Mcpvet MCP server

by CloudCorpRecords·io.github.CloudCorpRecords/mcpvet·v0.2.1

No reviews yet

Vetting for MCP servers and skills: capabilities, configs, mismatches, typosquats, probe parity.

A92/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A92/100

not scanned yet

Adoption

Growing

0 stars257 downloads/wk

Reviews

Write one

Nobody has reviewed Mcpvet yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Mcpvet tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How Mcpvet compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 92/100; higher than 90% of 48,273 servers
Downloads a week: 257; more than 79% of 11,915 servers with a package

Release history: 3 versions in the registry since 2026-10-23, latest 2026-10-26, typically one every 2 days.

Install Mcpvet in Claude Code, Cursor or VS Code

Runs npx -y @reneturcios/mcpvet on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcpvet -- npx -y @reneturcios/mcpvet

Add to Cursor

What the publisher says

From the Mcpvet repository's README, as published. We do not edit it. Read it on GitHub

mcpvet

Vet MCP servers and agent skills before you install them.

In early 2026 the ClawHavoc wave put 1,184 malicious skills on a public skill marketplace from just 12 accounts: credential stealers and reverse shells dressed up as helpful agent skills, inheriting whatever permissions the agent itself had. Only a small minority of organizations audit the MCP servers they install, and almost none audit skill packs. The install click is the trust decision, and it usually happens with no evidence at all.

mcpvet is the pre-install check. Point it at a local MCP server directory, a SKILL.md skill directory, a client config tree, or an npm package name, and it returns a deterministic verdict with evidence for every finding: VETTED, REVIEW, or DO-NOT-INSTALL. The scan is static only. Scanned code is read as text and never executed, imported, or installed.

Install

npx -y @reneturcios/mcpvet --version
npm install -g @reneturcios/mcpvet
docker run -i --rm ghcr.io/cloudcorprecords/mcpvet mcp

Quick start

mcpvet vet ~/src/some-mcp-server
mcpvet vet ~/skills/some-skill --json
mcpvet vet-package @modelcontextprotocol/server-filesystem@2025.3.28
mcpvet mcp

CLI exit codes: 0 when the verdict is VETTED, 1 for REVIEW or DO-NOT-INSTALL, 2 for a usage or setup error, 141 when the reader closed the output pipe before the report was delivered.

What it checks

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Mcpvet: common questions

Is Mcpvet MCP server safe?: Yes, by our scan: it is graded A (92/100). Read the Mcpvet safety report
How do I install Mcpvet?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Mcpvet need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Mcpvet maintained?: The last commit was 10 days ago (2026-10-23). The latest release is v0.2.1.
How does Mcpvet compare with other MCP servers?: safety score 92/100 (higher than 90% of 48,273 servers); downloads a week 257 (more than 79% of 11,915 servers with a package). Full comparison.