Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Three pull requests to yunaremaia/mcp-guard, an MCP server supply-chain and security scanner, addressed empty-scan exit codes, tool-risk keyword false positives, and npm provenance verification. Edison Flores’s account says the most consequential review finding was in mcp-guard verify: an incorrect assumption about npm’s attestation endpoint meant the feature would report every package as unsigned. Flores says the three changes merged in roughly 36 hours; the pull requests and current repository behavior have not been independently confirmed here.
What the three pull requests changed
Flores describes three independently scoped changes, identified as PRs #87, #88, and #86. The work touched different parts of the scanner, but each addressed a boundary that matters to users: whether a clean scan passes, whether a tool name is classified fairly, and whether a package’s provenance can be checked accurately.
| Pull request | Problem described | Reported change |
|---|---|---|
| #87 | An empty scan could fail a severity threshold. | Use a distinct default when there are no findings, with two regression tests. |
| #88 | Substring matching could label benign tool names as destructive. | Match name segments and description word boundaries, while keeping suppression narrow. |
| #86 | A presumed npm attestation endpoint returned 404 even for a package Flores says was signed. | Read the attestation URL from version metadata when available and distinguish a missing pinned version from missing attestation data. |
The article says the changes and tests were AI-assisted using Claude and GLM under human direction. Flores credits maintainer reviews with improving all three. The implementation details below are his account, not an independently verified description of the current code.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why a clean scan should pass a severity gate
In Flores’s account, scan --fail-on low returned exit code 1 when the scan found no issues. The reported cause was a calculation using max(severities, default=0): with an empty findings list, the default value of zero equaled the threshold for the lowest severity, so the command behaved as if it had found a low-severity issue.
#1 Best Overall
The described fix changes the empty-list default to -1, separating “no findings” from “a finding at the lowest severity.” Flores says PR #87 also added two regression tests. The distinction matters to continuous integration: an exit status is part of a command-line tool’s interface, and a clean scan should not fail a policy gate simply because there was nothing to classify.
How the tool-risk matcher handled false positives and true positives
Flores says PR #88 addressed overly broad substring matching. A fragment such as add inside get_address could be read as a destructive action; names such as read_settings and search_update_records could also be flagged despite indicating read-oriented behavior.
Match meaningful boundaries, not arbitrary fragments
The reported adjustment tokenizes tool names and matches whole segments, while using word boundaries for descriptions. This reduces false positives caused by a risk keyword appearing as part of a longer, unrelated word.
Keep read-only suppression narrow
A broad rule that suppresses risk whenever a name begins with a read-only verb could hide a genuinely destructive action. Flores says review caught this in an initial guard that would have suppressed get_and_delete_user. The reported final behavior continued to flag that name rather than treating the read-oriented opening word as a blanket exemption.
Rank #3
One limitation remains in the account: drop_in_query still triggers a false positive and was documented as out of scope. The example illustrates why a matcher needs tests in both directions: reduce false alarms on benign names without suppressing names that contain an actual destructive operation.
How review uncovered the npm provenance bug
The most substantial issue described in the article concerns PR #86 and mcp-guard verify. Flores says the initial implementation assumed an npm attestation endpoint path that looked plausible but returned 404 even for @sigstore/sign. If that endpoint failed for every package, verification could not identify signed packages; the result would be “unsigned” regardless of the package’s actual provenance.
Use version metadata to locate attestations
The reported correction reads dist.attestations.url from the version manifest when that field is present. Flores distinguishes the packument, which carries data for package versions, from the manifest for a specific version. The account says that if a pinned version’s manifest returns 404, verification reports not_found, rather than treating that missing version as a package with no attestation.
Recommended Free Tools
Keep the result states distinct
The account implies three materially different outcomes for a policy gate:
- Signed: version metadata points to an attestation that can be checked.
- No attestation metadata: the package version is found, but no attestation URL is present.
- Not found: the requested pinned version’s manifest cannot be found.
These states should not collapse into a single “unsigned” result. A strict policy may treat an unsigned package and a nonexistent pinned version differently, so callers need a result that preserves the distinction.
Flores also says the implementation trusts only the discovered URL’s pathname and reattaches it to the registry origin. That is a security-sensitive boundary: metadata can indicate where an attestation is located, but the host used for the request should remain constrained to the expected registry origin.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the review process demonstrates
The three examples point to practical review habits for security-sensitive command-line software:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
- Test the empty case as well as cases with findings; an absent value is not automatically equivalent to the lowest value.
- For classifiers, test both false positives and false negatives. A fix that quiets benign read names is incomplete if it also hides destructive ones.
- For live-registry integrations, verify positive and negative cases against the service. A 404 for a known signed package is evidence that the assumed lookup path is wrong, not evidence that the package lacks provenance.
- Preserve distinct states for absent metadata and a missing resource so downstream policy decisions can be deliberate.
- Keep changes small enough to reproduce and review independently. Flores presents that as a contribution lesson from the three-PR sequence.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
