# Getmcpm Cli > MCP package manager with built-in trust scoring. Search, install, and audit MCP servers across Claude Desktop, Cursor, VS Code, and Windsurf. - **Type:** MCP server - **Install:** `agentstack add mcp-getmcpm-cli` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [getmcpm](https://agentstack.voostack.com/s/getmcpm) - **Installs:** 0 - **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [getmcpm](https://github.com/getmcpm) - **Source:** https://github.com/getmcpm/cli - **Website:** https://www.npmjs.com/package/@getmcpm/cli ## Install ```sh agentstack add mcp-getmcpm-cli ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # mcpm **The MCP package manager that guards your AI's tools at runtime -- search, install, audit, and inspect every MCP server from your terminal.** [](https://www.npmjs.com/package/@getmcpm/cli) [](./LICENSE) [](https://github.com/getmcpm/cli/actions) [](https://snyk.io/advisor/npm-package/@getmcpm/cli) --- The risky part of an MCP server doesn't show up at install -- it shows up while your agent is running: prompt injection hidden in a tool's output, a server that quietly rewrites its tools after you approved them, a sampling request that smuggles instructions into your model. mcpm scores every install for hardcoded secrets, prompt injection, and typosquatting ([66% of MCP servers have security findings](https://agentseal.org/blog/mcp-server-security-findings)) -- then runs a live guard between your AI client and each server, pinning tool definitions against rug-pulls and blocking injection before it reaches the model. ## Quick start Install with the package manager you already use: | Method | Command | |---|---| | **npm** (global) | `npm install -g @getmcpm/cli` | | **npx** (no install) | `npx @getmcpm/cli ` | | **pnpm** | `pnpm add -g @getmcpm/cli` | | **mise** | `mise use -g npm:@getmcpm/cli` | The binary is `mcpm`. **Heads up:** the `mcpm` Homebrew formula is a *different, unrelated* project ([mcpm.sh](https://mcpm.sh)) — install this mcpm via npm/npx/pnpm/mise above (all resolve the scoped `@getmcpm/cli` package, so there's no name collision). A dedicated Homebrew tap is deferred; see [`docs/DISTRIBUTION.md`](docs/DISTRIBUTION.md). ```bash mcpm search filesystem mcpm info io.github.domdomegg/filesystem-mcp mcpm install io.github.domdomegg/filesystem-mcp ``` ## Features ### Search the MCP registry Query the official MCP Registry and see results with trust indicators. ``` $ mcpm search filesystem Name Description Score io.github.domdomegg/filesystem-mcp File system access via MCP 82/100 io.github.Digital-Defiance/mcp-filesystem Read-only filesystem server 67/100 ... ``` ### Install with trust assessment Every install runs a metadata-based trust assessment before writing config. ``` $ mcpm install io.github.domdomegg/filesystem-mcp Trust Score: 82/100 (safe) Health check: 30/30 Static scan: 32/40 External scan: — (install mcp-scan for full coverage) Registry meta: 10/10 Install to Claude Desktop? (Y/n) ``` ### Audit installed servers Scan everything you have installed. Get a trust report. ``` $ mcpm audit Server Client Score Level servers-filesystem Claude Desktop 82/100 safe servers-github Cursor 74/100 caution some-sketchy-server VS Code 31/100 risky ``` ### Cross-IDE support One tool for all your AI clients. mcpm reads and writes the correct config format for each. ``` $ mcpm list Client Server Name Status Command/URL Claude Desktop servers-filesystem active npx -y servers-filesystem Claude Desktop servers-github active npx -y servers-github Cursor servers-fetch disabled npx -y servers-fetch ``` ### Doctor: check your MCP setup health Find misconfigurations, missing runtimes, and broken servers. ``` $ mcpm doctor Checking MCP setup... [pass] Claude Desktop config found [pass] npx runtime available [warn] Cursor config not found [pass] 3 servers installed, 0 with errors ``` ### Stack files: docker-compose for MCP Declare your project's MCP servers in `mcpm.yaml`, lock versions with trust snapshots, and let every team member replicate the setup with one command. ```bash mcpm export > mcpm.yaml # dump current setup mcpm lock # resolve versions + trust snapshot mcpm up # install everything from mcpm.yaml mcpm diff # compare installed vs declared state ``` Stack files include a trust policy. If a server's trust score drops below the threshold, `mcpm up` blocks it. ```yaml version: "1" policy: minTrustScore: 60 blockOnScoreDrop: true servers: io.github.domdomegg/filesystem-mcp: version: "^1.0.0" io.github.modelcontextprotocol/servers-github: version: "1.2.3" env: GITHUB_TOKEN: { required: true, secret: true } ``` ### Scaffold a stack file Start a new project's MCP setup in one command. `mcpm init` writes a starter `mcpm.yaml` you fill in with servers from `mcpm search`. ``` $ mcpm init Created mcpm.yaml. Next steps: mcpm search find MCP servers in the registry edit mcpm.yaml add them under `servers:` mcpm lock resolve and lock versions mcpm up install from the stack file ``` It refuses to clobber an existing `mcpm.yaml` (pass `--force` to overwrite). mcpm deliberately doesn't ship curated packs — blessing specific community servers is a trust decision a security tool shouldn't bake in. ## Trust score The trust score is a 0-100 assessment based on publicly available metadata. It is **not** a source code audit. What it