Truecopy

What askalf/truecopy MCP server does

askalf/truecopy MCP server provides a supply-chain control layer for MCP servers and agent skills. It examines tool names, descriptions, and schemas for instruction-override and exfiltration patterns, then stores approved content hashes in truecopy.lock. The lock can also contain Ed25519 signatures when signing is enabled.

The project addresses two separate risks: malicious instructions hidden in tool metadata and silent changes to tools that were previously reviewed. A scan can identify suspicious content before installation, while later verification detects changes to pinned files. The repository describes the process as scan, pin, verify, and enforce.

How it works

Run scan against an MCP manifest, skill, or directory to inspect it for poisoning indicators. add performs the vetting step and records the selected source in the lockfile; it refuses a poisoned skill. verify rechecks every locked item for both drift and poisoning, returning a nonzero exit status when a check fails. diff, list, and remove help inspect or maintain the pinned set.

At runtime, askalf/truecopy MCP server can sit between an MCP client and a live server through the truecopy-mcp proxy. The proxy filters tools/list so that only pinned, unchanged, and unpoisoned tools are exposed. Calls to removed tools return a normal tool error. With --strict, any problem causes the whole server to be blocked instead of filtering individual tools.

Setup and configuration

Install the published package globally with npm i -g @askalf/truecopy, or use a pinned release such as @0.10.3. The README also documents installation directly from the GitHub repository. Commands can be run one at a time with npx -y @askalf/truecopy.

A typical workflow is to scan a manifest, add it to truecopy.lock, and run verification in CI. The runtime proxy accepts a lockfile, a server name, and a command used to start the wrapped MCP server. For example, the documented pattern uses truecopy-mcp --lock truecopy.lock --name filesystem -- followed by the server command.

On Windows with Git Bash, the README warns that MSYS path conversion can alter Unix-style paths. Setting MSYS_NO_PATHCONV=1 before execution avoids that conversion.

Tools and capabilities

• Scan MCP manifests, skills, or directories for suspicious instructions.
• Pin vetted content by hash in truecopy.lock.
• Add optional Ed25519 signatures to pinned entries.
• Verify drift and rerun poisoning checks, including in CI.
• Show changes, list pins, and remove deprecated lock entries.
• Launch a command only after the lock passes with guard.
• Proxy an MCP server while filtering unapproved or changed tools.
• Install a Claude Code hook and pin Claude Code skill scopes, including marketplace plugins.
• Compare installed skills with a published directory manifest using check-manifest.

Limitations and notes

The checks are deterministic and offline after required manifests or sources are available locally. A hash match does not by itself mean that a skill is endorsed: the documented directory-manifest workflow separately treats watch-flagged skills as failures. Skills that are unlisted in the manifest are reported but are not fatal in that workflow.

The proxy protects the tools it can evaluate against the supplied lockfile; it does not replace runtime containment. The README identifies redstamp as the separate project for containing tool calls. The project was formerly named canon, and legacy canon and canon-mcp command aliases remain available according to the README.