Resident security check

POST your MCP server's package manifest — get every Still OS finding and load-bearing-floor exposure back instantly. Built for agents and CI: check on every build, not once.

Usage

curl -s https://stillosdigitalholdings.com/advisories/check \
  -H 'content-type: application/json' \
  -d '{"packages":["@rog0x/mcp-git-tools","zod","your-mcp-server"]}'

Also accepts a bare JSON array, a package.json (its dependencies are read), or a newline/space list. Send X-No-Log: 1 to opt out of the anonymized deployed-surface census (we never log your identity, IP, or manifest — only which package names were queried).

Returns Still OS advisories (Still OS MCP Supply-Chain Security Research), our STILLOS- identifiers, and whether any package is a load-bearing ecosystem chokepoint. Still OS Digital Holdings LLC · security@stillosdigitalholdings.com.