mcp supply chain gate

The problem

One-time security audits of MCP servers expire the moment a new version ships or a new vulnerability is discovered. Manual tracking of approved server versions across a fleet is prone to human error, leaving orgs vulnerable to "MCPoison" style content swaps and typosquatting.

What it does

• Generates a registry manifest to track approved MCP servers by exact content hash, not just version strings.
• Runs typosquatting and Unicode homoglyph checks on candidate servers to detect impersonation before auditing.
• Builds CI/CD gates that block builds if an MCP server is unapproved, has a hash mismatch, or has a lapsed audit window.
• Configures automated CVE feed subscriptions (OSV/GHSA/NVD) to trigger immediate re-audits when new vulnerabilities land.
• Establishes a formal bypass protocol with second-party approval and grant-time alerting for emergency overrides.

Frameworks & tools

GitHub Actions, GitLab CI, MCP (Model Context Protocol), OSV.dev, GHSA, NVD, and agent-skill-security-scanner.

Why this beats prompting it yourself

Standard prompts often overlook that version strings can be spoofed without a version bump. This skill enforces a cryptographic content-hash registry and a dual-signal typosquat check that balances edit distance with popularity disparity, preventing the "theatrical security" of simple name matches.

Use cases

• Enforcing a "no unvetted code" policy for third-party MCP servers in production CI.
• Detecting malicious homoglyph clones of popular MCP tools during developer intake.
• Automating the re-audit cycle for a fleet of 50+ third-party agent skills.
• Hardening agent environments against CVE-2025-54136 style trust-binding attacks.

Known limitations

This skill manages the registry and gate process but does not perform the code-level audit itself. It requires a content hash for exact pinning; name-only checks cannot detect novel malicious packages.