Server Attestation
About
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.
Details
- License
- MIT
Explore
- CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection
- CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack
- Canonical JSON is the signed surface. Re-serialisation cannot change the signed bytes
- Sandbox or containerise the server process
- OAuth flow hardening (separate mcp-oauth-shield build)
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Server AttestationCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
npm install mcp-server-attestation
import { verifyManifestStrict, attestSpawnStrict, type SignedManifest } from "mcp-server-attestation";
import signed from "./signed/manifest.json" assert { type: "json" };
// 1. At startup: prove the manifest you ship is the manifest you signed.
verifyManifestStrict(signed);
// 2. Before every child_process.spawn:
attestSpawnStrict(signed as SignedManifest, { command, args });
That is the entire integration. Two function calls, no SaaS, no daemon.
If you would rather re-verify the signature on every spawn (defense-in-depth
against an unverified or swapped manifest reaching the gate), use the single
fail-safe call instead — it verifies then attests:
import { attestSpawnVerified, type SignedManifest } from "mcp-server-attestation";
attestSpawnVerified(signed as SignedManifest, { command, args });
```
| # | Name | readOnlyHint | destructiveHint |
| - | ---- | ------------ | --------------- |
| 1 | attest_verify_manifest | true | false |
| 2 | attest_inspect_spawn | true | false |
| 3 | attest_generate_manifest_template | true | false |
| 4 | attest_sign_manifest | false | false |
| 5 | attest_keygen | false | false |
Annotations are honest: attest_sign_manifest and attest_keygen write files on disk so they are not read-only, but they do not destroy existing data so destructiveHint stays false. See docs/THREAT-MODEL.md for the per-tool capability table.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"server attestation": {
"mcp-server-attestation": {
"command": "npx",
"args": [
"mcp-attest-demo"
]
}
}
}
}McpServers
{
"mcp-server-attestation": {
"command": "npx",
"args": [
"mcp-attest-demo"
]
}
}<!-- badges -->
<!-- /badges -->Layer-2 supply-chain hardening for Model Context Protocol servers. Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer.
Direct response to:
- OX Security marketplace-poisoning, April 2026 — 9 of 11 MCP registries accepted malicious servers. Anthropic's published position: "expected behavior".
- CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection.
- CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack.
This package provides what Anthropic chose not to: cryptographic verification of which tools a server is allowed to expose and which spawn calls it is allowed to make. It is a drop-in dependency, not a runtime replacement.
A note from us
We have been building tools and systems for ourselves for the past two years. The fact that this repo is small and has few stars is not because it is new. It is because we only just decided to share what we have built. It is not a fresh experiment, it is a long story with a recent commit.
We love building things and sharing them. We do not love social media tactics, growth hacks, or chasing stars and followers. So this repo is small. The code is real, it gets used, issues get answered. Judge for yourself.
If it helps you, sharing, testing, and feedback help us. If it could be better, an issue is more useful. If you build something with it, tell us at [email protected]. That genuinely makes our day.
From a small studio in Palma de Mallorca.
Packages (npm workspaces)
| Package | Purpose |
| --- | --- |
| mcp-server-attestation (packages/lib) | Library: Ed25519 sign/verify, manifest schema, sanitizer, spawn attester, TOFU trust store. |
| mcp-attest-cli (packages/cli) | CLI mcp-attest: keygen, sign, verify, inspect, fingerprint, check-pin. |
| mcp-attest-demo (packages/demo-server) | Reference MCP server (stdio, spec 2025-06-18) exposing 5 tools that demonstrate the library. |
Install
```bash
npm install mcp-server-attestation
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
