A command for auditing and approving a specific version of an MCP package before installation, using a Zero-Trust Validation Protocol and an allowlist, a record of permitted packages.

Use it to inspect package ownership and publishing details, compare them with expected project information, and add an approved package version to the allowlist.

It reduces supply-chain risk by requiring an exact version, checking its source, and recording approval only after human review.

mcp-approve — Command for Claude Code by MilindGaharwar

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/MilindGaharwar/fettle

Made for: Claude Code.

Or install fettle, the plugin that ships this one along with the rest of its 34 commands, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/milindgaharwar/fettle/mcp-approve.svg)](https://agentmods.dev/commands/milindgaharwar/fettle/mcp-approve)

Your own site

<a href="https://agentmods.dev/commands/milindgaharwar/fettle/mcp-approve"><img src="https://agentmods.dev/badge/commands/milindgaharwar/fettle/mcp-approve.svg" alt="Measured on agentmods" height="20"></a>

Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,019 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 94% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00021	$0.01019
Opus 5	$0.00010	$0.00509
Sonnet 5	$0.00004	$0.00204
Haiku 4.5	$0.00002	$0.00102

Measured 7d ago against content hash 607d36ceee45, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

mcp-approve scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Writes to a temp file then sudo copies it to the ledger path

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- Grep for red flags: `child_process.exec`, `eval(`, `Function(`, `fs.writeFile`, `process.env`, outbound network calls, obfuscated code

Origin

This is a copy

94% identical to fettle-mcp-approve — 9 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

commands/mcp-approve.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Run the full 5-phase MCP Zero-Trust Validation Protocol to audit a package, then — with human approval — add it to the root-owned allowlist ledger.

Procedure

Parse arguments. Extract package name and exact version from $ARGUMENTS (e.g., @playwright/[email protected]). If no version is pinned, STOP and ask for an exact version — unpinned packages are never approved.
Locate the ledger. The allowlist lives at ~/.config/fettle/mcp-allowlist.json by default. Precedence: a policy-pinned [gates.mcp_trust].allowlist_path in the effective config wins; otherwise the MCP_ALLOWLIST_PATH env var; otherwise the default. Check fettle config --print-effective for a pinned path.
Check if already approved. Read the allowlist ledger and check if this exact package@version is already present under packages. If so, report it and stop.
Phase 1 — Package Provenance & Supply Chain
- Run npm view <package>@<version> --json to get publisher, download stats, repo link, publish date
- Verify publisher is the expected organization
- Cross-reference npm maintainers against known project contributors
- Check for recent ownership transfers or suspicious maintainer changes
- Run npm audit for known CVEs
- Present findings to user with PASS/WARN/FAIL for each check
Phase 2 — Source Code Review
- Download without installing: npm pack <package>@<version>
- Extract tarball to /tmp/mcp-audit-<package>/
- Review ALL runtime files (not just README)
- Grep for red flags: child_process.exec, eval(, Function(, fs.writeFile, process.env, outbound network calls, obfuscated code
- Map every exposed MCP tool to its blast radius
- Count total lines of runtime code
- Present findings to user
Phase 3 — Dependency Tree Audit
- Count transitive dependencies
- Check npm audit on full resolved tree
- Flag dependencies with <100 weekly downloads or recent ownership transfers
- Present findings to user
Phase 4 — Runtime Isolation Test
- Start the MCP server in a subprocess
- Check ports opened (ss -tulpn), filesystem paths touched, DNS lookups
- Test one benign operation and observe side effects
- Verify no unexpected phone-home or persistent connections
- Present findings to user
Phase 5 — Permission Scoping
- Recommend MCP tool allowlist for settings.json
- Recommend network restrictions if supported
- Recommend --isolated mode if available
- Recommend output directory restrictions
- Present recommendations to user
Compute tarball SHA256. Run sha256sum on the downloaded tarball.
Write audit report. Save the full audit report (all 5 phases with findings) to .fettle/audits/<package>-<version>.md with date and auditor.
Present summary and ask for human approval. Show:
- Overall verdict: APPROVE / REJECT / CONDITIONAL
- Phase-by-phase summary (PASS/WARN/FAIL)
- Any conditions or restrictions
- Ask: "Do you approve adding @ to the allowlist?"
If approved, update the ledger via sudo. Use a Python script that:
- Reads the current allowlist ledger
- Adds the new package entry under packages with version, sha256_tarball (npm) or sha256_wheel (Python), audit date, auditor, report path, and approved_by_human: true; set allow_source: true only when a source build was explicitly audited
- Writes to a temp file then sudo copies it to the ledger path
- Sets ownership to root:root and permissions to 0644
Confirm the ledger was updated by reading it back.

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 81 lines · 21 tokens per session scan A 607d36ceee45

Subscribe to this mod's changes

mcp-approve is a command published in the GitHub repository MilindGaharwar/fettle (2 stars, last pushed 3d ago), licensed Apache-2.0. It adds 21 tokens to every session and 1,019 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 2 findings (asks for root, runs shell commands). It is 94% identical to fettle-mcp-approve, differing in 9 lines, and is treated as a copy.

Claude Code Security ai-agents cli codex-cli developer-tools devsecops

scout-scan

Scan a path with Scout and walk through the security findings.

Varpost/Scout · 12 tokens

kb-ingest

Ingest external material into Sources/ inside the bound project KB, then update registry, index, and daily note as needed.

Galaxy-Dawn/claude-scholar · 29 tokens

atomic-plan

Write a design doc (concepts, business rules, approaches) and a checkpoint-table spec (contract) for non-trivial work; inline spec only for trivial. Gauges triviality; loops spec authoring with subagents. Human-facing artifact, Mermaid diagrams allowed.

damusix/atomic-claude · 54 tokens

mcp-approve