What does the MCP Manifest Scanner check for?

It looks at each entry in mcpServers for API keys pasted into env blocks (common formats such as sk-, ghp_, xoxb-, AIza and r8_) and for arguments that pull the latest version of a package (@latest) or point at unusual paths.

How does typosquatting detection work?

It compares each dependency name with a list of popular npm packages and known lookalike misspellings, and flags names that are one or two letters away from a popular package.

Package.json & MCP Manifest Security Auditor

Check a package.json or MCP config for risky install scripts, typos and exposed secrets.

In plain words: MCP servers and npm packages can run code on your computer. Paste a package.json or MCP config and the scanner flags warning signs. A clean result lowers the risk but doesn't guarantee safety.

🔒 100% Local Browser Execution — Files never leave your device ✓ No email · No sign-up · No watermark · Free

Load Sample Manifest:

Safety Score: 100/100

Paste package.json, mcp.json or requirements.txt

Supply-Chain Security Audit Findings

🔗 Chain next workflow: Jump straight to a related tool

{ } JSON Formatter, Validator & Tree Explorer .* Live Regex Tester, Highlighter & Cheat Sheet 🤖 AI Token & Cost Calculator

How to Use Package.json & MCP Manifest Security Auditor

Paste your package.json or mcp.json (Claude Desktop / Cursor / Antigravity MCP config), or load one of the sample files.
Review the Safety Score (100 = no issues found) and the findings, marked Critical, High, Medium or OK.
Click "Copy Markdown Report" to paste the results into a pull request or security review.

Protect Your Codebase & AI Coding Agents from Supply-Chain Attacks

As developers rapidly install npm packages, Python dependencies, and Model Context Protocol (mcp.json) servers from GitHub and community posts, supply-chain attacks have surged. Malicious packages often use lookalike names (e.g. lodahs, axois), hidden preinstall / postinstall scripts that run shell commands (curl ... | sh), unpinned wildcard versions (*), or plaintext API keys inside MCP environment blocks.

WeShoal's Package & MCP Manifest Auditor checks your file in your browser, without uploading it or your secrets anywhere. It is a quick first check using simple rules, not a full security audit, so a clean result doesn't guarantee a package is safe.