# askalf/truecopy [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/askalf/truecopy  
**GitHub Stars:** 1  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/askalf-truecopy

## Description
Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "truecopy": {
    "command": "npx",
    "args": ["-y","@askalf/truecopy"]
  }
}
```

## Documentation

## What askalf/truecopy MCP server does

askalf/truecopy MCP server provides a supply-chain control layer for MCP servers and agent skills. It examines tool names, descriptions, and schemas for instruction-override and exfiltration patterns, then stores approved content hashes in `truecopy.lock`. The lock can also contain Ed25519 signatures when signing is enabled.

The project addresses two separate risks: malicious instructions hidden in tool metadata and silent changes to tools that were previously reviewed. A scan can identify suspicious content before installation, while later verification detects changes to pinned files. The repository describes the process as scan, pin, verify, and enforce.

## How it works

Run `scan` against an MCP manifest, skill, or directory to inspect it for poisoning indicators. `add` performs the vetting step and records the selected source in the lockfile; it refuses a poisoned skill. `verify` rechecks every locked item for both drift and poisoning, returning a nonzero exit status when a check fails. `diff`, `list`, and `remove` help inspect or maintain the pinned set.

At runtime, askalf/truecopy MCP server can sit between an MCP client and a live server through the `truecopy-mcp` proxy. The proxy filters `tools/list` so that only pinned, unchanged, and unpoisoned tools are exposed. Calls to removed tools return a normal tool error. With `--strict`, any problem causes the whole server to be blocked instead of filtering individual tools.

## Setup and configuration

Install the published package globally with `npm i -g @askalf/truecopy`, or use a pinned release such as `@0.10.3`. The README also documents installation directly from the GitHub repository. Commands can be run one at a time with `npx -y @askalf/truecopy`.

A typical workflow is to scan a manifest, add it to `truecopy.lock`, and run verification in CI. The runtime proxy accepts a lockfile, a server name, and a command used to start the wrapped MCP server. For example, the documented pattern uses `truecopy-mcp --lock truecopy.lock --name filesystem --` followed by the server command.

On Windows with Git Bash, the README warns that MSYS path conversion can alter Unix-style paths. Setting `MSYS_NO_PATHCONV=1` before execution avoids that conversion.

## Tools and capabilities

- Scan MCP manifests, skills, or directories for suspicious instructions.
- Pin vetted content by hash in `truecopy.lock`.
- Add optional Ed25519 signatures to pinned entries.
- Verify drift and rerun poisoning checks, including in CI.
- Show changes, list pins, and remove deprecated lock entries.
- Launch a command only after the lock passes with `guard`.
- Proxy an MCP server while filtering unapproved or changed tools.
- Install a Claude Code hook and pin Claude Code skill scopes, including marketplace plugins.
- Compare installed skills with a published directory manifest using `check-manifest`.

## Limitations and notes

The checks are deterministic and offline after required manifests or sources are available locally. A hash match does not by itself mean that a skill is endorsed: the documented directory-manifest workflow separately treats watch-flagged skills as failures. Skills that are unlisted in the manifest are reported but are not fatal in that workflow.

The proxy protects the tools it can evaluate against the supplied lockfile; it does not replace runtime containment. The README identifies `redstamp` as the separate project for containing tool calls. The project was formerly named `canon`, and legacy `canon` and `canon-mcp` command aliases remain available according to the README.

_Full upstream README: https://allmcps.com/mcp/askalf-truecopy/readme_