Smallprint Action README

Small Print (MCP)

Listed on M8ven: https://m8ven.ai/mcp/gostanos-smallprint-action-12nii2

Small Print keeps a record of the text that MCP servers, agent skills and plugins give your AI agent, and tells you when a change is graded high or critical. It fetches the lists of the public registries, reads the new versions it can, and grades each change it finds by a written rule: https://smallprint.dev.

• Get an email in the next daily brief after a change to something you use is graded high or critical. Sign up with just your email address at https://smallprint.dev/start, from the watch box on any entry's page, or by typing it when npx smallprint check asks. Pin the servers and skills you use; by default the daily brief shows changes graded high or critical and high or critical advisories, by email or Discord, and choosing everything in settings brings every change. No password, and no credit card required.
• Check what your agents have installed, free and with no account: npx smallprint@1.5.2 check --no-upload prints what it found and sends nothing; without the flag it asks before sending names and versions to get grades. Or paste a config file at https://smallprint.dev/check.
• Plans: New accounts get 30 days of Pro, no credit card required. What each plan includes, and the prices, are at https://smallprint.dev/pricing.
• New to this? A step-by-step guide in plain words: https://smallprint.dev/guide

The grading rules are printed at https://smallprint.dev/how-we-grade.

What is in this repository

• This Action fails a build when a repository's MCP server versions, skill files or instruction files differ from its lock.
• npx smallprint gate asks the record before a session whether a change to the small print of each server here that has a registry name is on record since the lock, or a high or critical advisory covers the version here; exit codes for a shell hook. CLI 1.5.2.
• mcp/: smallprint-mcp, an MCP server with four read-only tools over the public record (npx -y smallprint-mcp; registry name dev.smallprint/smallprint).
• Dockerfile builds and runs that server over stdio, for registries that start a server to check it answers.
• cli/: the source of the smallprint command, from which the npm package is built, with its tests. npx smallprint@1.5.2 check --no-upload prints what it found and sends nothing.
• vscode/: the Small Print extension for VS Code and Cursor, the same files that go to the stores.
• tools/verify-chain.mjs: checks the record chain from the public API: every link, every signature, and the entries hash of every day whose lines are kept; node tools/verify-chain.mjs. Rows written before 4 October 2026 link, and their entries cannot be recomputed.

Small Print check, as a GitHub Action

Fails the build when an MCP server's version, a skill's files or an instruction file such as CLAUDE.md, AGENTS.md or an .mcp.json differs from a lock you committed.

- uses: gostanos/smallprint-action@v1.18

Write the lock from the repository's directory on a machine that has the intended configuration, with --project so it holds only what lives in the repository (the .mcp.json, the .claude/ and .cursor/ folders, CLAUDE.md, AGENTS.md and the rest), and commit it:

npx smallprint lock --project
git add smallprint.lock

To see it working, gostanos/smallprint-demo passes on its main branch, and its open pull request fails because it changes the filesystem server from version 2026.7.4 to 2026.7.10, and the lock check names that change. The check compares versions and file fingerprints; it does not read tool descriptions.

The check is local: it reads the repository's config and instruction files, compares them with the lock, and sends nothing anywhere. It exits 2 when something changed and prints what. When the change is yours, run npx smallprint lock --project again and commit. A lock written without --project also holds the machine's home-directory entries, which a CI runner does not have, so that check would fail on every run; the lock records which kind it is and the check honours it.

Inputs: lockfile (default smallprint.lock), version (the CLI version, default 1.5.2).

With a code-scanning upload

The step can write what changed as a SARIF log, and GitHub's upload-sarif action turns each line into a code-scanning alert on the pull request. Needs the --sarif flag, which is in smallprint 0.1.4 and later. The upload needs the security-events: write permission, and if: always() lets it run after the check has failed, so the build still fails when something changed.

    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: gostanos/smallprint-action@v1.18
        with:
          sarif: smallprint.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: smallprint.sarif

As a pre-commit hook

With pre-commit, the same check runs before every commit, offline. Add this to .pre-commit-config.yaml in the repository that holds the lock:

repos:
  - repo: https://github.com/gostanos/smallprint-action
    rev: v1.18
    hooks:
      - id: smallprint-locked   # runs smallprint check --locked; the commit stops when anything differs from the lock
      - id: smallprint-lock     # only when you ask: pre-commit run smallprint-lock --hook-stage manual

The hooks run the pinned version of the command with npx, so the machine needs Node 20 or later.