Mcp Provenance Monitor

MCP Provenance Monitor

👉 MCP Provenance Monitor Dashboard

A web dashboard for monitoring the software supply chain provenance of local MCP (Model Context Protocol) server packages.

[](https://letmaik.github.io/mcp-provenance-monitor)

[](https://letmaik.github.io/mcp-provenance-monitor)

FAQ

Why is MCP server xyz missing?

• Currently, only servers published on npm or PyPI are supported.
• Server data is sourced from the MCP registry at https://github.com/modelcontextprotocol/registry, which may not contain every server.

How can I add provenance to my MCP server?

• For NPM packages, see Generating provenance statements.
• For PyPI packages, see Producing attestations.

How can I add provenance to dependencies?

• Help improve the ecosystem by contributing to dependency packages: ensure they are built in CI and publish provenance. You can also consider submitting a pull request to those projects.

I just released a new version with provenance, but it still says provenance is missing. Why?

• Data is refreshed daily. If you just published a new version, please allow up to one day for the update to appear.

Do MCP clients check provenance?

• Not yet. For updates, see this issue.

Development

pip install -r requirements.txt
python -m collector.main --dev
python -m http.server -d web

License

See the [LICENSE](LICENSE) file for details.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: letmaik
• Source: letmaik/mcp-provenance-monitor
• License: MIT
• Homepage: https://letmaik.github.io/mcp-provenance-monitor

Install and usage instructions live in the source repository linked above.