MCP.so
Sign In

Server Attestation

@studiomeyer-io

RepositoryHomepage

About Server Attestation

Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-server-attestation": {
      "command": "npx",
      "args": [
        "mcp-attest-demo"
      ]
    }
  }
}

Tools

No tools detected

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is Server Attestation?

Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.

How to use Server Attestation?

The README includes setup instructions such as npx mcp-attest-demo.

Key features of Server Attestation

  • CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection
  • CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack
  • Canonical JSON is the signed surface. Re-serialisation cannot change the signed bytes
  • Sandbox or containerise the server process
  • OAuth flow hardening (separate mcp-oauth-shield build)

Use cases of Server Attestation

  • Connect an MCP-compatible client to this repository's service.
  • Review the README-backed setup before enabling it in production.

FAQ from Server Attestation

Where is the source code for Server Attestation?

The source code is linked from the repository URL on this page.

Does Server Attestation include a standard MCP config?

If the README contains a parseable MCP configuration block, it is shown in the Config tab.

Frequently asked questions

Where is the source code for Server Attestation?

The source code is linked from the repository URL on this page.

Does Server Attestation include a standard MCP config?

If the README contains a parseable MCP configuration block, it is shown in the Config tab.

Comments

Basic information

License

MIT

Author

studiomeyer-io

Submitted by

Matthias Meyer - StudioMeyer

More MCP servers

Lumify Sports Intelligence

Lumify

Agent-ready sports intelligence API: live scores, odds, line movement, public betting splits, and explainable bet confidence — via 16 MCP tools at https://lumify.ai/mcp. Get a free key instantly — no signup, email, or ca

Vibgrate MCP

Vibgrate

Query your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up

3

TranscriptFetch MCP Server

TranscriptFetch

Model Context Protocol (MCP) server for TranscriptFetch: fetch YouTube transcripts, search, channels, and playlists from any MCP client.

discoverGPT

Joe Monastiero

discoverGPT is visualAI's unified MCP gateway for AI commerce, exposing 29 tools across four capabilities on one canonical product catalog: trimodal search (natural-language, precise-color, and image-similarity), AI cata

B

Boson Protocol

Boson Protocol is a remote MCP server available at https://mcp.bosonprotocol.io.