@modelcontextprotocol/inspector-client
7
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-antcliffhall
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): Icon lib used in bundled React app, false positive. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Bundled frontend dep used via build tooling, not statically detected import. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): UI lib used in bundled React app, false positive. | ai | |
| phantom-deps | phantom-dep:cmdk | AI (phantom-deps): UI lib used in bundled React app, false positive. | ai | |
| phantom-deps | phantom-dep:prismjs | AI (phantom-deps): UI lib used in bundled React app, false positive. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Core React dep, false positive from static import scan. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Localhost console log message, not an actual network request to a raw IP. | ai | |
| source-diff | obfuscated-file:dist/assets/index-DjSLdS7f.js | AI (source-diff): Vite-bundled React app output; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/assets/index-DjSLdS7f.js | AI (source-diff): Standard bundled frontend fetch/module code, no dropper behavior. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): React deps bundled into dist by Vite; not directly imported at top level. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Official MCP org package with provenance; README links are legitimate project URLs. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Standard child-process spawn pattern passing env vars; not exfiltration. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 1.0.0 | 27 / 26 | |
| 0.22.0 | 27 / 26 | |
| 0.21.2 | 27 / 26 | |
| 0.19.0 | 25 / 26 | |
| 0.16.3 | 25 / 24 | |
| 0.14.2 | 25 / 24 | |
| 0.8.0 | 24 / 23 |
v1.0.0
3 findings
HIGH
New obfuscated file: dist/assets/index-DjSLdS7f.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/assets/index-DjSLdS7f.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.