mcpm

Open-source MCP security

Your MCP stack.
A clearer view.

Know more about the servers your agents use. Assess trust, verify package records, and inspect wrapped stdio traffic on your machine.

Get started Explore the source

Local-first. No account. No telemetry.

mcpm / command previewstdio workflow

# Discover a server

$ mcpm search filesystem

# Understand the trust evidence

$ mcpm why <server-name>

# Preview explicit protection

$ mcpm guard enable --dry-run
Real commands. No simulated scan results.

Configuration adapters for

Before install. At runtime.

Make the next decision
with evidence.

From the public registry to an explicitly wrapped server, keep the checks and their gaps in view.

Discover

Find the server. Read the signals.

Search the official MCP registry and inspect computed trust components, including checks that did not run.

mcpm search filesystem
Assess

Understand what is behind the score.

Review metadata findings before making an installation decision. Assessment does not execute the server or audit its source.

mcpm why <server-name>
Enroll

Choose runtime protection explicitly.

Preview configuration changes, then enable the stdio wrapper and restart the affected server. Installation alone does not enroll it.

mcpm guard enable --dry-run
Read the command guide

Security without the overclaim.

A guardrail.
With clear boundaries.

Useful evidence starts with being honest about what it can establish.

Read the coverage guide
Trust scores are signals, not guarantees.

A score is not a safety probability. Metadata checks do not execute servers, and matching package records do not prove safe behavior.

Guard covers wrapped stdio traffic.

Enable the wrapper and restart the affected server. HTTP/SSE servers have no runtime inspection from guard. Warnings forward traffic; blocks substitute an error.

The first observation becomes a baseline.

Tool pins use trust on first observation. Initial malicious definitions can become the baseline. Review actual changes before accepting drift.

Your machine. Your next step.

Start with one command.

Open source, under the MIT license. No model subscription required.

Follow the quick start
npm install -g @getmcpm/cli

Node.js ^22.22.2 || ^24.15.0 || >=26.0.0

Registry resolution and package checks contact the public MCP registry and npm.