mcpm

by getmcpm·io.github.getmcpm/cli·v0.41.0

MCP security guard + package manager: trust-scored installs, blocks prompt injection and rug-pulls.

B83/100grade B

What users say

No reviews yet

Safety scan

B83/100

Adoption

Growing

3 stars529 downloads/wk

Reviews

Nobody has reviewed mcpm yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Tool lists for local packages are only visible after install.

scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it

1 medium

Code scan66 source files scanned20/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner7/10

mediumeval / new Function usedexec.eval

dist/chunk-PYE36HA6.js: …rlier // draft instead matched `new Function(`/IIFE syntax with NO call // ga…

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y @getmcpm/cli on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add cli -- npx -y @getmcpm/cli

Same job from other publishers, ranked by rating then adoption.

ha-mcp
Comprehensive Model Context Protocol server for managing Home Assistant through AI assistants.
not reviewed
Widely used
C
IWE
Markdown knowledge base as agent memory. Runs against the notes directory it is started in.
not reviewed
Established
A
fiori-mcp-server
SAP Fiori - Model Context Protocol (MCP) server
not reviewed
Established
A
mcp-local-rag
Easy-to-setup local RAG server with minimal configuration
not reviewed
Established
A
mcp-ts-core
Agent-native TypeScript framework for MCP servers.
not reviewed
Established
C