Small Print MCP server

Small Print (MCP)

Small Print keeps a record of the text that MCP servers, agent skills and plugins give your AI agent, and tells you when a change is graded high or critical. Every night it fetches the lists of the public registries, reads the new versions it finds, keeps every version it has read, and grades each change by a written rule: https://smallprint.dev.

• Get an email the morning a change to something you use is graded high or critical. Sign up with just your email address at https://smallprint.dev/start, from the watch box on any entry's page, or by typing it when npx smallprint check asks. Pin the servers and skills you use; by default the daily brief shows changes graded high or critical and high or critical advisories, by email or Discord, and choosing everything in settings brings every change. No password, and no credit card required.
• Check what your agents have installed, free and with no account: npx smallprint@1.2.0 check --no-upload prints what it found and sends nothing; without the flag it asks before sending names and versions to get grades. Or paste a config file at https://smallprint.dev/check.
• Plans: every account starts with 30 days of Pro. After that, the Free plan keeps 25 pins, the daily brief, and the off-machine record of your instruction files from each sync you run by hand. Pro adds the scheduled sync, which keeps that record current without you, and removes the pin limit. https://smallprint.dev/pricing
• New to this? A step-by-step guide in plain words: https://smallprint.dev/guide

The grading rules are printed at https://smallprint.dev/how-we-grade.

What is in this repository

• This Action fails a build when the small print in a repository changed since its lock was written.
• npx smallprint gate asks the record before a session whether any server here changed since the lock or gained a high advisory; exit codes for a shell hook. CLI 1.2.0.
• mcp/: smallprint-mcp, an MCP server with four read-only tools over the public record (npx -y smallprint-mcp; registry name dev.smallprint/smallprint).
• Dockerfile builds and runs that server over stdio, for registries that start a server to check it answers.
• cli/: the source of the smallprint command, from which the npm package is built, with its tests. npx smallprint@1.2.0 check --no-upload prints what it found and sends nothing.
• vscode/: the Small Print extension for VS Code and Cursor, the same files that go to the stores.
• tools/verify-chain.mjs: checks the record chain from the public API: every link, every signature, and the entries hash of every day whose lines are kept; node tools/verify-chain.mjs. Rows written before 4 October 2026 link, and their entries cannot be recomputed.

Small Print check, as a GitHub Action

Fails the build when the small print your agents read has changed: an MCP server's version, a skill's files, or an instruction file such as CLAUDE.md, AGENTS.md or an .mcp.json, compared with a lock you committed.

- uses: gostanos/smallprint-action@v1.13

Write the lock from the repository's directory on a machine that has the intended configuration, with --project so it holds only what lives in the repository (the .mcp.json, the .claude/ and .cursor/ folders, CLAUDE.md, AGENTS.md and the rest), and commit it:

npx smallprint lock --project
git add smallprint.lock

Shortened. The full README is on GitHub.