MCP Server Attestation
Cryptographic hardening layer for MCP servers that signs tool manifests with Ed25519 and validates spawn calls before execution. Drop in verifyManifestStrict at startup and attestSpawnStrict before every child_process.spawn to block the command injection and malicious update vectors that hit Serverless Framework and Cursor in 2025. Ships with a TOFU trust store, default-deny argument sanitizer that blocks shell metacharacters and Unicode exploits, and a CLI for keygen, signing, and verification. Built as a direct response to marketplace poisoning and CVE-2025-69256. Reference server exposes five tools including manifest signing, spawn inspection, and key generation. Opt into Sigstore Rekor cross-reference for transparency log verification beyond local pinning.
- tools
- 5
- transport
- STDIO
- last updated
- Aug 19, 2026
Tools
5 toolsPublic tool metadata for what this MCP can expose to an agent.
attest_verify_manifestReference server tool that verifies a signed manifest.
Reference server tool that verifies a signed manifest.
No parameter schema in public metadata yet.
attest_inspect_spawnReference server tool that inspects a spawn call against a manifest.
Reference server tool that inspects a spawn call against a manifest.
No parameter schema in public metadata yet.
attest_generate_manifest_templateReference server tool that generates a manifest template.
Reference server tool that generates a manifest template.
No parameter schema in public metadata yet.
attest_sign_manifestReference server tool that signs a manifest; it writes files on disk.
Reference server tool that signs a manifest; it writes files on disk.
No parameter schema in public metadata yet.
attest_keygenReference server tool that generates an Ed25519 keypair; it writes files on disk.
Reference server tool that generates an Ed25519 keypair; it writes files on disk.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Part of the StudioMeyer MCP Stack — Built in Mallorca 🌴 · ⭐ if you use it
mcp-server-attestation
Details
- Repository
- github.com/studiomeyer-io/mcp-server-attestation
- Package
mcp-attest-demo- Transport
- STDIO
- Registry
- MCP registry, active