mcp-provenance-scanner

“npm audit, but for your agent’s tool supply chain.”

MCP (Model Context Protocol) servers are installed from npm/PyPI with almost no provenance verification — and in 2026 no comprehensive MCP security platform exists. Your agent’s capabilities are only as trustworthy as the servers behind them. mcp-provenance-scanner reads your MCP server configs and reports what each server actually is: where its code comes from, whether the version is pinned, what credentials it touches, and what network endpoints it reaches — plus honest, labeled heuristic risk findings.

The problem

A typical Claude Code / Claude Desktop setup pulls in a dozen MCP servers with one-click installs. Each entry is a standing grant of trust: arbitrary code running next to your agent, often with API keys in the same config file, often pinned to nothing (npx -y some-server resolves to latest on every run). A compromised or typosquatted package updates silently and your agent keeps calling it. Nobody maps this.

Install

Zero dependencies — Python 3.8+ stdlib only. No package manager needed.

git clone https://github.com/Iceman2050/mcp-provenance-scanner.git
cd mcp-provenance-scanner
python3 mcp_provenance_scanner.py --help

Usage

Scan the well-known configs (Claude Code ~/.claude.json, Claude Desktop claude_desktop_config.json):

python3 mcp_provenance_scanner.py

Scan a specific config file (handy for testing / CI):

python3 mcp_provenance_scanner.py --config /path/to/claude.json --config other.json

Machine-readable output:

python3 mcp_provenance_scanner.py --json

For each server the tool reports:

Heuristics (labeled as such)

• Floating version → higher risk. npx -y pkg or pkg>=0.5 can change behavior on the next run without you noticing.
• Remote-URL server → higher risk. SSE/HTTP servers run off-machine; you trust the operator, not just the package.
• Env vars named *KEY / *TOKEN / *SECRET / … → sensitive. Flagged by name; values are never collected or printed.
• Local-path servers → lower supply-chain risk. A file on disk can’t be swapped by a registry compromise (it can still be malicious — review it).

Example output

Server         Transport  Registry  Package                                  Pinning   Risk