Dredd MCP

pduggusa/dredd-mcp

A preflight security layer that checks MCP servers before your agent invokes their tools. Dredd queries its threat intelligence backend to flag compromised dependencies, tool surface drift, remote URL changes, and permission escalation. It returns BLOCK, ADVISORY, or ALLOW verdicts in under 200ms, each HMAC-signed. You call check_mcp_server with a server name, optional version, and optional tool name before execution. Useful if you're consuming third-party MCP servers and want a second opinion on whether their dependency tree or runtime behavior has shifted since you last vetted them. Fails open by design so it won't brick your workflow if the backend is unreachable.

tool: 1
transport: HTTP
last updated: Oct 20, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://analytics.dugganusa.com/api/v1/dredd/mcp --name dredd-mcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http dredd-mcp https://analytics.dugganusa.com/api/v1/dredd/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 1 tools

Verified live against the running server on Nov 6, 2026.

check_mcp_serverPre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALL...3 params

Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALL...

Parameters* required

server*string

REQUIRED. The server to judge: its exact MCP Registry name (io.github.owner/server-name, optionally @version). A bare name (server-name) is judged as typed, never mapped to a registry server, and t...

toolstring

Optional name of the specific tool being invoked

versionstring

Optional version of the MCP server (semver). A version inside `server` (name@1.2.3) is used when this is empty.

Readme

Dredd MCP — Pre-Flight Security for the MCP Ecosystem

DugganUSA turns scattered public threat reporting into feeds and pre-install checks a small team can use in minutes. It cites its sources, says what it does not know, and corrects itself in public.

Free API key: https://analytics.dugganusa.com/stix/register. One key covers the feed, the API, the MCP servers, Edge Shield and the Checks Action. Questions: https://docs.dugganusa.com/faq/

Docs: https://docs.dugganusa.com/agents/dredd/

You do you. I do me. We share contexts.

Everything is context now: data, transport, the TV in your living room. Share the context, never the core. Dredd judges what's about to cross into your agent before it runs: the server, its full dependency tree, and the CVEs published against it. Every verdict is signed, and you get an honest unknown when we couldn't see.

"Jeevesus saves. Dredd judges."

View the full README on GitHub

Details

Repository: github.com/pduggusa/dredd-mcp
Website: analytics.dugganusa.com/api/v1/dredd
Transport: HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026