MCP servers distributed via npm are one of the fastest-growing AI artifact types. artguard should be able to scan an npm package (local tarball or directory) containing an MCP server config.
What to build:
- Detect MCP server packages by looking for
mcp.json, tool definitions in package.json, or server manifest files
- Parse tool definitions, permission scopes, and network endpoints
- Extract README/description claims for Layer 1 privacy posture comparison
Why it matters:
npm MCP packages are being installed with zero review. This is arguably the highest-risk artifact type in the wild right now.
MCP servers distributed via npm are one of the fastest-growing AI artifact types. artguard should be able to scan an npm package (local tarball or directory) containing an MCP server config.
What to build:
mcp.json, tool definitions inpackage.json, or server manifest filesWhy it matters:
npm MCP packages are being installed with zero review. This is arguably the highest-risk artifact type in the wild right now.