github TypeScript analyzed cc2874b

getmcpm/cli

Runtime security guard for MCP servers, plus the package manager to install them. Search, install, audit, and guard across Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Gemini CLI.

maintainer: getmcpm
license: MIT
first seen: 2026-06-08
last seen: 2026-08-24
releases · 30d: 4
short id

Drift inferred · capture-to-capture

HIGH 2026-08-23 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-20 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-18 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-18 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-18 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-16 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-16 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-16 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-14 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-14 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-13 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-12 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-12 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-08-11 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-07-02 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-06-29 code analysis flagged hidden prompt content in getmcpm/cli
HIGH 2026-06-24 code analysis flagged hidden prompt content in getmcpm/cli

capabilities 9 tools

transport stdio verified reported listed in the official MCP registry counts 9 tools · 0 res · 0 prompts permission surface via code analysis

tools

mcpm_audit
mcpm_doctor
mcpm_info
mcpm_install
mcpm_list
mcpm_remove
mcpm_search
mcpm_setup
mcpm_up

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit cc2874b · analyzer v33 · 3d ago

skills & prompt files 1

hidden: agent-rules: tag-smuggling getmcpm-cli-cc2874b/CLAUDE.md :600 smuggled ascii: "gbsct"

danger signals8

suspicious endpoint 93.184.216.34 getmcpm-cli-cc2874b/src/__tests__/registry/publish-client.test.ts :180 expect(() => validateRegistryUrl("https://93.184.216.34")).not.toThrow();
suspicious endpoint 100.63.255.255 getmcpm-cli-cc2874b/src/__tests__/registry/publish-client.test.ts :181 expect(() => validateRegistryUrl("https://100.63.255.255")).not.toThrow();
suspicious endpoint 100.128.0.1 getmcpm-cli-cc2874b/src/__tests__/registry/publish-client.test.ts :182 expect(() => validateRegistryUrl("https://100.128.0.1")).not.toThrow();
suspicious endpoint 169.254.169.254 (cloud metadata) getmcpm-cli-cc2874b/src/registry/registry.test.ts :987 expect(() => new RegistryClient({ baseUrl: "https://169.254.169.254" })).toThrow(
committed secret GitHub token getmcpm-cli-cc2874b/src/guard/__tests__/fixtures/mcptox/attacks/credential-egress-github-pat.json :14 ghp_A1…(40 chars, redacted)
committed secret private key getmcpm-cli-cc2874b/src/guard/__tests__/fixtures/mcptox/attacks/credential-egress-private-key.json :14 PEM private key block (redacted)
committed secret GitHub token getmcpm-cli-cc2874b/src/guard/__tests__/patterns.test.ts :562 ghp_A1…(40 chars, redacted)
committed secret GitLab token getmcpm-cli-cc2874b/src/guard/__tests__/patterns.test.ts :640 glpat-…(53 chars, redacted)

