Approve an agent's tools with evidence, not a glance. One paste turns a server config or skill manifest into a verdict, the rule behind each finding and the exact fix, before the agent has the credentials.
MCP and skills supply chain
MCP and Skills Supply Chain Checker
Read from the real rules, not invented. Every answer MCP Supply Chain Checker gives points to the official rule behind it, so you can check any line yourself. Read from NIST SP 800-161 Rev 1, the EU Cyber Resilience Act, UK Cyber Essentials and the ASD Strategies to Mitigate Cyber Security Incidents.
Read from the real rules40 official rules behind itLinked to related standardsCheck any line yourself
Paste an MCP server config or a skills manifest. You get a verdict, every finding with the rule behind it, and the fix, before the agent runs.
JSON (Claude, Cursor, VS Code), a skills manifest, a SKILL.md, the inventory CSV from /kit/, or one server per line. Nothing leaves the browser until you save.
What does an MCP supply chain check look for?
It looks at seven things the manifest already carries: where the server or skill came from and whether its version is pinned; the filesystem and network scope it asks for; whether it runs in a sandbox; whose identity it uses; whether the package name is the real one; whether tool calls are logged; and whether the instructions hide or override something.
The check reads the file, not the running process. That is deliberate: the decision to approve happens before the process exists, and the manifest is the only artefact every harness shares.
Why are skills and MCP servers the new npm?
Because an agent installs code from a stranger and then runs it with your credentials. In The AI Native Dev episode published on 20 October, Manoj Nair of Snyk put the new supply chain beside the old one: "skills and MCP servers are the new NPM of these agents", and "three lines of English can be malware". The intent of a skill is now a security question, not a documentation question.
The episode describes a 50,000-agent Claude Code rollout pulled forward by weeks, and the enterprise answer that followed: skills scanning and MCP scanning, a secure sandbox such as Docker, and separate identities for agents, at a minimum each agent treated as a teammate with its own identity and locked out of the open internet. It also names the behavioural risk with the PocketOS case, where an over-permissioned agent deleted a production database. The manifest is where all three risks become visible at once.
Read the longer answer, with the timestamps and the sources.
What comes back from a paste?
A verdict, the severity counts, what was checked, and one finding per affected entry. Each finding carries the rule, the evidence from your own file, why it matters, the fix and the official rule behind it. This is the shape, using the specimen:
| Rule | What it saw | What to do |
|---|---|---|
| SC-09 Known-malicious or lookalike package | A package name one character from the official filesystem server | Copy the name from the publisher's page, not from a suggestion |
| SC-06 Instructions download or execute code | A base64 decode piped into a shell in the skill text | Remove the instruction; vendor and review the code |
| SC-08 Agents share one identity | Two tools using the same token, one marked shared | Give each agent and server its own short-lived credential |
| SC-04 Broad filesystem scope | A root directory and a home directory grant | Grant the one directory the task needs, read-only |
| SC-10 No audit logging | Six entries with no log destination | Name the destination, the retention and the owner |
| SC-02 Version not pinned | latest, a range and a bare package name | Pin an exact version or a commit hash |
The specimen is a deliberately bad set of eight entries. Press Load a specimen above to run it and open each finding.
Which manifests can I paste?
- MCP config JSON. The
mcpServersblock from Claude Desktop or Claude Code, theserversblock from VS Code and Cursor, or a single server object. - Skills manifest JSON. A list under
skills, with permissions, allowed tools, sandbox, identity and logging where you record them. - A SKILL.md. The YAML front matter plus the instruction body, which is where the hidden and override text lives.
- The inventory CSV. The template from /kit/, with one row per server or skill. Fill it in and paste it back.
If your harness does not export a manifest, use the CSV. It carries the same fields the checker reads, so a team can review a fleet without installing anything.
A line that cannot be parsed is named by line number. The checker never guesses a server into existence to make a report look complete.
What does it check, rule by rule?
| Rule | Family | Severity | The question it answers |
|---|---|---|---|
| SC-01 Server or skill source is not verified | Source | High | Who published this, and where can I check it? |
| SC-02 Version is not pinned | Source | High | Can the code change after I approve it? |
| SC-03 Remote connection is not encrypted | Source | High | Can someone read or change the traffic between the agent and the server? |
| SC-04 Skill asks for a broad filesystem scope | Scope | Critical | What on this machine can the skill read or write? |
| SC-05 Skill has unrestricted network access | Scope | High | Where can this skill send data? |
| SC-06 Instructions download or execute code | Instructions | Critical | Does the skill ask the agent to run something it fetched? |
| SC-07 No sandbox isolation | Isolation | High | Does this server run on the host or in a container? |
| SC-08 Agents share one identity | Identity | Critical | If one agent goes wrong, whose access does it have? |
| SC-09 Known-malicious or lookalike package name | Package | Critical | Is this the package it claims to be? |
| SC-10 No audit logging | Logs | High | After an incident, what will tell you what the agent did? |
| SC-11 Hidden or override instructions | Instructions | Critical | Does the skill say one thing and instruct another? |
| SC-12 Destructive tool is over-permissioned | Identity | Critical | Could this agent delete or overwrite something that matters? |
| SC-13 Secret is stored in the config | Package | Critical | Is a live credential sitting in plain text? |
| SC-14 Destructive actions are auto-approved | Isolation | High | Will a person see this before it happens? |
| SC-15 Third-party content can steer the agent | Scope | Medium | Can something the skill reads give it orders? |
Every rule in full, with the official rule behind it and the four markets.
