mcpm

A runtime security guard for your AI's tools -- and the package manager to install them. Blocks prompt injection, tool poisoning, and credential exfiltration in live MCP traffic. Local-first, deterministic, no LLM in the enforcement path.

The risky part of an MCP server doesn't show up at install -- it shows up while your agent is running: prompt injection hidden in a tool's output, a server that quietly rewrites its tools after you approved them, a sampling request that smuggles instructions into your model. Being listed in a registry is not a safety signal -- in 2026 a proof-of-concept poisoned server was accepted by 9 of 11 public registries and marketplaces. So mcpm scores every install for hardcoded secrets, prompt injection, and typosquatting -- then runs a live guard between your AI client and each server, pinning tool definitions against rug-pulls and blocking injection before it reaches the model.

You don't have to take our word for any of that. Guards are easy to claim and hard to check, so the measuring stick is public: mcp-guardbench is a guard-agnostic benchmark -- versioned attack and benign cases, an open schema, and a runner that scores any MCP guard through its own published CLI. mcpm is scored the same way as everyone else, by shelling out to mcpm guard inspect, never by importing its own engine.

mcpm currently scores 100% recall at a 0% false-positive rate on that corpus -- which is by construction, since the corpus was extracted from mcpm's own test fixtures. That is a baseline, not a boast. It gets interesting when someone scores a second guard, or contributes a case mcpm misses.

Quick start

Install with the package manager you already use:

Requires Node ^22.22.2 || ^24.15.0 || >=26.0.0 — that is 22.22.2+, 24.15.0+ or 26+, the intersection of what every runtime dependency itself supports. Everything else is excluded, 23.x and 25.x included. npm warns EBADENGINE and fails outright under --engine-strict; pnpm installs silently and exits 0 unless you set engine-strict=true, so there an unsupported Node surfaces as a runtime error rather than an install one.

The binary is mcpm. Heads up: the mcpm Homebrew formula is a different, unrelated project (mcpm.sh) — install this mcpm via npm/npx/pnpm/mise above (all resolve the scoped @getmcpm/cli package, so there's no name collision). A dedicated Homebrew tap is deferred; see docs/DISTRIBUTION.md.

mcpm search filesystem
mcpm info io.github.domdomegg/filesystem-mcp
mcpm install io.github.domdomegg/filesystem-mcp

Features

Search the MCP registry

Query the official MCP Registry and see results with trust indicators.

$ mcpm search filesystem

  Name                                    Description                   Version  Transport  Status
  io.github.domdomegg/filesystem-mcp       File system access via MCP    1.4.0    stdio      active
  io.github.Digital-Defiance/mcp-filesystem Read-only filesystem server  0.9.2    stdio      active
  ...

Search shows registry lifecycle status, not a trust score -- it is a fast discovery list and does not run the scanner per result. Computed trust lives in mcpm why, info, install, and audit.

Install with trust assessment

Every install runs a metadata-based trust assessment before writing config.

$ mcpm install io.github.domdomegg/filesystem-mcp

  ███████████████░░░░░ 57/80 CAUTION
    ├─ Health check: not yet run
    ├─ Tool descriptions: score 32/40
    ├─ Package: publisher verification passed
    └─ External scan: not available (set MCPM_EXTERNAL_SCANNER for deeper analysis)

  Install to Claude Desktop? (Y/n)

Audit installed servers

Scan everything you have installed. Get a trust report.

$ mcpm audit

  Server                                   Score  Level    Findings
  servers-filesystem                        72/80  safe     0
  servers-github                            52/80  caution  2
  some-sketchy-server                       24/80  risky    5

Cross-IDE support

One tool for all your AI clients. mcpm reads and writes the correct config format for each.

$ mcpm list

  Client            Server Name                  Status     Command/URL
  Claude Desktop    servers-filesystem           active     npx -y servers-filesystem
  Claude Desktop    servers-github               active     npx -y servers-github
  Cursor            servers-fetch                disabled   npx -y servers-fetch

Doctor: check your MCP setup health

Find misconfigurations, missing runtimes, broken servers, and plaintext secrets pasted into client config.

$ mcpm doctor

  Checking MCP setup...
  [pass] Claude Desktop config found
  [pass] npx runtime available
  [warn] Cursor config not found
  [pass] 3 servers installed, 0 with errors
  [warn] plaintext secret (advisory): github-mcp · env 'GITHUB_TOKEN' — GitHub token
         Move it to the encrypted store: mcpm secrets set <server> <KEY>

The plaintext-secret scan reports the key name and label only — never the value — and skips values already stored as mcpm:keychain: placeholders. It's advisory (never fails doctor).

Stack files: docker-compose for MCP

Declare your project's MCP servers in mcpm.yaml, lock versions with trust snapshots, and let every team member replicate the setup with one command.

mcpm export > mcpm.yaml          # dump current setup
mcpm lock                        # resolve versions + trust snapshot
mcpm up                          # install everything from mcpm.yaml
mcpm diff                        # compare installed vs declared state

Stack files include a trust policy. If a server's trust score drops below the threshold, mcpm up blocks it.

version: "1"
policy:
  minTrustScore: 60
  blockOnScoreDrop: true
servers:
  io.github.domdomegg/filesystem-mcp:
    version: "^1.0.0"
  io.github.modelcontextprotocol/servers-github:
    version: "1.2.3"
    env:
      GITHUB_TOKEN: { required: true, secret: true }

Scaffold a stack file

Start a new project's MCP setup in one command. mcpm init writes a starter mcpm.yaml you fill in with servers from mcpm search.

$ mcpm init

  Created mcpm.yaml.

  Next steps:
    mcpm search <query>   find MCP servers in the registry
    edit mcpm.yaml        add them under `servers:`
    mcpm lock             resolve and lock versions
    mcpm up               install from the stack file

It refuses to clobber an existing mcpm.yaml (pass --force to overwrite). mcpm deliberately doesn't ship curated packs — blessing specific community servers is a trust decision a security tool shouldn't bake in.

Trust score

The trust score is a 0-100 assessment based on publicly available metadata. It is not a source code audit.

What it checks:

Levels are a ratio of the points available, not absolute: safe at 80% of maxPossible or better, caution at 50-79%, risky below 50%. With no external scanner (maxPossible 80) that puts safe at 64 points, not 80.

mcpm audit shows clean · not run where the server cleared every check that actually ran and the only unmeasured component is the health check — audit never executes servers, so that bucket scores a flat 15/30 and would otherwise drag every flawless server into caution. It is a statement about what mcpm did (found nothing, ran nothing), deliberately weaker than safe, which is reserved for servers whose health check really ran.

Without an external scanner, the maximum possible score is 80/100 and the bucket is dropped from the total rather than counted as a failure. The static scan catches common patterns but cannot detect all vulnerabilities. Treat the score as a signal, not a guarantee.