daily-supply-chain-audit

Run a daily supply chain audit by executing the skill command, which validates installed MCP server versions, checks config baselines, and scans for known vulnerabilities. It generates a timestamped markdown report with severity-based exit codes for gating.

Config drift detection works by deterministic baseline diffing, comparing current agent tool configurations and hook content hashes against established baselines. It identifies unauthorized changes to MCP servers, installed skills, and package versions.

Yes, you can enforce pinned dependency versions and release-age gating for MCP tools. The audit flags unpinned tool version specs and detects packages published too recently based on your active protection level to prevent supply chain risks.

Yes, you need node/npm and python3 installed to perform an MCP security audit, along with jq, mcp-scan, mcp-scanner, and shasum. These dependencies enable version validation, vulnerability scanning, and package integrity checks.

The best way to check for plaintext secrets in MCP configurations is running this audit skill, which detects plaintext-looking secrets in configs and performs static checks on skill scripts for risky patterns like unsafe shell pipelines.

Run a supply chain audit for agent safety beyond your daily morning check after installing new MCP servers or skills, and whenever you suspect prompt injection, tool poisoning, configuration drift, or vulnerabilities. It verifies post-install integrity.