← Home

@modelcontextprotocol/inspector-client

7
Versions
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-antcliffhall

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:lucide-react AI (phantom-deps): Icon lib used in bundled React app, false positive. ai
phantom-deps phantom-dep:zod AI (phantom-deps): Bundled frontend dep used via build tooling, not statically detected import. ai
phantom-deps phantom-dep:clsx AI (phantom-deps): UI lib used in bundled React app, false positive. ai
phantom-deps phantom-dep:cmdk AI (phantom-deps): UI lib used in bundled React app, false positive. ai
phantom-deps phantom-dep:prismjs AI (phantom-deps): UI lib used in bundled React app, false positive. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): Core React dep, false positive from static import scan. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Localhost console log message, not an actual network request to a raw IP. ai
source-diff obfuscated-file:dist/assets/index-DjSLdS7f.js AI (source-diff): Vite-bundled React app output; minified not obfuscated. ai
source-diff net-exec-file:dist/assets/index-DjSLdS7f.js AI (source-diff): Standard bundled frontend fetch/module code, no dropper behavior. ai
phantom-deps phantom-dep:react AI (phantom-deps): React deps bundled into dist by Vite; not directly imported at top level. ai
bogus-package bogus-package AI (bogus-package): Official MCP org package with provenance; README links are legitimate project URLs. ai
semgrep semgrep:env-spread AI (semgrep): Standard child-process spawn pattern passing env vars; not exfiltration. ai

Versions (showing 7 of 7)

Version Deps Published
1.0.0 27 / 26
0.22.0 27 / 26
0.21.2 27 / 26
0.19.0 25 / 26
0.16.3 25 / 24
0.14.2 25 / 24
0.8.0 24 / 23

v1.0.0

3 findings
HIGH New obfuscated file: dist/assets/index-DjSLdS7f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/assets/index-DjSLdS7f.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.