MCP security guard + package manager. Block prompt injection, tool poisoning and rug-pulls in Model Context Protocol servers at runtime; trust-scored installs with Sigstore provenance for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI. Local, deterministic, no LLM in the loop.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add mcpm -- npx -y @getmcpm/cli~/.codex/config.toml
[mcp_servers.mcpm]
command = "npx"
args = ["-y", "@getmcpm/cli"]
# codex mcp add mcpm -- npx -y @getmcpm/cli~/.cursor/mcp.json
{
"mcpServers": {
"mcpm": {
"command": "npx",
"args": [
"-y",
"@getmcpm/cli"
]
}
}
}.vscode/mcp.json
{
"servers": {
"mcpm": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@getmcpm/cli"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"mcpm": {
"command": "npx",
"args": [
"-y",
"@getmcpm/cli"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"mcpm": {
"command": "npx",
"args": [
"-y",
"@getmcpm/cli"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"mcpm": {
"command": "npx",
"args": [
"-y",
"@getmcpm/cli"
]
}
}
}