MCP.so
Sign In

Server Attestation

@studiomeyer-io

RepositoryHomepage

About Server Attestation

Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-server-attestation": {
      "command": "npx",
      "args": [
        "mcp-attest-demo"
      ]
    }
  }
}

Tools

No tools detected

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is Server Attestation?

Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.

How to use Server Attestation?

The README includes setup instructions such as npx mcp-attest-demo.

Key features of Server Attestation

  • CVE-2025-69256 — Serverless Framework MCP RCE via child_process.exec() command injection
  • CVE-2025-61591 — Cursor MCP RCE through OAuth-installed malicious server with spawn hijack
  • Canonical JSON is the signed surface. Re-serialisation cannot change the signed bytes
  • Sandbox or containerise the server process
  • OAuth flow hardening (separate mcp-oauth-shield build)

Use cases of Server Attestation

  • Connect an MCP-compatible client to this repository's service.
  • Review the README-backed setup before enabling it in production.

FAQ from Server Attestation

Where is the source code for Server Attestation?

The source code is linked from the repository URL on this page.

Does Server Attestation include a standard MCP config?

If the README contains a parseable MCP configuration block, it is shown in the Config tab.

Frequently asked questions

Where is the source code for Server Attestation?

The source code is linked from the repository URL on this page.

Does Server Attestation include a standard MCP config?

If the README contains a parseable MCP configuration block, it is shown in the Config tab.

Comments

Basic information

License

MIT

Author

studiomeyer-io

Submitted by

Matthias Meyer - StudioMeyer

More MCP servers

q-ring

I4cTime

Quantum-inspired keyring for AI coding agents. Secure secrets with superposition, entanglement, tunneling, and teleportation — CLI + 44 MCP tools.

3

Sugra API MCP

Sugra Systems, Inc.

Official MCP server for the Sugra API, giving AI agents source-attributed access to 1,500+ endpoints across 36 data domains from 160+ primary sources. Covers markets, economics, company fundamentals, government, news, cl

1

FiatDock

fiatdock

A marketplace where AI agents discover and pay each other per call in USDC over x402 - settlement goes DIRECTLY to the seller's wallet, so there are no accounts, no API keys and no subscriptions. Buy from 24 live MCP ser

1

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

1

LocalCan

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

82