code evidence vv0.30.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 244

filesystem 61

fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/diff.test.ts :6 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/export.test.ts :8 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/lock-integrity.test.ts :20 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/lock-provenance.test.ts :15 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/lock.test.ts :8 import { writeFile, mkdir, readFile } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/secrets-write.test.ts :8 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/up-frozen.test.ts :23 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/up-integrity.test.ts :23 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/up-shadow.test.ts :22 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/up-unguarded.test.ts :16 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/commands/up.test.ts :9 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/claude-code.test.ts :26 import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/claude-desktop.test.ts :19 import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/cursor.test.ts :19 import { readFile, writeFile, rename, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/gemini-cli.test.ts :26 import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/vscode.test.ts :18 import { readFile, writeFile, rename, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/windsurf.test.ts :18 import { readFile, writeFile, rename, lstat, unlink } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/adapters/write-safety.test.ts :16 import { mkdtemp, mkdir, readFile, writeFile, symlink, rm, lstat } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/config/detector.test.ts :22 import { access } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/engines-invariant.test.ts :50 import { existsSync, readFileSync, realpathSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/server/handlers-up.test.ts :17 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/smoke/cli-smoke.test.ts :18 import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/stack/schema.test.ts :13 import { writeFile, mkdtemp } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/store/atomic.test.ts :21 import { mkdtemp, readFile, writeFile, symlink, rm, lstat, mkdir } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/store/keychain-master-key.test.ts :18 import { readFile, rm } from "node:fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/__tests__/store/store.test.ts :27 import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises";
fs getmcpm-cli-cc2874b/src/commands/doctor.ts :19 import { access } from "fs/promises";
fs getmcpm-cli-cc2874b/src/commands/export.ts :158 import { writeFile as fsWriteFile } from "fs/promises";
fs getmcpm-cli-cc2874b/src/commands/lock.ts :477 import { writeFile } from "fs/promises";
fs getmcpm-cli-cc2874b/src/commands/publish/manifest.ts :6 import { readFile } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/commands/verify.ts :323 import { access } from "fs/promises";
fs getmcpm-cli-cc2874b/src/config/adapters/base.ts :11 import { readFile, writeFile, rename, mkdir, lstat, unlink } from "fs/promises";
fs getmcpm-cli-cc2874b/src/config/detector.ts :6 import { access } from "fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/cli-cleanup.test.ts :10 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/cli-confine.test.ts :9 import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/event-log.test.ts :6 import { mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/fp-rate.test.ts :21 import { readFileSync, readdirSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/inspect-relay-parity.test.ts :30 import { readFileSync, readdirSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/mcptox.test.ts :14 import { readFileSync, readdirSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/pins.test.ts :15 } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/policy.test.ts :6 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/store-integrity.test.ts :9 import { mkdtempSync, rmSync, writeFileSync, symlinkSync, readFileSync, existsSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/__tests__/unguarded.test.ts :14 import { mkdtempSync, rmSync, statSync, readFileSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/guard/confine/__tests__/store.test.ts :2 import { mkdtempSync, rmSync, writeFileSync, symlinkSync, mkdirSync, appendFileSync } from "node:fs";
fs getmcpm-cli-cc2874b/src/guard/confine/backend-macos.ts :19 import { existsSync } from "node:fs";
fs getmcpm-cli-cc2874b/src/guard/confine/store.ts :20 import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/guard/event-log.ts :13 import { appendFile, mkdir } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/guard/orchestrator.ts :17 import { copyFile } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/guard/pins.ts :34 import { readFile, writeFile, unlink } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/guard/policy.ts :21 import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
fs getmcpm-cli-cc2874b/src/guard/store-integrity.ts :21 import { lstat, rename, unlink, writeFile } from "node:fs/promises";
fs (weak) getmcpm-cli-cc2874b/src/registry/npm-provenance.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/registry/registry.test.ts :13 import { readFileSync } from "node:fs";
fs (weak) getmcpm-cli-cc2874b/src/registry/sigstore-verify.test.ts :1 import { readFileSync } from "node:fs";
fs getmcpm-cli-cc2874b/src/stack/env.ts :17 import { readFile } from "fs/promises";
fs getmcpm-cli-cc2874b/src/stack/schema.ts :9 import { readFile } from "fs/promises";
fs getmcpm-cli-cc2874b/src/store/atomic.ts :25 import { writeFile, rename, lstat, unlink } from "fs/promises";
fs getmcpm-cli-cc2874b/src/store/index.ts :10 import { readFile, mkdir } from "fs/promises";
fs getmcpm-cli-cc2874b/src/store/os-keychain.ts :27 import { readFile, writeFile } from "node:fs/promises";
fs getmcpm-cli-cc2874b/tsup.config.ts :2 import { readFileSync } from "fs";
fs getmcpm-cli-cc2874b/vitest.setup.ts :22 import { mkdtempSync } from "node:fs";

