passmcp
Tests any MCP server the way an agent would: 138 checks in nine phases, read-only by default, every finding tied to the request that showed it, and a signed attestation at the end.
Check a serverOpen source · runs where your credentials already are · no telemetry
Evidence you can check, for the servers your agents trust.
Satellion builds open-source tools that test the infrastructure AI agents connect to, and prove what they found. Every finding cites the request that showed it, and every verdict can be verified offline by someone who does not have to trust us.
What we build
One question, answered with evidence: is it safe to connect to?
Agents are being connected to MCP servers faster than anyone checks them. These tools do the checking, and leave a record anyone can verify.
Fleets and drift
passmcp fleet run checks every server you depend on, on a schedule, and fails the moment one changes in a way that matters, such as a tool that stops claiming to be read-only.
Watch a fleetOpen attestation formats
The in-toto predicates passmcp writes, their JSON Schemas and the offline verifier are Apache-2.0, so a gateway, a registry or a CI system can check a verdict without running us.
Read the formatA public scorecard
Every remote server in the MCP Registry, checked read-only and without credentials, each result an attestation, and anything that would expose a vulnerability withheld for its owner first. Released in passmcp-registry 0.0.1.
Follow the registryThe passmcp family
Nine components, one version.
The family moves in lockstep: one version across every component, released together. Each status links to its release, or to the changelog that tracks what is not released yet.
| Component | Purpose | Status |
|---|---|---|
| passmcp | The engine, every check, and the three peer surfaces: CLI, TUI and the embedded local web UI. | Released in 0.0.8 |
| passmcp-reporting | The attestation predicate, its JSON Schema and the offline verifier, as a module with no dependencies; the report schema, the renderers and the rubric as data follow when a consumer needs them. | Released in 0.0.8 |
| passmcp-server | An MCP server exposing passmcp's diagnostics as read-only tools, so an agent can evaluate a server, or check an attestation about one, from inside the editor. | Released in 0.0.8 |
| passmcp-action | The GitHub Action wrapping the published image by digest, and a GitLab CI template. | Released in 0.0.8 |
| passmcp-graph | A local graph of which agents use which MCP servers, which tools those servers expose and which identities reach them, built from passmcp's attestations, reports and MCP client configurations, queried offline and gated by policy in CI. | Released in 0.0.8 |
| passmcp-registry | The tooling for a signed public scorecard of the remote servers in the MCP Registry: each checked read-only and without credentials by a pinned passmcp release, every result an offline-verifiable attestation, and anything that would expose a vulnerability withheld for its owner first. No run has been published yet. | Released in 0.0.8 |
| passmcp-lsp | A language server over MCP artefacts — server.json, tool schemas, client configuration, passmcp policy and attestation files — with check-id hover from the guidance catalogue. | Released in 0.0.8 |
| passmcp-census | The reliability census of the MCP Registry's remote servers: the methodology, the disclosure log and the command that reproduces the figures. No edition has been published yet. | Released in 0.0.8 |
| satellion.com | The public site at satellion.com, built with SSG against passmcp's latest release: the home page, the manual and a sample report passmcp generates. | Released in 0.0.8 |
How we work
The rules every tool here keeps.
Evidence, not opinions
A check passes only when a request showed the property. One that could not look says so and why, and never counts as a pass.
Nothing phoned home
No telemetry, no account, no API key. The tools run on your machine or your CI runner and contact only what you point them at.
Safe on production
Read-only by default: only tools a server declares read-only are ever invoked, so pointing passmcp at a live system changes nothing.
Open by default
The source, the formats and the check inventory are public. Anyone can see exactly what was tested and how.
Trust
Held to the same standard we check others against.
Security policy
Report a vulnerability privately; it is acknowledged within 72 hours and fixed within 90 days.
Read the policyAdvisories
Every fixed vulnerability is published as a GitHub security advisory, with the affected versions.
See the advisoriesEU Cyber Resilience Act
Each release carries an SBOM per artefact and SLSA provenance, and an OpenVEX statement whenever a dependency advisory does not affect it, with every claim linked to its evidence.
See the evidence