Supply Chain Guard
io.github.homeofePublished by GitHub account homeofev6.6.1Updated Oct 30, 2026
Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.
The publisher's own server: Agent.chain.tokyo Address Contracts
Overview
Offline supply-chain malware scanner exposed as an MCP server, letting an assistant vet packages across 15 ecosystems before installing them.
- What you can do
- Check packages for malware and supply-chain risk before they are installed
- Cover packages from 15 different package ecosystems
- Run the checks offline, without sending package data to an external service
- When to use it
- Useful when an assistant helps add or upgrade dependencies and you want a pre-install safety check on unfamiliar packages. Suited to teams that prefer offline scanning over uploading package names to a hosted service.
- Requirements
- Runs as a local process over stdio, installed from the npm package supply-chain-guard, so Node.js and npm are needed on the machine. No authentication, environment variables or headers are declared. Desktop-only; not available as a web executable.
Installation
In SourceWeft
- Open Supply Chain Guard in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
This repository has no README.
Tools
0Version history
21- v6.6.1LatestOct 29, 2026
- v6.6.0Oct 21, 2026
- v6.5.10Oct 21, 2026
- v6.5.9Oct 18, 2026
- v6.5.8Oct 16, 2026
- v6.5.7Oct 14, 2026
- v6.5.6Oct 13, 2026
- v6.5.5Oct 13, 2026
- v6.5.4Oct 11, 2026
- v6.5.3Oct 9, 2026
- v6.5.2Oct 8, 2026
- v6.5.1Oct 6, 2026
- v6.5.0Oct 5, 2026
- v6.4.3Oct 4, 2026
- v6.4.2Oct 3, 2026
- v6.4.1Oct 2, 2026
- v6.4.0Sep 30, 2026
- v6.3.3Sep 29, 2026
- v6.3.2Sep 28, 2026
- v6.3.1Sep 26, 2026
- v6.3.0Sep 26, 2026
Score
25% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
- License10 pts
Declare a license in the repository or the registry entry.
Other Chain integrations
Agent.chain.tokyo Address Contracts
tokyo.chain.agentOfficial publisher
Lets an assistant rent a Japan mailing address for an agent: browse locations and floors, create a 55 USDC payment intent, and track contracts and events.
Chain Data for Agents (x402)
Published by GitHub account zuo305
Remote MCP server giving assistants live Solana validator data: network health, per-validator stats, and ranked validator lists, paid per call via x402.
Zovo Countdown Chain
Published by GitHub account theluckystrike
Generates a printable countdown calendar to one event — month pages, paper-chain strips or tear-off cards — plus an ICS reminder file.
DeviceChain
io.devicechain
Read-only MCP tools for a self-hosted DeviceChain IoT instance, letting an assistant inspect devices, telemetry and alarms.
On-chain Forensics
dev.onchainforensics
On-chain token due-diligence tools that let an assistant grade tokens, screen wallets and check settlement safety before a trade.