Supply Chain Guard MCP Server

by homeofe Your server? Claim it

local only

Supply Chain Guard runs on your own machine — the client starts it, so there is no endpoint to ping. 1 696 installs a week from npm.

Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.

The linked repository no longer exists on GitHub — it was deleted or made private.

Installs per day peak 684 · avg 288 · +26% w/w

a month agotoday

1 696

Installs / week

npm · supply-chain-guard

—

Stars

on GitHub

—

Last commit

86 releases in 90 days

—

License

language unknown

What the code does

We have not read this server's code yet, 3 d ago · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Checks whether it runs in a sandbox src/broad-gap-pattern-matchers.ts:1332, src/patterns.ts:4095

        tokens: [String.raw`(?:GetTickCount|IsDebuggerPresent|NtQueryInformationProcess|CheckRemoteDebuggerPresent)`],

Runs an external command src/correlated-pattern-matchers.ts:866, src/safe-exec.ts:142

const HOSTILE_TRAP_OPERATION = /\b(?:eval)\s*\(|\bnew\s+Function\b|\bfetch\s*\(|\baxios(?:\.\w+)?\s*\(|\bXMLHttpRequest\s*\(|\bchild_process\s*\.\s*(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(|\bexecSync\s*\(|\batob\s*\(/g;

Builds a file path from a variable src/cache-dir.ts:86, src/internal-disclosure.ts:2216, src/lockfile-checker.ts:682 и ещё 1

  const target = path.join(cacheDir, fileName);

Touches key and credential files src/correlated-pattern-matchers.ts:1301, src/correlation-engine.ts:60, src/broad-gap-pattern-matchers.ts:707

const NPM_CREDENTIAL_PATH = /(?:\.npmrc(?![A-Za-z0-9_.\\/\-])|\bnpm_config_userconfig\b)/i;

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add supply-chain-guard -- npx -y supply-chain-guard

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "supply-chain-guard": {
      "command": "npx",
      "args": [
        "-y",
        "supply-chain-guard"
      ]
    }
  }
}

~/.codex/config.toml

[mcp_servers.supply-chain-guard]
command = "npx"
args = ["-y", "supply-chain-guard"]

.cursor/mcp.json

{
  "mcpServers": {
    "supply-chain-guard": {
      "command": "npx",
      "args": [
        "-y",
        "supply-chain-guard"
      ]
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "supply-chain-guard": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "supply-chain-guard"
      ]
    }
  }
}

Alternatives to Supply Chain Guard

same job, measured the same way

SkillTriage

by moorai

Scan AI agent skills, MCP server packages and MCP configs before you install them. Static analysis.

4 tools answering

Mund — MCP Security Scanner

by tyox-all

Scan for prompt injection, secrets, PII, and vet MCP servers before installation

94 installs/wk local only

Presend MCP Server

by presendapp

Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

40 tools answering

multichain-mcp

by wkalidev

MCP server for AI agents — Stacks, Celo, and Base in one npm package.

56 installs/wk local only

pkgxray

by adamsjack711-ux

Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.

63 installs/wk local only

ScriptProbe MCP

by thecompound

ScriptProbe: Check npm install scripts and publisher changes before installing.

local only

MCP Customs

by mcpcustoms

Inspect an MCP server for common security risks before you install it. Offline, zero telemetry.

43 installs/wk local only

Ecosystems

by pipeworx-io

ecosyste.ms Packages MCP.

425 installs/wk 47 tools answering

Supply Chain Guard — questions

Answers built from our own checks of this server.

Why is there no uptime for Supply Chain Guard?

Supply Chain Guard runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package supply-chain-guard was installed 1 696 times last week.

Is Supply Chain Guard still maintained?

The linked repository no longer exists on GitHub — it was deleted or made private. We show this because it changes what you can expect: an unmaintained server may keep answering for months and then stop without warning.

How do I connect Supply Chain Guard?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls supply-chain-guard straight from npm; nothing to host, nothing to sign up for.

How many people use Supply Chain Guard?

The npm package supply-chain-guard was installed 1 696 times in the last week. Week over week that is +26%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.