MCP-SUPPLY-02 — Trusted Package Sources and Registry Verification#

// .npmrc
registry=https://registry.npmjs.org/
@anthropic:registry=https://registry.npmjs.org/
@microsoft:registry=https://registry.npmjs.org/
audit-level=critical

const crypto = require('crypto');
const fs = require('fs');

const TRUSTED_PACKAGES = {
  '@anthropic/mcp': {
    publisher: 'anthropic',
    minVersion: '1.0.0',
    checksums: {
      '1.0.0': 'sha256:abc123...',
      '1.0.1': 'sha256:def456...'
    }
  },
  '@modelcontextprotocol/server-memory': {
    publisher: 'mcp-team',
    namespace: '@modelcontextprotocol'
  }
};

function verifyPackage(packageName, version) {
  const trusted = TRUSTED_PACKAGES[packageName];
  if (!trusted) {
    throw new Error(`Unknown package: ${packageName}`);
  }

  // Verify namespace matches
  if (trusted.namespace && !packageName.startsWith(trusted.namespace)) {
    throw new Error(`Invalid namespace for ${packageName}`);
  }

  // Check against known checksums
  if (trusted.checksums && trusted.checksums[version]) {
    const packagePath = `node_modules/${packageName}/package.json`;
    const hash = crypto.createHash('sha256')
      .update(fs.readFileSync(packagePath))
      .digest('hex');

    if (hash !== trusted.checksums[version]) {
      throw new Error(`Checksum mismatch for ${packageName}@${version}`);
    }
  }
}

# requirements.txt with hash verification
mcp-server-python==1.0.0 \
    --hash=sha256:abcdef1234567890abcdef1234567890abcdef12

# Install with verification
pip install --require-hashes -r requirements.txt

# Pull with content trust enabled
export DOCKER_CONTENT_TRUST=1
docker pull anthropic/mcp-server:latest

# Verify image signature
docker trust inspect anthropic/mcp-server:latest

# Use specific digests instead of tags
docker pull anthropic/mcp-server@sha256:abc123...

// go.mod with checksums
module github.com/mycompany/mcp-client

require (
    github.com/anthropic-ai/mcp-go v1.0.0
)

// go.sum automatically maintains checksums
// Verify with: go mod verify

import difflib
from packaging import version

OFFICIAL_PACKAGES = [
    'mcp-server-anthropic',
    '@anthropic/mcp',
    '@microsoft/playwright-mcp'
]

def check_typosquats(package_name):
    # Check similarity to official packages
    for official in OFFICIAL_PACKAGES:
        similarity = difflib.SequenceMatcher(
            None, package_name, official
        ).ratio()

        if 0.8 < similarity < 1.0:  # Similar but not exact
            return f"WARNING: '{package_name}' similar to '{official}'"

    # Check common typosquat patterns
    suspicious_patterns = [
        'mcpp-',     # Extra 'p'
        'mpc-',      # Transposed letters
        'ncp-',      # Adjacent key
        '-mcps',     # Plural
        'test-mcp',  # Test prefix
    ]

    for pattern in suspicious_patterns:
        if pattern in package_name:
            return f"WARNING: Suspicious pattern '{pattern}' in name"

    return None

# NPM: Verify publisher
npm view @anthropic/mcp maintainers
npm audit signatures  # Requires npm 8.13.0+

# Check for typosquats
npm search mcp-server --json | jq '.[].name' | grep -E '(mcpp|mpc-|ncp)'

# Python: Verify package metadata
pip show mcp-server-python
pip list --format json | jq '.[] | select(.name | contains("mcp"))'

# Go: Verify module checksums
go mod verify
go list -m all | grep mcp

# Container: Verify signatures
cosign verify anthropic/mcp-server:latest \
  --certificate-identity=anthropic@example.com \
  --certificate-oidc-issuer=https://github.com/login/oauth

# GitHub Actions workflow
name: Verify MCP Dependencies
on: [pull_request]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Check package.json
        run: |
          ALLOWED_MCP="@anthropic/mcp @microsoft/playwright-mcp"
          for pkg in $(jq -r '.dependencies | keys[]' package.json | grep mcp); do
            if ! echo "$ALLOWED_MCP" | grep -q "$pkg"; then
              echo "ERROR: Unauthorized MCP package: $pkg"
              exit 1
            fi
          done

      - name: Verify checksums
        run: |
          npm ci
          npm audit signatures