What it will not tell you
It does not run the server, open the package, inspect network traffic or watch what the agent does. It does not know whether a publisher is honest; it knows whether you recorded who they are and what you checked. A clean report means no rule fired on this manifest, not that the tool is safe.
It does not replace an allowlist or an agent security platform. It is the cheap, fast reading you do before either of them sees the manifest, and the record you keep afterwards.
It does not scan package code for vulnerabilities: that is an SCA scanner's job. It does not give legal advice on the Cyber Resilience Act or any other regime. It cites the official rule it read and leaves the judgement to you.
Every limit is repeated on the method page and in the report itself.
How is this different from an agent security platform?
| Approach | What it needs | What it gives you | Where it fits |
|---|---|---|---|
| This checker | A paste. No agent, no install, no account for the first result | A verdict, findings, the rule behind each, the fix, a dated note | The five minutes before approval, and the record after it |
| A fleet platform (Snyk Evo, Bifrost Edge, an agent gateway) | An agent on every machine and a control plane | Live inventory across the fleet, policy enforcement, runtime blocking | Once you know what you are approving, and you need it enforced |
| A manual review | A senior engineer and a checklist | Judgement, with no record and no repeatability | The cases the rules do not cover |
| An SCA scanner | The package source and a build | Known vulnerabilities in dependencies | After the package is chosen |
The honest answer: buy the platform when you need enforcement at fleet scale. Use this when you need a decision now, a repeatable rule set, and something to attach to the ticket.
Who is it for?
A security engineer or platform engineering lead at a mid-market firm that has put coding agents into more than one team. They hold the budget for the rollout or sit beside the person who does. They are asked "can we approve this?" in a pull request or a review meeting, and they need one sentence and the evidence behind it.
It is also for the developer on the other side of that question: the report gives the exact fix, so the pull request moves instead of stalling.
What does it cost?
Report
USD 149
One manifest, one payment
- The full findings report
- Markdown, CSV, JSON and the approval note
- One saved record
Watch, monthlyMost teams
USD 99
A month
- Up to 50 saved manifests
- The estate view, ranked by verdict
- Every export, every re-check
- Rule updates as new attacks publish
Watch, yearly
USD 990
A year, two months free
- Everything in the monthly watch
- One invoice for the year
- The same saved estate
One click to checkout: card, Apple Pay or Google Pay, and your account is created from the email you give there, no sign-up form and no link to wait for. The check itself is free and does not need an account. Compare the plans in full.
Where do the rules come from?
The checks are a reading of the 20 October episode with Manoj Nair, plus the public research that names the attack shapes: the Snyk ToxicSkills audit of 3,984 agent skills, the OWASP MCP Security Cheat Sheet and the MCP security best practices page. Each rule cites its source on the rules page and in the report.
The official rule behind each check comes from the standards and laws we read: NIST SP 800-161 Rev 1 for supply chain risk in the United States, the EU Cyber Resilience Act, UK Cyber Essentials and the ASD Strategies to Mitigate Cyber Security Incidents in Australia. The four market sections say which requirement applies where.
Questions buyers ask
Does the checker send my config anywhere?
No. Parsing and checking run in your browser. Nothing is sent until you choose to save a report to an account, and the page says so before you press the button.
What is a good result?
One of four verdicts: Not ready to approve, Fix before approving, Review before approving, or No blocking findings. The last one means no rule fired on this manifest; it is not a guarantee that the tool is safe.
Can I check a SKILL.md as well as a config?
Yes. Paste the front matter and the instruction body. Hidden and override instructions are read from the body, which is where the toxic skills in the public research carried their payload.
Does it need an agent or a GitHub connection?
No. It reads a paste. The paid watch stores manifests you choose to save; the free check is complete without an account.
Is it a scanner like Snyk or an agent gateway?
No. It is the approval check before those tools: a paste, a verdict, the rule behind each finding and a dated note. It does not run, block or monitor.
What happens when a rule changes?
The changelog records the rule, the date and what changed. Saved manifests can be re-checked against the new rule set.
Can I use my own allowlist?
Yes. Paste the names your house policy allows into the allowlist field in the workspace and run again; anything not on it is reported.
Is the price per person?
No. A report covers one manifest. The watch covers up to 50 saved manifests for the team that holds the account, however many people review them.
The rules this is built from
Nothing here is invented. The checker reads the official rules listed below, by market, and every answer points to the one it came from. The same rules are linked to related standards, the way a security team checks them.
| Market | Standard or law | What it holds |
|---|---|---|
| US | NIST SP 800-161 Rev 1 | 191 controls across 20 domains |
| EU | EU Cyber Resilience Act | 140 controls across 11 domains |
| UK | UK Cyber Essentials | 36 controls across 6 domains |
| AU | ASD Strategies to Mitigate Cyber Security Incidents | 37 controls across 5 domains |
40 official requirements sit behind the 15 checks. See the four market sections.