Server Attestation
About
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.
Details
- Author
- studiomeyer-io
- Downloads
- 210
Jump to
- CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection
- CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack
- Canonical JSON is the signed surface. Re-serialisation cannot change the signed bytes
- Sandbox or containerise the server process
- OAuth flow hardening (separate mcp-oauth-shield build)
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Server AttestationCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
The README includes setup instructions such as npx mcp-attest-demo.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"server attestation": {
"mcp-server-attestation": {
"command": "npx",
"args": [
"mcp-attest-demo"
]
}
}
}
}McpServers
{
"mcp-server-attestation": {
"command": "npx",
"args": [
"mcp-attest-demo"
]
}
}mcp-server-attestation
<!-- badges -->
<!-- /badges -->Layer-2 supply-chain hardening for Model Context Protocol servers. Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer.
Direct response to:
- OX Security marketplace-poisoning, April 2026 — 9 of 11 MCP registries accepted malicious servers. Anthropic's published position: "expected behavior".
- CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection.
- CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack.
This package provides what Anthropic chose not to: cryptographic verification of which tools a server is allowed to expose and which spawn calls it is allowed to make. It is a drop-in dependency, not a runtime replacement.
A note from us
We have been building tools and systems for ourselves for the past two years. The fact that this repo is small and has few stars is not because it is new. It is because we only just decided to share what we have built. It is not a fresh experiment, it is a long story with a recent commit.
We love building things and sharing them. We do not love social media tactics, growth hacks, or chasing stars and followers. So this repo is small. The code is real, it gets used, issues get answered. Judge for yourself.
If it helps you, sharing, testing, and feedback help us. If it could be better, an issue is more useful. If you build something with it, tell us at hello@studiomeyer.io. That genuinely makes our day.
From a small studio in Palma de Mallorca.
Packages (npm workspaces)
| Package | Purpose |
| --- | --- |
| mcp-server-attestation (packages/lib) | Library: Ed25519 sign/verify, manifest schema, sanitizer, spawn attester, TOFU trust store. |
| mcp-attest-cli (packages/cli) | CLI mcp-attest: keygen, sign, verify, inspect, fingerprint, check-pin. |
| mcp-attest-demo (packages/demo-server) | Reference MCP server (stdio, spec 2025-06-18) exposing 5 tools that demonstrate the library. |
Install
```bash
npm install mcp-server-attestation
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
