Three reported pull requests to yunaremaia/mcp-guard fixed an empty-scan exit-code error, narrowed risky-tool name matching, and corrected npm provenance verification. The most consequential review finding was in mcp-guard verify: according to contributor Edison Flores, its assumed npm attestation endpoint returned 404 even for a package known to have a signature, so the feature would have treated every package as unsigned.
What the three pull requests changed
Flores’s account describes three small changes to an MCP server supply-chain and security scanner. The PR numbers and implementation details below reflect that account; the pull requests and current repository code have not been independently verified here.
As an Amazon Associate I earn from qualifying purchases.
| Pull request | Reported change | Why it matters |
|---|---|---|
| #87 | Make an empty scan pass scan --fail-on low, with a default severity value of -1 rather than 0; add two regression tests. |
A clean scan should not fail a severity gate merely because there are no findings. |
| #88 | Replace broad substring checks for risky tool names with token-aware matching, add word-boundary matching for descriptions, and constrain read-only suppression. | Reduce false alarms on read-only names without suppressing genuinely destructive names. |
| #86 | Use the version manifest’s dist.attestations.url when present to locate npm provenance attestations, and distinguish a missing pinned version from absent attestation metadata. |
A failed lookup should not be mistaken for proof that a package is unsigned. |
The article says the three PRs were merged in roughly 36 hours. Flores also credits maintainer reviews with improving all three changes. That timing and the implementation descriptions are reported by the article, not independently confirmed merge or code-history data.
Why the empty scan failed its severity gate
In PR #87, the reported problem was an edge case in how the highest finding severity was computed. When a scan returned no findings, max(severities, default=0) yielded zero. The low threshold was also represented by zero, so the empty result compared as though it had a finding at the lowest severity and returned exit code 1.
#1 Best Overall
Flores reports changing the empty-set default to -1 and adding two regression tests. The distinction matters to CI: a severity gate consumes a process exit status, so “no issues found” must remain different from “at least one issue found at the lowest configured level.”
How tool-risk matching balanced false positives and false negatives
PR #88 addressed the opposite risks of name matching. According to Flores, substring matching treated harmless fragments as destructive: add inside get_address could trigger a warning, as could names such as read_settings and search_update_records. The reported fix tokenizes tool names and matches whole segments, while description matching uses word boundaries.
Why read-only suppression needed a narrow rule
A broad rule that suppresses warnings whenever a name begins with a read-style verb could hide a destructive action later in the same name. The review reportedly caught that flaw in an initial guard: get_and_delete_user must still be flagged. Flores says the final behavior limits read-only suppression to a more narrowly defined name pattern, preserving that warning rather than treating the initial guard as safe.
Free tools Windows power users keep installed
One-click scans. No signup required.
What remained out of scope
Flores notes that drop_in_query still produces a false positive and was documented as out of scope. That illustrates why a matcher needs tests for both directions: names that should stop triggering warnings and destructive names that must not be suppressed.
Rank #3
What review found in npm provenance verification
PR #86 concerned mcp-guard verify, which the article describes as checking npm provenance attestations. Flores says the initial implementation assumed a documented-looking endpoint path, but that path returned 404 even for @sigstore/sign. If the lookup failed that way for every package, the verifier could never identify a signed package; all results would appear unsigned.
Use the version manifest’s attestation URL
The reported correction reads dist.attestations.url from the package’s version manifest when that field exists, rather than constructing the assumed endpoint. The packument contains per-version data, so the lookup is tied to the version being checked. Flores says the implementation trusts only the discovered URL’s pathname and reattaches it to the registry origin.
Keep unsigned and not found as separate results
The reported behavior distinguishes three cases: a package version with attestation data to verify, a found version with no attestation metadata, and a pinned version whose manifest returns 404. The last case becomes not_found, rather than being collapsed into “unsigned.” That distinction gives a strict security policy a chance to treat an unavailable reference differently from an existing package that has no attestation metadata.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat these changes show about security reviews
- Test boundaries, not just the usual case. Empty findings exposed the severity default bug; name-matching examples exposed both false alarms and the risk of suppressing destructive tools.
- Exercise live-service assumptions with positive and negative cases. The provenance issue, as Flores describes it, was a lookup that returned 404 even for a known signed package. A test that checks only failure handling would not establish that signed packages can be found.
- Model different failure states explicitly. Missing attestation metadata and a missing pinned version are not interchangeable outcomes.
- Keep changes reviewable. Flores’s reported contribution lesson is that small, separate changes are easier to reproduce, review, and revert.
Flores says the investigation, fixes, and tests were AI-assisted using Claude and GLM, with human direction; the maintainer’s reviews improved the changes. The account does not independently establish exact diffs, test counts, merge timestamps, or the repository’s current behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