checks: | Component | Points | What it measures | |---|---|---| | Health check | 0-30 | Can the server start and respond to `list_tools`? | | Static scan | 0-40 | Regex-based detection of hardcoded secrets, prompt injection patterns in tool descriptions, typosquatting in package names, suspicious argument schemas | | External scanner | 0-20 | Results from [MCP-Scan](https://github.com/invariantlabs-ai/mcp-scan) if installed (optional) | | Registry metadata | 0-10 | Verified publisher, publish date, download count (capped to 0 when critical findings present) | Levels: **safe** (80+), **caution** (50-79), **risky** (below 50). Without an external scanner installed, the maximum possible score is 80/100. The static scan catches common patterns but cannot detect all vulnerabilities. Treat the score as a signal, not a guarantee. ## Commands | Command | Description | |---|---| | `mcpm search ` | Search the MCP registry for servers | | `mcpm install ` | Install an MCP server from the registry | | `mcpm info ` | Show full details for an MCP server | | `mcpm list` | List all installed MCP servers across detected AI clients | | `mcpm remove ` | Remove an MCP server from client config(s) | | `mcpm audit` | Scan all installed servers and produce a trust report (`--json`, `--sarif` for GitHub code-scanning) | | `mcpm update` | Check for newer versions and update installed servers | | `mcpm outdated` | Show version drift and trust regression for installed servers | | `mcpm secrets` | Manage MCP server credentials (AES-GCM encrypted at rest; key held in the OS keychain — macOS Keychain / libsecret / Windows DPAPI — so a copied store can't be decrypted off-machine, with a machine-derived-key fallback where no keychain is available). `mcpm secrets migrate` upgrades older entries | | `mcpm publish scaffold` | Create a .mcpm-publish.yaml manifest interactively | | `mcpm publish check` | Dry-run: show trust score and what would be submitted | | `mcpm publish` | Submit to the official MCP registry (requires GITHUB_TOKEN) | | `mcpm doctor` | Check MCP setup health and report issues (`--json` structured model, `--report` redacted paste-for-bug-reports snapshot) | | `mcpm init` | Scaffold a starter `mcpm.yaml` stack file in the current directory | | `mcpm disable ` | Disable an MCP server without removing it from config | | `mcpm enable ` | Re-enable a previously disabled MCP server | | `mcpm import` | Import existing MCP servers from client config files | | `mcpm alias` | Create short aliases for long MCP server names | | `mcpm export` | Export installed servers as an mcpm.yaml stack file | | `mcpm lock` | Resolve versions and create mcpm-lock.yaml with trust snapshots | | `mcpm up` | Install all servers from mcpm.yaml with trust verification | | `mcpm verify` | Repo-only CI gate: verify lockfile integrity vs npm's published record (`--json`) | | `mcpm diff` | Compare installed servers against mcpm.yaml and lock file | | `mcpm sync` | Show cross-client config drift across all detected clients (`--check` gates CI with exit 2, `--json`) | | `mcpm completions ` | Generate shell completion scripts (bash, zsh, fish) | | `mcpm why ` | Explain a server's trust score (breakdown of all components) | | `mcpm serve` | Start mcpm as an MCP server (stdio transport) | | `mcpm guard enable` | Wrap detected client configs with the inspection relay | | `mcpm guard disable` | Restore original client configs | | `mcpm guard status` | Show what's wrapped and the per-server pin state | | `mcpm guard demo` | Run the synthetic prompt-injection scenario (visible block) | | `mcpm guard accept-drift ` | Re-pin a tool's schema after a legitimate upgrade | | `mcpm guard mute ` | Disable a signature with optional `--for ` | | `mcpm guard unmute ` | Re-enable a muted signature | | `mcpm guard pause` | Pause all guard inspection (debugging escape hatch) | | `mcpm guard cleanup` | Prune pin entries for uninstalled servers | | `mcpm guard list-signatures` | Show the shipped OWASP MCP Top 10 signature catalog | | `mcpm guard reset-integrity` | Regenerate the pins.json or guard-policy.yaml integrity sidecar | Run `mcpm --help` for options and flags. ## CI: verify your lockfile `mcpm verify` is a repo-only, **client-free** gate: it checks your committed `mcpm-lock.yaml` against npm's **published** `dist.integrity` record and exits non-zero on integrity drift, an unverifiable record, a format mismatch, or a suspicious missing baseline. Because it needs no AI clients installed, it runs on a hosted CI runner (where `mcpm up` cannot). ```yaml # .github/workflows/mcpm.yml jobs: verify: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: getmcpm/cli/.github/actions/mcpm-verify@v0.19.0 # or: run: npx @getmcpm/cli verify ``` The Action writes a job step summary from `--json`; the same verb works as a pre-commit hook. See [`.github/actions/mcpm-verify`](.github/actions/mcpm-verify). **Code scanning:** `mcpm audit --sarif` emits a SARIF 2.1.0 report (one rule per finding type, findings anchored file-level to `mcpm.yaml`) that GitHub ingests as code-scanning alerts: ```yaml - run: npx @getmcpm/cli audit --sarif > mcpm.sarif continue-on-error: true # audit exits 1 when a server is risky - uses: github/codeql-action/upload-sarif@v3 if: always() # upload even if the audit flagged a risk with: sarif_file: mcpm.sarif ``` > Honesty