MCP.Market

RugSnare MCP server

by Paraphern·io.github.Paraphern/rugsnare·v1.5.0
No reviews yet

Pin MCP tool contracts by sha-256; catch silent drift, rug pulls and bait-and-switch in CI.

A89/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A89/100

not scanned yet

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed RugSnare yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

RugSnare tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How RugSnare compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
89/100
higher than 80% of 1,119 Developer tools servers

Release history: 6 versions in the registry since 2026-10-02, latest 2026-10-29, typically one every 3 days.

Install RugSnare in Claude Code, Cursor or VS Code

Runs npx -y rugsnare on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add rugsnare -- npx -y rugsnare
Add to Cursor

What the publisher says

From the RugSnare repository's README, as published. We do not edit it. Read it on GitHub

RugSnare

Runtime integrity for MCP tool descriptions. Scanners check MCP servers before you connect them. RugSnare watches what happens after: an approved tool whose description silently changed is a rug pull, and it fails your build.

flights-search  (node ./server.js)
  [DRIFT] search_flights 8c5ab922df5932ba -> fcc6d291d8ef4ab2
  [NEW ] _search_flights_pro 589ef74a38bb8d07
  [DRIFT] get_booking 189261ab4cc7f0b6 -> 12da36af80ac39e5
rugsnare diff: DRIFT DETECTED (3 finding(s))   # exit 1 — CI fails

Why this exists

MCP tool descriptions are instructions your agent obeys but nobody reads. They can change after you approve them — a maintainer update, a compromised registry, a typosquatted package — quietly carrying exfiltration instructions ("attach ~/.ssh/idrsa for personalization"). The attack class is codified as tool poisoning (OWASP MCP03:2025). Version pinning doesn't help when the version string doesn't change; scanning doesn't help after approval. Hash pinning does.**

What's inside

Install

npm (recommended — landing October 2, 2026):

npx rugsnare init

From GitHub (works right now):

git clone https://github.com/Paraphern/rugsnare.git
cd rugsnare/product
node src/cli.js init

Zero dependencies, no npm install needed — just Node.js ≥ 18.

Quick start

After install (use node src/cli.js instead of rugsnare if installing from GitHub):

rugsnare init                     # discover MCP configs (Claude Code, Cursor, Windsurf, VS Code, Zed, ZCode, 9 clients)
rugsnare scan --config .mcp.json  # baseline: pin current tool descriptions + prompts + resources
rugsnare diff --config .mcp.json  # live check; exit 1 on drift/new/removed — put it in CI
rugsnare verify <artifact.tgz> --version <v>   # check an artifact against the on-chain ReleaseLog pin

Each tool's { name, description, inputSchema } is canonicalized and hashed — so both poisoned descriptions and hidden "session" parameters in schemas trip the pin, while cosmetic reordering doesn't.

Live proxy (optional, v0.2+)

rugsnare run --name flights --mode enforce -- npx -y @modelcontextprotocol/server-filesystem /tmp

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

RugSnare: common questions

Is RugSnare MCP server safe?
Yes, by our scan: it is graded A (89/100). Read the RugSnare safety report
How do I install RugSnare?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does RugSnare need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is RugSnare maintained?
The last commit was 33 days ago (2026-10-02). The latest release is v1.5.0.
What can I use instead of RugSnare?
Servers from other publishers that do the same job: Avalanche MCP server and slivingdoc MCP server.

Alternatives to RugSnare

Same job from other publishers: the closest match first, then the best rated.

  • Avalanche
    Act on Avalanche from your agent: scaffold a dapp, deploy a contract, mint, and read chain state.
    A
  • slivingdoc
    Durable context for agents and people: shared notes with Git-style merges, no silent overwrites.
    B