Tools / MCP Supply Chain Checker
MCP Supply Chain Checker
Paste an MCP config and get a static triage for the supply-chain failure modes that actually get exploited: unpinned versions, auto-install flags, mutable sources, secrets in env blocks, and standing authorizations. Runs entirely in your browser; nothing is uploaded.
Paste a .mcp.json, ~/.claude.json, or any config fragment. This is a first-pass triage, not a scanner: it flags known supply-chain patterns and deliberately avoids false positives. It cannot tell you whether a package is malicious — pinning versions is the control, and this tool shows you where you're missing it.
- Auto-install flagHigh
`@somepkg/mcp-server` is installed with -y/--yes — it fetches whatever is current at run time without asking.
Line 4
Fix — Remove -y/--yes and pin an exact version so installs are deterministic and reviewable.
- Unpinned package versionHigh
`@somepkg/mcp-server` has no version pin — the package can change between runs, and a compromised release becomes your agent's code.
Line 4
Fix — Pin an exact version, e.g. `@scope/pkg@1.2.3` instead of `@scope/pkg`.
- Standing authorization (autoApprove)High
mcpServers.fetch has autoApprove set — the server can call tools without asking. A compromised or malicious server gets a blank check.
Line 4
Fix — Remove autoApprove, or scope it to read-only tools you trust explicitly.
- Unpinned package versionHigh
`@modelcontextprotocol/server-filesystem@latest` has no version pin — the package can change between runs, and a compromised release becomes your agent's code.
Line 12
Fix — Pin an exact version, e.g. `@scope/pkg@1.2.3` instead of `@scope/pkg`.
- Standing authorization (autoApprove)High
mcpServers.filesystem has autoApprove set — the server can call tools without asking. A compromised or malicious server gets a blank check.
Line 12
Fix — Remove autoApprove, or scope it to read-only tools you trust explicitly.
- Standing authorization (autoApprove)High
`autoApprove` lets the server call tools without asking — a compromised or malicious server gets a blank check.
Line 9
Fix — Remove autoApprove, or scope it to read-only tools you trust explicitly.
- Standing authorization (autoApprove)High
`autoApprove` lets the server call tools without asking — a compromised or malicious server gets a blank check.
Line 14
Fix — Remove autoApprove, or scope it to read-only tools you trust explicitly.
- Explicit @latest tagMedium
`@latest` means every run can pull a different version — the exact failure mode supply-chain attacks exploit.
Line 13
Fix — Pin an exact version instead of @latest.
// About this tool
MCP Supply Chain Checker
MCP servers are code that runs on your machine with your agent's credentials. When a config says npx -y @somepkg/mcp-server with no version pin, every run fetches whatever is current — and a compromised release becomes your agent's code. This tool flags exactly those patterns: unpinned package versions, -y/--yes auto-install flags, mutable sources (git URLs, tarballs, github: shorthand), explicit @latest tags, secrets sitting in env blocks, and standing authorizations like autoApprove.
It runs a structural pass when the input parses as JSON — so findings carry the server name (mcpServers.fetch) — and a text-level pass for JSONC, YAML, and config fragments. Findings are deduplicated and sorted by severity, with a concrete remediation for every finding.
This is deliberately conservative: it flags patterns, not intent. A pinned package can still be compromised upstream — the pin just shrinks the window. Treat the result as a starting triage, not a clean bill of health.
// When to use it
Audit a config before wiring it into your agent
Paste your .mcp.json and check for unpinned npx/uvx commands, -y flags, and secrets in env blocks before the server gets access to your environment.
Review a config inherited from a teammate or template
Quickly see which supply-chain risks a config you didn't write actually contains — unpinned versions and auto-install flags are the ones that bite.
Pair with the AI Agent Config Checker
This tool covers the supply chain; the Agent Config Checker covers secrets and permissions. Run both on the same config for the full picture.
// Questions
Is my config uploaded to a server?
No. The scan runs entirely in your browser via JavaScript. Nothing is uploaded, logged, or transmitted — which is why it's safe to paste configs that contain real-looking secrets.
What does this tool detect?
Unpinned package versions (npx/uvx without @version), auto-install flags (-y/--yes), mutable sources (git URLs, tarballs, github: shorthand), explicit @latest tags, secrets in env blocks (OpenAI, Anthropic, AWS, GitHub, Slack, Google keys, private keys, DB URIs with passwords, bearer tokens), and standing authorizations (autoApprove, alwaysAllow).
What does this tool NOT detect?
Whether a package is actually malicious. Static checks can't tell you that a pinned package was compromised upstream — they can only show you where you're missing the controls that make compromise survivable. This is a conservative triage, not a clean bill of health.
Is this tool free?
Yes. Free, runs locally in your browser, no account required.
What config formats does it accept?
Strict JSON gets a structural pass with server names; JSONC, YAML, and config fragments fall back to text-level heuristics. Paste any of them and the same checks run.