mcp-proof 0.3.8 → 0.3.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -1
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# mcp-proof
|
|
2
2
|
|
|
3
|
-
>
|
|
3
|
+
> An auditable, privacy-preserving way to test whether MCP servers can be trusted before they are connected to an AI system — in your terminal, in CI, or via the [free browser scanner](https://vyriai.pro/scanner.html).
|
|
4
4
|
|
|
5
5
|
[](https://www.npmjs.com/package/mcp-proof)
|
|
6
6
|
[](https://opensource.org/licenses/MIT)
|
|
@@ -217,6 +217,10 @@ const skill = scanSkillManifest(fs.readFileSync('./SKILL.md', 'utf8'));
|
|
|
217
217
|
console.log(skill.decision);
|
|
218
218
|
```
|
|
219
219
|
|
|
220
|
+
## Privacy contract
|
|
221
|
+
|
|
222
|
+
The npm CLI is local-first: MCP manifests, tool descriptions, tool arguments, client configs, skill contents, scan results, and Trust Cards never leave your machine. The package contains no VyriAI API client, telemetry, analytics, or automatic upload path. `--stdio` only launches the server locally and requests its `tools/list` metadata. The sole network exception is opt-in `--live`, which sends only the declared npm package name to `registry.npmjs.org` for publisher verification; it does not send scan input or results.
|
|
223
|
+
|
|
220
224
|
## Limits (honest scope)
|
|
221
225
|
|
|
222
226
|
- **Publisher verification is lexical only by default.** npm scope match + Levenshtein typosquat. Pass `--live` to confirm npm packages against `registry.npmjs.org` with one network call. *No GitHub-API lookup, no signature verification.*
|
package/package.json
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-proof",
|
|
3
|
-
"version": "0.3.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "0.3.10",
|
|
4
|
+
"description": "Auditable, privacy-preserving MCP (Model Context Protocol) server verifier with local Trust Cards and SARIF output — test servers before connecting them to an AI system.",
|
|
5
5
|
"main": "engine.js",
|
|
6
6
|
"bin": {
|
|
7
7
|
"mcp-proof": "bin/mcp-proof.js"
|
|
8
8
|
},
|
|
9
9
|
"files": [
|
|
10
10
|
"engine.js",
|
|
11
|
-
"bin/",
|
|
11
|
+
"bin/mcp-proof.js",
|
|
12
12
|
"README.md",
|
|
13
13
|
"LICENSE"
|
|
14
14
|
],
|