mcpField
S
supply-chain-guard

supply-chain-guard

Local
github.com/homeofeSecurity
Repository

About supply-chain-guard

supply-chain-guard is an open-source scanner that runs locally and offline to inspect packages and components across 15 ecosystems. It analyzes malicious behavior, generates SBOMs, and lets coding agents check dependencies before installation through MCP.

Key features

  1. 01Offline manifest and lockfile scans
  2. 02Malicious component matching across 15 ecosystems
  3. 03Malware and install-hook analysis
  4. 04CycloneDX 1.6 SBOM generation
  5. 05SLSA provenance grading and attack-chain correlation

Use cases

  1. 01Vet dependencies before installing packages
  2. 02Gate risky changes in CI
  3. 03Check repositories for transitive dependencies and malware

MCP support

The MCP server provides package-checking capabilities to coding agents so they can assess dependencies before installation.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "homeofe-supply-chain-guard": {
      "command": "npx",
      "args": [
        "-y",
        "supply-chain-guard"
      ]
    }
  }
}
Run commandnpx -y supply-chain-guard

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmsupply-chain-guard6.6.1

Tools

3

Saved tool list · updated 1d ago

ParameterTypeRequiredDescription
namestringNoPackage name, e.g. 'event-stream' or '@scope/pkg' (package-mode)
versionstringNoExact version to check (optional, package-mode). Without it only version-independent IOCs match.
ecosystemenumNoPackage ecosystem the name belongs to (package-mode)npm | pypi | ruby | composer | nuget | go | jenkins | terraform | vscode | openvsx | maven | actions | pub | docker | tfmodule | swift | cocoapods | hex | cran | conan | helm | ansible | homebrew | chrome | edge | firefox | jetbrains
indicatorstringNoA single domain, url, ip, or hash to look up against the feed (indicator-mode). Use INSTEAD of ecosystem/name.

Details

The maintainer has not added details yet. Check the README in the repository.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.