Work / Supply-chain security
sealpin
npm audit for the MCP servers your AI agent trusts. A supply-chain and prompt-injection scanner that finds which servers can read your SSH keys, which changed their tool definitions since you approved them, and which hide instructions to the model inside tool descriptions.
- Status
- published
- Period
- v1, pre-release
- Stack
- TypeScriptStatic analysisMCPSandboxed probingJSON-RPC proxy
- The crux
- The lockfile, not the linter — a scan runs once, a pinned manifest defends against the rug pull forever.
The gap
Adding a server to an MCP config executes arbitrary code, hands it your environment variables, and lets it inject text into your model’s context as trusted tool documentation — with no re-review when the package updates. There is no signing, no permission manifest, and no standard way to notice that a server’s tool definitions changed after you approved them.
npm audit and Snyk cannot see prompt-layer attacks at all. To them, a tool description is just a string.
The lockfile is the point
A linter runs once; a lockfile lives in the repo forever. Locking canonically hashes every server’s full tool manifest — names, descriptions, schemas, annotations — and pins it. Verifying re-hashes and exits non-zero on drift; diffing shows the human-readable changeset.
Canonicalization is order-independent and whitespace-normalized, so reordering tools or reflowing a description doesn’t register as drift. Only a real change to what the model is told does.
From scanner to control plane
Scanning observes. The proxy enforces — a transparent stdio layer between client and server that mediates every JSON-RPC message. On a tool call it evaluates policy and blocks before the server ever sees the request; on a tool listing it strips tools whose definitions drifted from the lockfile, which is rug-pull defense at runtime rather than at review time.
17 rules span prompt-layer, capability and supply-chain attacks: descriptions that instruct the model rather than document the tool, zero-width and bidirectional-override characters, filesystem servers rooted at a drive root or home directory, plaintext credentials, typosquats at edit-distance one, install scripts, interpolated child-process calls. Two composition rules matter most — the lethal trifecta of private data, untrusted content and exfiltration capability in one context, and an untrusted-content server sharing a context with command execution.
Next — PayHub