# Mcp Registry Audit

> Read-only reconnaissance CLI that scans public MCP registries for rug-pull and lookalike supply-chain attacks.

- **Type:** MCP server
- **Install:** `agentstack add mcp-nesqcck-mcp-registry-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Nesqcck](https://agentstack.voostack.com/s/nesqcck)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Nesqcck](https://github.com/Nesqcck)
- **Source:** https://github.com/Nesqcck/mcp-registry-audit
- **Website:** https://nesqcck.github.io

## Install

```sh
agentstack add mcp-nesqcck-mcp-registry-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# mcp-registry-audit

A read-only reconnaissance CLI that scans public MCP (Model Context Protocol) registries for two supply-chain attack shapes — **rug-pulls** (a server that turns malicious in a later version) and **lookalikes** (brand impersonation) — and produces a ranked, evidence-traced candidate list for manual review.

## Read-only by design

The scanner only **reads public metadata**. It never installs, executes, imports, unpacks, or process-spawns any target, and it never contacts any URL, domain, or endpoint found inside a package — those are treated as inert strings to be scored, never reached. All network access is plain HTTP GET against registry and package-backend APIs. Confirmation of any candidate is a separate, manual, sandboxed step performed by a human — never by this tool.

## What it does

Two pipelines over a shared, cached, read-only fetch core:

- **Lookalike** — matches server names against a canonical brand set (normalized name-distance + homoglyph + substring) and scores publisher mismatch, off-canonical install, fresh repo, thin/fake contributor graph, and official-sounding-but-low-trust naming.
- **Rug-pull / drift** — resolves a server to its npm/PyPI/GitHub source, diffs consecutive published versions, and scores newly-introduced outbound calls, hardcoded sinks, install hooks, env-harvest-near-network, maintainer changes, and obfuscation.

Every candidate score traces to a named signal with its evidence, so a human can confirm or dismiss each by reading the source.

## Install

From source (editable):

```
git clone https://github.com/Nesqcck/mcp-registry-audit
cd mcp-registry-audit
python -m venv .venv
source .venv/bin/activate       # Unix; on Windows: .venv\Scripts\activate
pip install -e ".[dev]"
```

## Usage

```
hunt pull --registry all          # build/refresh the local read-only index
hunt lookalikes --enrich          # Pipeline B: brand-impersonation candidates
hunt diff --top 200               # Pipeline A: rug-pull / version-drift candidates
hunt rank --out candidates.csv    # merge both, ranked -> out/ (JSON + CSV + XLSX)
```

The local index/cache is written under `cache/` and outputs under `out/`; both are git-ignored. Optionally set `GITHUB_TOKEN` in the environment for higher GitHub rate limits during `--enrich`.

## Tech stack

Python 3.12+ — `httpx` (GET-only fetching), `pydantic` (data model), `typer` (CLI), `rapidfuzz` (name-distance scoring). Two independent pipeline modules over one read-only fetch-and-cache core.

## Writeup

Background, method, and snapshot findings: https://nesqcck.github.io

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Nesqcck](https://github.com/Nesqcck)
- **Source:** [Nesqcck/mcp-registry-audit](https://github.com/Nesqcck/mcp-registry-audit)
- **License:** MIT
- **Homepage:** https://nesqcck.github.io

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-nesqcck-mcp-registry-audit
- Seller: https://agentstack.voostack.com/s/nesqcck
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.