shell / exec 13

shell (weak) getmcpm-cli-cc2874b/src/__tests__/smoke/cli-smoke.test.ts :17 import { spawnSync, execSync } from "node:child_process";
shell (weak) getmcpm-cli-cc2874b/src/__tests__/store/os-keychain.test.ts :33 spawn(command: string, args: string[], opts: { env?: NodeJS.ProcessEnv }) {
shell getmcpm-cli-cc2874b/src/commands/doctor.ts :467 import { execFile } from "child_process";
shell getmcpm-cli-cc2874b/src/commands/guard.ts :418 // wrap-marker integrity at spawn (previously parsed here but dropped).
shell getmcpm-cli-cc2874b/src/commands/install.ts :140 // Blocks shell metacharacters: ; | $ ` & ( ) { } < > ! ' "
shell (weak) getmcpm-cli-cc2874b/src/guard/__tests__/relay.test.ts :16 import type { ChildProcess } from "node:child_process";
shell getmcpm-cli-cc2874b/src/guard/confine/store.ts :9 * spawn (run-inner) treats an unreadable store as "profile absent" and keys the
shell getmcpm-cli-cc2874b/src/guard/relay.ts :17 import { spawn } from "node:child_process";
shell getmcpm-cli-cc2874b/src/guard/run-inner.ts :51 * enable` time). Verified at spawn (warn-once on mismatch — see runInner). Absent
shell (weak) getmcpm-cli-cc2874b/src/scanner/health-check.test.ts :12 // Mock child_process.spawn
shell getmcpm-cli-cc2874b/src/scanner/health-check.ts :12 import { spawn } from "node:child_process";
shell getmcpm-cli-cc2874b/src/scanner/tier2.ts :214 const { execFile } = await import("node:child_process");
shell getmcpm-cli-cc2874b/src/store/os-keychain.ts :26 import { spawn } from "node:child_process";

network 2

net getmcpm-cli-cc2874b/src/registry/publish-client.ts :117 response = await fetch(url, {
net getmcpm-cli-cc2874b/src/stack/frozen-provenance.ts :178 // Fail-open fetch (offline / endpoint error) → can't re-check → re-run.

secrets 4

secrets (weak) getmcpm-cli-cc2874b/src/__tests__/commands/secrets-write.test.ts :270 delete process.env.SERVER_A_SECRET;
secrets (weak) getmcpm-cli-cc2874b/src/__tests__/server/handlers-up.test.ts :217 const original = process.env.API_TOKEN;
secrets getmcpm-cli-cc2874b/src/commands/publish/submit.ts :63 return process.env.GITHUB_TOKEN ?? process.env.MCPM_TOKEN ?? null;
secrets (weak) getmcpm-cli-cc2874b/src/scanner/health-check-env.test.ts :21 process.env.MY_COMPANY_SECRET = "supersecret"; // custom name a denylist would miss

tool registrations 9

mcpm_search getmcpm-cli-cc2874b/src/server/index.ts :82
mcpm_install getmcpm-cli-cc2874b/src/server/index.ts :91
mcpm_info getmcpm-cli-cc2874b/src/server/index.ts :100
mcpm_list getmcpm-cli-cc2874b/src/server/index.ts :109
mcpm_remove getmcpm-cli-cc2874b/src/server/index.ts :118
mcpm_audit getmcpm-cli-cc2874b/src/server/index.ts :127
mcpm_doctor getmcpm-cli-cc2874b/src/server/index.ts :136
mcpm_setup getmcpm-cli-cc2874b/src/server/index.ts :145
mcpm_up getmcpm-cli-cc2874b/src/server/index.ts :154

install hooks 1

prepublishOnly getmcpm-cli-cc2874b/package.json :25 npm run build

declared dependencies 20

@modelcontextprotocol/sdk@^1.30.0
@inquirer/prompts@^8.5.2
@sigstore/bundle@^5.0.0
@sigstore/protobuf-specs@^0.5.1
@sigstore/verify@^4.1.2
@types/proper-lockfile@^4.1.4
chalk@^6.0.0
cli-table3@^0.6.5
commander@^15.0.0
ora@^9.4.0
proper-lockfile@^4.1.2
semver@^7.8.1
yaml@^2.9.0
zod@^4.4.3
@types/node@^22.19.19
@types/semver@^7.8.0
@vitest/coverage-v8@^4.1.0
tsup@^8.5.1
typescript@^5.9.3
vitest@^4.1.0