We scanned the 40 most-downloaded MCP servers on npm

21 of them refuse to tell you what they can do until you hand over an API key.

Your agent connects to tools that nobody has read. MonadGuard reads what a tool declares — its tools/list, its skill text — for hidden instructions, exfiltration and rug-pull patterns, signs the verdict with a P-256 key, and anchors it on Monad, where the contract verifies that signature itself. Nothing to trust on our side.

–

tools in registry

–

anchored scans

–

flagged critical

–

attestors

Registry

Every tool with at least one anchored scan, latest first. Select a row for its full history and findings.

Tool	Latest verdict	Risk	Scans	Last anchored
Loading registry…

Check a tool

Paste an MCP server's tools/list output or a SKILL.md. Scan returns the verdict and a signed receipt and writes nothing on-chain. With a passkey attestor unlocked below, Sign & anchor scans in your browser and puts your verdict on Monad.
A hosted server does not need pasting by hand: npm run capture:remote -- https://host/mcp opens an MCP session, reads its tools/list and closes, executing nothing. There is deliberately no box here that makes this server fetch a URL for you — that would turn it into a proxy into its own network.

Attest with a passkey

Become an independent attestor with nothing but a passkey. One fingerprint unlocks two keys — no wallet, no seed phrase, no server key.

Loading…

We scanned the most-downloaded MCP servers

Server	Downloads / mo	Tools	Verdict	Risk

A rule hit is not an accusation and a clean verdict is not a guarantee: this reads the declared interface, it does not run the tool. Method and full findings in the repo.

Use it in your agent

One call before connecting. Fails closed: CRITICAL, WARN, a stale verdict or a tool nobody scanned all stop the connection.

npm i monadguard

import { gate } from 'monadguard';
await gate({ kind: 'mcp', name: 'memory-server', origin: 'npm:@modelcontextprotocol/server-memory' });
await client.connect(transport);   // only reached when a fresh CLEAN verdict exists

In CInpx monadguard check npm:@acme/mcp-server --name acme-server

In a contractregistry.isCleared(toolId, contentHash, attestor, 30 days)

You pick the attestors you trust — the registry records who said what and gatekeeps nobody.

Verify it yourself

Nothing here needs to be trusted. The same data is on-chain and in two independent indexes.

ScanRegistry contract0xd0f6edd9be9cde91f671f4c2e129ee6105358436

GraphQL · Envio Cloudhttps://indexer.dev.hyperindex.xyz/c532682/v1/graphql

GraphQL · self-hostedhttps://graphql.monadguard.com/v1/graphql

REST APIhttps://api.monadguard.com/registry

curl -s https://indexer.dev.hyperindex.xyz/c532682/v1/graphql \
  -H 'content-type: application/json' \
  -d '{"query":"{ Scan { blockNumber verdict score txHash } Tool { id scanCount } }"}'