Pre-flight check for AI coding agents: hallucinated packages + secrets, 6 ecosystems, no account.

How do I install Graneth?

Install Graneth via npm from https://registry.npmjs.org, then add the server config to your MCP client (Claude Desktop, Cursor, or VS Code).

Is Graneth open source?

Yes, Graneth is open source under the MIT license. Source code is available at https://github.com/zubovartemiy/graneth-mcp.

What category does Graneth belong to?

Graneth is listed under Security & Auth MCP servers on MCPFind.

Graneth — MCP Server for Security & Auth

graneth-mcp

Source for @graneth/mcp-server — an account-free MCP server that checks AI-written changes before they are committed: packages that do not exist, dependency risk shapes, and hardcoded secrets.

npx @graneth/mcp-server

Tool documentation, install snippets for Claude Code / Cursor / Windsurf, and the exact verdicts it returns: packages/mcp-server/README.md.

What is in this repository


`packages/mcp-server`	the MCP server itself — stdio, hand-rolled JSON-RPC, no runtime dependencies
`packages/core-checks`	the detection core it bundles: registry existence across six ecosystems, manifest parsing, secret patterns + entropy, risk scoring

What is not

The hosted scanning service is a separate, closed codebase: pull-request scanning, the second-pass LLM triage, policy enforcement, signed receipts and billing are not here and are not open source. This repository is the free tool and the checks it runs — which is the part you install on your machine, and therefore the part worth being able to read.

How it is maintained

Generated from the internal monorepo, which is the source of truth. Edits made directly here are overwritten on the next sync, so please open an issue rather than a patch — the fix lands upstream and comes back with the next release.

Three of core-checks' test files are held back: they assert that the secret rules fire, so their fixtures are literal example credentials, and every scanner — GitHub's push protection and this project's own — reads them as the real thing. The rules themselves are here in full (packages/core-checks/src/secrets.ts), as are the package's other tests.

Licence

MIT. See LICENSE.

Set up in your AI client

AI clientOperating system

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json

{
  "mcpServers": {
    "com-graneth-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@graneth/mcp-server"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Compatible MCP Clients

Graneth works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.

Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.

VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.

Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.

Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

Graneth