Supply Chain Guard MCP Server

Open-source supply-chain security scanner that runs locally and offline. It matches known-malicious packages, extensions, plugins, providers, container images and CI actions in 15 ecosystems, with tested matchers ready for more (see Ecosystem Coverage), reading manifests and lockfiles at any depth of a repository, including the transitive dependencies a lockfile pins; and it analyses what you install for malware…

People who work with elvatis, github action and glassworm and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-09-29 · ★ 6 · #13 OF 165 MAINTAINED CLOUD INFRASTRUCTURE · VERIFIED 2026-09-30

Apache-2.0 · TypeScript servers · how we verify → /methodology

01 · Install Supply Chain Guard

before you install - you'll need

Set SCG_INTERNAL_HASH_SALT, SCG_INTERNAL_DISCLOSURE_FILE before connecting.

Claude Code

claude mcp add homeofe-supply-chain-guard -- npx -y supply-chain-guard

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "homeofe-supply-chain-guard": {
      "command": "npx",
      "args": [
        "-y",
        "supply-chain-guard"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package supply-chain-guard - unscoped; check the name against the project README before installing

registry namespace io.github.homeofe is GitHub-verified and matches the repo owner

03 · What Supply Chain Guard can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v6.4.0 · 2026-09-30

[6.4.0] - 2026-09-30 · Added · Threat intel (2026-09-30): 138 package IOCs from the GitHub Advisory · Database and OpenSSF, 97 in the offline bundle and 41 in the catalog. 35 · npm names are blocked outright, each…

v6.3.3 · 2026-09-29

[6.3.3] - 2026-09-29 · Changed · The bundle cutoff advanced from 2026-08-29 to 2026-08-30, moving 145 · package indicators dated 2026-08-29 from the bundle into the catalog. None · of them is asserted by a test or…

v6.3.2 · 2026-09-28

[6.3.2] - 2026-09-28 · Added · Threat intel (2026-09-27): seven package IOCs from the GitHub Advisory · Database, corroborated by OpenSSF, all in the offline bundle: · pypi:donutautosellsrc 0.3.7 to 0.3.9…

04 · Who maintains Supply Chain Guard

supply-chain-guard is maintained by homeofe. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/homeofe/supply-chain-guard
category: cloud infrastructure - ranked #13 of 165 actively-maintained cloud infrastructure servers as of 2026-09-30.
release cadence: 10+ releases in the last 90 days (latest 2026-09-30)
registry: io.github.homeofe/supply-chain-guard (active, first published 2026-09-26 · 5 versions)
packages: npm:supply-chain-guard

06 · Supply Chain Guard FAQ

What is Supply Chain Guard?

Is Supply Chain Guard still maintained?

Yes - as of 2026-09-30, its last commit was 2026-09-29 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Supply Chain Guard?

Run `npx -y supply-chain-guard`. The README documents 2 environment variables (SCG_INTERNAL_HASH_SALT, SCG_INTERNAL_DISCLOSURE_FILE) to set first. Set SCG_INTERNAL_HASH_SALT, SCG_INTERNAL_DISCLOSURE_FILE before connecting. You can also paste the ready-made client config above.

Does Supply Chain Guard run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Supply Chain Guard

Alternatives to Supply Chain Guard

Maintained cloud infrastructure servers if Supply Chain Guard isn't the fit.

Pairs well with

Servers that cover what Supply Chain Guard doesn't - only shown when the pairing reason fits the companion.

More cloud infrastructure MCP servers · Ynab MCP Server · Roku MCP · Aigroup Mdtoword MCP · Antrieb · Flaim Fantasy

More TypeScript MCP servers · Ris (honeyfield-org) · Hormonaly Clinical Intelligence · Hostinger API MCP · Amazon Creators · Fanout · see all