Package.json & MCP Manifest Security Auditor
Audit package.json, requirements.txt & mcp.json for typosquatting, risky shell hooks & secrets.
๐ 100% Local Browser Execution โ Files never leave your device โ No email ยท No sign-up ยท No watermark ยท Free
Load Sample Manifest:
Safety Score: 100/100 Paste
package.json, mcp.json or requirements.txt Supply-Chain Security Audit Findings
๐ Chain next workflow: Jump straight to a related tool
How to Use Package.json & MCP Manifest Security Auditor
- Paste your package.json, mcp.json (Claude Desktop / Cursor / Antigravity MCP config), or requirements.txt file โ or load a sample manifest.
- Review the instant security risk score (0โ100) and detailed findings broken down by Critical, High, Medium, and Informational severity.
- Export the audit report as Markdown or JSON to attach to your pull request or security review.
Protect Your Codebase & AI Coding Agents from Supply-Chain Attacks
As developers rapidly install npm packages, Python dependencies, and Model Context Protocol (mcp.json) servers from GitHub and community posts, supply-chain attacks have surged. Malicious packages frequently rely on Levenshtein typosquatting (e.g. lodahs, axois, react-domm), hidden preinstall / postinstall shell execution hooks (curl ... | sh), unpinned wildcard versions (*), or plaintext API keys inside MCP environment blocks.
Shoal's Package & MCP Manifest Auditor inspects your configuration locally in milliseconds without uploading proprietary manifests or secret environment variables to any external server.