Still OS · Security
✦ 3 MITRE-assigned CVEs · independent MCP security research

The MCP servers your agents trust
can have remote code execution.

Your AI agents call MCP tools that run on third-party servers almost nobody audits. Paste your dependencies and see — in seconds — the confirmed command-injection and arbitrary-write vulnerabilities in your supply chain. Free.

693MCP servers scanned
8confirmed vulnerabilities
3MITRE CVEs credited
CVE-2026-106763CVE-2026-106764CVE-2026-106765

Check your exposure

Paste your package.json, or a JSON array of MCP server package names.

No sample handy? Load an example manifest →
●
Free, read-only, and private. We match package names against findings we confirmed from each package's own published source. Your manifest is used only to compute your result — it is not uploaded to a third party, and nothing is ever sent on your behalf.

Did the servers you depend on change under you?

A published version number tells you a package changed. It does not tell you whether a live MCP server quietly swapped its tool list. We have been recording that daily since 21 September — paste your mcpServers config and we will tell you what moved.

Config handy? It is the same block your agent already uses. Load an example →
●
This is a record of change, not a judgement. A changed tool surface is evidence that something moved — it is not evidence of intent, fault, or any security consequence, and we never report it as one. UNOBSERVED is not a clean bill of health: it means we were not watching that endpoint, and says nothing about the server. Servers reached over stdio have no address to watch and will always read UNOBSERVED.

How it works

Checking mcp.fltln.io

Arrived from that server's public record. Paste your real config below to check every server you run, not just this one — nothing is checked or stored until you submit.

{
  "mcpServers": {
    "mcp_fltln_io": {
      "url": "https://mcp.fltln.io/mcp"
    }
  }
}
01 — matchTwo independent checks, never summed into one score. Your dependency names are matched against our corpus of confirmed MCP vulnerabilities by exact package coordinate, and every server URL in your config is matched against the Still OS trust classification board.
02 — reportUnlock the full report: affected versions, the mechanism, and the remediation for every finding in your tree.
03 — monitorPoint your CI at a monitoring token to watch your pinned packages for new findings as we publish them. Your CI pulls; nothing is ever sent on your behalf.

Pricing

On-demand check — freePermanently free, no account. Paste your manifest and get every confirmed match in your tree.
Continuous monitoring — $299/monthUnmetered polling of your pinned manifest, returning only what is NEW since your last poll with the date each finding was first observed. The dated record of what your dependency surface did between annual audits — the gap a 12-month certificate cannot cover. Subscribe — enter your monitoring token at checkout.
Machine poll — $0.01 per pollFor agents paying per call over x402. Same delta, no subscription.
04 — the change recordSeparately, we enumerate live MCP servers every day and keep the dated history of their tool surfaces. Nobody can reconstruct what a server looked like on a past date without having recorded it — so the record itself is the asset, and it is free to query.