boundary: a failure means npm's *published record* diverged from your > lock — not that mcpm caught malicious bytes; npx/uvx fetch the artifact > independently at server launch. ## Runtime defense (mcpm-guard) Install-time trust scoring catches most poisoned servers before they ship. But what about **rug-pulls** — a server that changes its tool definitions after you've already approved them? Or **prompt-injection in tool responses** — adversarial text embedded in a Slack message, web page, or calendar invite that the agent reads through your trusted MCP server? `mcpm guard` adds a runtime inspection layer. It wraps every installed MCP server with a stdio relay, scans tool descriptions / responses / arguments for OWASP MCP Top 10 attack patterns, pins each tool's schema at install time, and blocks calls when the live response drifts from the pin (rug-pull defense). ### What happens on every tool call The guard sits inline on the stdio channel between your AI client and each MCP server, so it sees **both halves of every tool call** and inspects them as they pass: - **The request your agent sends** — the tool name and arguments, checked for sensitive-path exfil and injection smuggled into call parameters. - **The response the server returns** — checked for instruction injection hidden in the tool's output (the Slack message, web page, or calendar invite your agent is about to read). - **The tool's own definition** — `tools/list` descriptions, schemas, and annotations, checked against the schema pinned at approval time, so a server can't quietly rewrite a tool you already trusted. When a frame trips a signature, drift check, or policy rule, the guard **drops it and hands your agent a JSON-RPC error in its place** — carrying the signature id and a `remediation` string — so the poisoned content never reaches your model. Clean calls pass straight through (p99 ~0.065 ms on small frames). Server-initiated `sampling` / `elicitation` requests are inspected the same way, with the error routed back to the server rather than to your agent. ### Quick start ```bash npm install -g @getmcpm/cli@latest mcpm guard enable # wrap detected client configs (Claude Desktop / Claude Code / Cursor / VS Code / Windsurf / Gemini CLI) # → restart your IDE so it re-spawns the wrapped server processes mcpm guard demo # synthetic prompt-injection scenario — see a live block in your terminal mcpm guard status # what's protected, what's still in first-session-pin mode ``` The `demo` command boots an in-process synthetic malicious server that returns a canned prompt-injection payload; the relay blocks it. Total time from `npm install` to a screenshot-worthy block: ~5 minutes (most of which is the IDE restart). ### What it catches | Category | Attack class | Action | |---|---|---| | OWASP-MCP-1 | Tool-description injection (poisoning) | block | | OWASP-MCP-1 | Schema / annotation drift since install (rug-pull) | block | | OWASP-MCP-1 | Description-only drift (cosmetic tier) | warn | | OWASP-MCP-1 | Injection in `initialize` instructions | block | | OWASP-MCP-2 | Instruction injection in tool responses | block | | OWASP-MCP-2 | Instruction injection in resource / prompt content | warn (forward) | | OWASP-MCP-7 | Sensitive-path exfil in tool arguments | warn (promote to block via policy) | | Hidden chars | Zero-width / bidi / non-printable in tool metadata | high (warn) | | Sampling | Injection in a server-initiated `sampling` prompt | block (to the server) | Detection is regex + structural; NFKC + zero-width-char stripping defeats the common Unicode evasions, and a separate hidden-character *presence* check flags evasion carriers before they're normalized away. See `mcpm guard list-signatures` for the current shipped set. ### Confinement (opt-in enforcement) Everything above is *detection* — the relay reasons about the JSON-RPC bytes and warns or blocks. But a server that decides to read `~/.ssh` or write a `~/Library/LaunchAgents` persistence hook never expresses that through inspectable traffic. `mcpm guard enable --confine` complements detection with *enforcement*: it wraps each relayed stdio server in an OS sandbox that physically denies reads of a secret-file denylist and writes outside caches/scratch, so the server can't exfil credentials or persist regardless of the JSON-RPC it emits. `mcpm guard doctor-confine` reports backend availability and which servers are enrolled. **macOS only** for now (Seatbelt/`sandbox-exec`); on other platforms it warns and runs unconfined rather than giving a false sense of protection. See `docs/GUARD.md` for the tier details and caveats. ### Day-1 commands ```bash mcpm guard enable [--client ] [--server ] [--dry-run] # wrap detected configs mcpm guard disable [--client ] [--server ] # unwrap mcpm guard status # what's wrapped + pin state mcpm guard demo # synthetic attack-block demo mcpm guard list-signatures [--json] # show shipped signatures mcpm guard enable --confine # al … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [getmcpm](https://github.com/getmcpm) - **Source:** [getmcpm/cli](https://github.com/getmcpm/cli) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/@getmcpm/cli Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-getmcpm-cli - Seller: https://agentstack.voostack.com/s/getmcpm - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.