SOC 2 Type II (CC6.1, CC6.6 & CC8.1) MCP Supply-Chain Audit Record
Live cryptographic audit snapshot (2026-11-13): 2,032 MCP packages SHA-512 inspected so far out of 5,003 indexed MCP servers (automated 4-hour backfill sweep running).
SHA-512 INSPECTED
2,032 / 5,003
SLSA PROVENANCE
1,010
INSTALL SCRIPTS BLOCKED
157
DEPRECATED BLOCKED
6
CC6.6 Boundary Control: Blocked MCP Packages Executing Install Scripts
| Package | Verdict | Observed npm Script / Notice |
|---|---|---|
| @wonderwhy-er/desktop-commander (npm MCP) Pin: 0.3.3 · Sign-Off Sheet |
PENDING REVIEW | postinstall: node dist/track-installation.js && node dist/npm-scripts/verify-ripgrep.js || no |
| @modelcontextprotocol/inspector (npm MCP) Pin: 2.15.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/install-clients.mjs |
| @azure/mcp (npm MCP) Pin: 4.0.0-beta.7 · Sign-Off Sheet |
NO-GO · BLOCKED | postinstall: node ./scripts/post-install-script.js |
| agentdb (npm MCP) Pin: 3.10.1 · Sign-Off Sheet |
NO-GO · BLOCKED | postinstall: node scripts/postinstall.cjs || true |
| agentic-flow (npm MCP) Pin: 3.5.5 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/postinstall.js || true |
| @claude-flow/cli (npm MCP) Pin: 3.77.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node ./scripts/postinstall.cjs |
| @bike4mind/cli (npm MCP) Pin: 4.0.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node -e "try { require('better-sqlite3') } catch (e) { if (e.message.includes('b |
| cline (npm MCP) Pin: 3.0.74 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node ./postinstall.mjs || true |
| @gitkraken/gk (npm MCP) Pin: 3.1.77 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node install.js |
| @tacticlaunch/mcp-linear (npm MCP) Pin: 1.4.5 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node -e "try { require('fs').chmodSync('./dist/index.js', '755') } catch (e) {}" |
| gitnexus (npm MCP) Pin: 1.6.12 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/build-tree-sitter-grammars.cjs |
| instar (npm MCP) Pin: 1.3.1745 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/fix-better-sqlite3.cjs |
| @drawio/mcp (npm MCP) Pin: 1.12.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node src/postinstall.js |
| agent-afk (npm MCP) Pin: 5.353.1 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/postinstall.mjs || true |
| corsair (npm MCP) Pin: 0.1.180 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/postinstall-frpc.mjs |
| agnix (npm MCP) Pin: 0.61.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node install.js |
| @nanonets/graft (npm MCP) Pin: 0.29.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/postinstall.mjs |
| loki-mode (npm MCP) Pin: 11.139.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node bin/loki-postinstall.js || exit 0 |
| @hasna/todos (npm MCP) Pin: 0.18.0 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node postinstall.js |
| @aashari/mcp-server-atlassian-jira (npm MCP) Pin: 3.3.0 · Sign-Off Sheet |
NO-GO · BLOCKED | postinstall: node scripts/ensure-executable.js |
| zames_pro (npm MCP) Pin: 2.96.27 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node scripts/postinstall.mjs |
| open-computer-use (npm MCP) Pin: 1.1.4 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node ./scripts/postinstall.mjs |
| @hasna/domains (npm MCP) Pin: 0.3.3 · Sign-Off Sheet |
GO · WHITELISTED | postinstall: node postinstall.js |
| @meta-quest/metavr (npm MCP) Pin: 1.10.0 · Sign-Off Sheet |
NO-GO · BLOCKED | postinstall: node postinstall.js |
| @coinbase/cdp-cli (npm MCP) Pin: 2.0.149 · Sign-Off Sheet |
NO-GO · BLOCKED | postinstall: node scripts/postinstall.mjs |
CC8.1 Approved Lockfile Examples (SHA-512 + SLSA Attested + Zero Install Hooks)
| Package | Pinned Version | SHA-512 Digest |
|---|---|---|
| @modelcontextprotocol/sdk (npm MCP) | 1.32.2 |
sha512-SWsVtH/0vULSQStoZ6xxH2K09... |
| ai (npm MCP) | 7.0.171 |
sha512-YGyMIMn7XZY1H1EwSGn0QItd8... |
| @modelcontextprotocol/core (npm MCP) | 2.4.0 |
sha512-z8QBKqdfXLPzkLQuG4xp8hrVE... |
| @modelcontextprotocol/server (npm MCP) | 2.4.0 |
sha512-rgR9yxSaAJ+bcsi/XroT/S2Af... |
| @modelcontextprotocol/client (npm MCP) | 2.4.0 |
sha512-LgrD2OphHuG12vfKFKz6SOnq7... |
| @modelcontextprotocol/ext-apps (npm MCP) | 2.0.4 |
sha512-B+PcbuGiaf0e5I3uy4iO5tS3A... |
| @ai-sdk/mcp (npm MCP) | 2.0.98 |
sha512-KSXh7KMA9KZiDbUSoq7TR292l... |
| @modelcontextprotocol/node (npm MCP) | 2.1.2 |
sha512-IIcIqBpr6NCQQs5DgJTgvbSOA... |
| @earendil-works/pi-mcp (npm MCP) | 1.5.2 |
sha512-zU1UgeXDlbixPqGEWD7Ql0brE... |
| @storybook/addon-mcp (npm MCP) | 10.6.7 |
sha512-UU3zMALeW5tee35WYsTU6PZE2... |
| @assistant-ui/react (npm MCP) | 0.15.36 |
sha512-cFaOFrPIRTZgzHMh7tCUEf6fj... |
| @storybook/mcp (npm MCP) | 10.6.7 |
sha512-mqCEG/vW7dnOYjIO5GoDapePj... |
| chrome-devtools-mcp (npm MCP) | 1.13.0 |
sha512-Yf4qhS0+2oo7c+gOySMDHQt4Z... |
| fallow (npm MCP) | 3.42.0 |
sha512-zVug6ujNPVVW706qDL5OZvjD+... |
| mcp-handler (npm MCP) | 2.4.0 |
sha512-jJYsZ9lCswOiRQXaAtWuFLWGs... |
| @modelcontextprotocol/express (npm MCP) | 2.0.2 |
sha512-lUvfV7gT/tgP8nLRs0ajUtgL+... |
| @modelcontextprotocol/server-pdf (npm MCP) | 2.0.4 |
sha512-0pTyYOiBAhB7s00qdp6S8tCtH... |
| mcp-remote (npm MCP) | 0.16.6 |
sha512-QqlBqut/oeDUFwrB/Igs5vGik... |
| @better-auth/cimd (npm MCP) | 1.7.22 |
sha512-m6gCxcPRbmafFbAXWRWyHqqAJ... |
| @better-auth/mcp (npm MCP) | 1.7.22 |
sha512-DXnqMA8L8pgRg/yTcFRSYSUA6... |
Full machine-readable audit bundle: GET /v1/export/soc2-evidence.json (included in the $149 SOC 2 Evidence Pack).