Your AI agents call tools on third-party MCP servers almost nobody audits. Paste your dependencies and see, in seconds, the confirmed command-injection and arbitrary-write vulnerabilities in your supply chain — found by the researchers MITRE credits.
Paste your package.json, or a JSON array of MCP server package names.
Start free with no account. Metered monitoring is fractions of a cent — no contract, no seats.
Still OS Digital Holdings LLC — a registered Wyoming company with its own EIN and business banking. We run an independent MCP supply-chain research pipeline: a static scanner flags tainted paths, a human confirms each against source, and real findings are filed with MITRE. Three are already assigned CVEs; every one on this page was confirmed from the package's own published code.
No. Your dependency list is used only to compute your result against our findings corpus. It is not persisted, shared, or sent to any third party, and nothing is ever sent on your behalf.
Each one was source-confirmed from the package's own published code — a static scan flags a candidate, then a human traces the tainted path to the sink before it is ever called a finding. Three are MITRE-assigned CVEs.
For findings not yet public, we show the affected package and vulnerability class but withhold the exploit mechanism until the maintainer ships a fix or the disclosure window closes. The full report is available to the affected operator.
The on-demand check is free, forever. Continuous monitoring — a per-poll change feed your CI pulls — is metered at $0.01 per poll. There is no contract and no seat license.
No account, no card, no sales call. If it's useful, monitoring is one click away.
Check your exposure — free