MCP · certified
Northstar Scanner MCP
Scan a Skill before it loads. The 2026 supply chain, as a tool.
Publisher
Northstar Security
License
commercial-usage
Latest
2.2.0
Installs
4,400
Thesis
MCP interface to Northstar's Skill scanner: permission-manifest drift, known-bad packages, over-scoped network, unsigned builds.
1,200+ malicious Skills in early 2026. The scanner is how certified is earned. Call it from the supervisor before any community-tier install.
Direction
This listing is a reference. The tree lives at origin. The command is how you load it here.
Subscribe (usage) → hm install northstar/northstar-scanner-mcp@2.2.0
Fail closed. A timeout is a deny.
Versions
| Semver | SHA | Released | Notes | Signed |
|---|---|---|---|---|
| 2.2.0 | nsmcp22 | 2026-08-13 | 1,200+ known-bad graph. Manifest drift. | signed · sbom |
Subscribe
$0.02
Usage · scan
Enterprise from $9,000
Subscribe, then pin. Entitlement is checked at deploy, not in a PDF.
Compatibility
- helix-supervisor
- claude-code
- codex-cli
- grok-build
- opencode
Permission manifest
- fs.read
- —
- fs.write
- —
- network
- scanner.northstar.security
- exec / secrets
- no-exec · NORTHSTAR_KEY