199e8/src/__tests__/commands/secrets-write.test.ts :270
delete process.env.SERVER_A_SECRET; - secrets (weak) getmcpm-cli-9d199e8/src/__tests__/server/handlers-up.test.ts :217
const original = process.env.API_TOKEN; - secrets getmcpm-cli-9d199e8/src/commands/publish/submit.ts :63
return process.env.GITHUB_TOKEN ?? process.env.MCPM_TOKEN ?? null; - secrets (weak) getmcpm-cli-9d199e8/src/scanner/health-check-env.test.ts :21
process.env.MY_COMPANY_SECRET = "supersecret"; // custom name a denylist would miss
tool registrations 9
- mcpm_search getmcpm-cli-9d199e8/src/server/index.ts :82
- mcpm_install getmcpm-cli-9d199e8/src/server/index.ts :91
- mcpm_info getmcpm-cli-9d199e8/src/server/index.ts :100
- mcpm_list getmcpm-cli-9d199e8/src/server/index.ts :109
- mcpm_remove getmcpm-cli-9d199e8/src/server/index.ts :118
- mcpm_audit getmcpm-cli-9d199e8/src/server/index.ts :127
- mcpm_doctor getmcpm-cli-9d199e8/src/server/index.ts :136
- mcpm_setup getmcpm-cli-9d199e8/src/server/index.ts :145
- mcpm_up getmcpm-cli-9d199e8/src/server/index.ts :154
install hooks 1
- prepublishOnly getmcpm-cli-9d199e8/package.json :25
npm run build
declared dependencies 20
- @modelcontextprotocol/sdk@^1.30.0
- @inquirer/prompts@^8.7.0
- @sigstore/bundle@^5.0.0
- @sigstore/protobuf-specs@^0.5.2
- @sigstore/verify@^4.1.2
- @types/proper-lockfile@^4.1.4
- chalk@^6.0.0
- cli-table3@^0.6.5
- commander@^15.0.0
- ora@^9.4.0
- proper-lockfile@^4.1.2
- semver@^7.8.1
show 8 more
- yaml@^2.9.0
- zod@^4.5.4
- @types/node@^22.19.19
- @types/semver@^7.8.0
- @vitest/coverage-v8@^4.1.0
- tsup@^8.5.1
- typescript@^5.9.3
- vitest@^4.1.0