Skip to main content
Glama
deenesjakoruzh
wwb-bill

mcp-supply-guard

by wwb-bill
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

🧬 mcp-supply-guard

Python License CI No Dependencies

MCP 도구 정의 공급망 무결성. 2026년 보안 데이터 포인트: MCP 서버의 43%가 명령어 삽입 취약점을 가지고 있으며, 도구 정의는 승인 후 변형될 수 있습니다 — 러그 풀 벡터입니다. 이 라이브러리는 검토 후 도구 정의 콘텐츠 해시의 기준선을 잠그고, 이후 로드 시 검증합니다: 추가/제거/수정된 도구를 플래그하고, 명령 실행 위험 신호에 대한 위험 스캔을 수행합니다.

종속성 없음. 순수 Python 표준 라이브러리.

빠른 시작

pip install mcp-supply-guard

Related MCP server: commit-check-mcp

사용법

from mcp_supply_guard import load_tools, fingerprint, verify, scan_risk

baseline = [fingerprint(t) for t in load_tools("approved.json")]  # lock after review
report = verify(load_tools("current.json"), baseline)
print(report.clean)          # False if any tool added/modified
for f in report.findings:
    print(f.kind, f.tool, f.message)

risks = scan_risk(load_tools("current.json"))

CLI

mcp-supply-guard lock approved.json baseline.json
mcp-supply-guard verify current.json baseline.json --json    # CI exit 1 on added/modified
mcp-supply-guard risk current.json --json

tools.json

{"tools": [{"name": "search", "description": "Search the index",
            "inputSchema": {"type": "object", "properties": {"q": {"type": "string"}}}}]}

결과

Kind

Severity

Meaning

added

error

기준선이 잠긴 후 도구 추가됨

modified

error

정의 해시 변경됨 (러그 풀 벡터)

removed

warning

기준선 도구가 현재 없음

risky

error/warning

설명/스키마에 명령 실행 위험 신호

라이선스

MIT © wwb-bill

This server cannot be deployed

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • heddle

    goweft
    A
    license
    Not graded
    quality
    A
    maintenance
    Enables users to define and run MCP tools using declarative YAML configs with built-in trust enforcement, credential brokering, and tamper-evident audit logging.
    13
    MIT
  • commit-check-mcp by commit-check

    commit-check-mcpofficial

    commit-check
    A
    license
    A
    quality
    A
    maintenance
    Enables validation of commit messages, branch names, author info, push safety, and repository state using commit-check rules, accessible as MCP tools.
    8
    31 PyPI
    1
    MIT

  • mcp-sentinel

    IronNathanAlvares
    A
    license
    Not graded
    quality
    B
    maintenance
    A continuous, out-of-band trust and reliability layer for the MCP ecosystem. It fingerprints MCP server tool definitions, detects and classifies drift (e.g., rug pulls) via a severity taxonomy, maintains a hash-chained evidence ledger, and gates CI with SARIF—while also acting as an MCP server itself so agents can check a server's safety before binding.
    Apache 2.0

  • eidolon-gateway

    gegane-lutshaba
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP clients to govern downstream tool servers by enforcing default-deny authority and attestation on every tool call, with live monitoring, approval, and mid-session revocation.
    3
    Apache 2.0