Is io.github.Mickdownunder/safeinstall safe to use?

io.github.Mickdownunder/safeinstall has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install io.github.Mickdownunder/safeinstall?

io.github.Mickdownunder/safeinstall supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.Mickdownunder/safeinstall do?

io.github.Mickdownunder/safeinstall provides 12 tools: node_modules, Install, Quickstart, Usage, Configuration and 7 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.Mickdownunder/safeinstall?

io.github.Mickdownunder/safeinstall is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.Mickdownunder/safeinstall actively maintained?

io.github.Mickdownunder/safeinstall is actively maintained — last commit was 10 days ago. It has 3 GitHub stars.

io.github.Mickdownunder/safeinstall

tsc

Local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks

3 823.6k/wk 12 tools GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 10d ago

Works with most clients

Transport: stdio, sse, http

12 tools

Grade F

MCPpedia last refreshed this data 12h ago

Edit this pageView history

io.github.Mickdownunder/safeinstall is an MCP server that local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 63/100 on MCPpedia's security, maintenance and efficiency rubric.

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-mickdownunder-safeinstall": {
      "args": [
        "-y",
        "tsc"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-mickdownunder-safeinstall)](https://mcppedia.org/s/io-github-mickdownunder-safeinstall)

Read me

What io.github.Mickdownunder/safeinstall does

The install gate for npm, pnpm, and bun — for the humans who type install, the AI agents that run it for them, and the config that programs those agents. Policy runs first. Then your package manager. Not the other way around. Local-first · No cloud · No account · MIT · Free forever

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'tsc' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked tsc against OSV.dev.

Inventory

Tools (12)

Click any tool to inspect its schema.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Mickdownunder/safeinstall safe to use?: io.github.Mickdownunder/safeinstall has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install io.github.Mickdownunder/safeinstall?: io.github.Mickdownunder/safeinstall supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.Mickdownunder/safeinstall do?: io.github.Mickdownunder/safeinstall provides 12 tools: node_modules, Install, Quickstart, Usage, Configuration and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.Mickdownunder/safeinstall?: io.github.Mickdownunder/safeinstall is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.Mickdownunder/safeinstall actively maintained?: io.github.Mickdownunder/safeinstall is actively maintained — last commit was 10 days ago. It has 3 GitHub stars.

Similar servers

Others in other

View all →

Transport Stdio95

Transport for TMCP using STDIO

197 14

Flare95

The graph based agentic IDE

123 3

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

67.2k 3

app.fojin/fojin-mcp94

Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.

329 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.Mickdownunder/safeinstall and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-mickdownunder-safeinstall": {
      "args": [
        "-y",
        "tsc"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-mickdownunder-safeinstall)](https://mcppedia.org/s/io-github-mickdownunder-safeinstall)

Read me

What io.github.Mickdownunder/safeinstall does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'tsc' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

SafeInstall
Supply-chain security for the AI-agent era.

The install gate for npm, pnpm, and bun — for the humans who type install, the AI agents that run it for them, and the config that programs those agents.
Policy runs first. Then your package manager. Not the other way around.

Local-first · No cloud · No account · MIT · Free forever

What it does

SafeInstall runs your policy before your package manager — locally, blocking by default. One tool, three layers of defense:

🧑‍💻 For the humans who install — prefix any command: safeinstall pnpm add axios. Policy runs, then pnpm. Release age, install scripts, untrusted sources, typo-squats, and cryptographic provenance are checked before anything touches disk.
🤖 For the AI agents that install for you — an MCP tool agents can call, plus a shell guard that intercepts install commands in Claude Code, Codex, and Cursor before they run. Best-effort shell interception — one defense layer that fires even when the agent isn't cooperating, not a lossless guarantee.
🔒 For the files that program the agents — the Agent Trust Surface: a committed hash baseline of your config, hooks, rules, and MCP files, reconciled locally and re-verified in CI, so tampering with the rules surfaces as drift instead of silently owning every future session — with a fully consistent rewrite caught by human review of the diff, not the automated check alone.

Why SafeInstall

AI coding tools suggest packages in seconds. They don't check publish dates. They don't read install scripts. They don't verify the source. You type "yes" and move on.

SafeInstall is the gate between suggestion and execution.

$ safeinstall pnpm add compromised-pkg@9.9.9

Install blocked.
- compromised-pkg@9.9.9
  Blocked: release too new (published 3 hours ago; minimum is 72 hours).
  Blocked: install script present (has postinstall).

No dashboard. No account. No cloud. One command prefix — policy runs locally, blocks by default, then invokes the real tool.

Catching a maintainer-compromise attack

A valid Sigstore signature is not enough. An attacker who compromises an npm maintainer account can publish a malicious version of a package you already trust, and the attestation on that malicious version will cryptographically verify — signed by a GitHub Actions workflow the attacker controls in a fork of the real repository.

SafeInstall catches this. Pin the expected source repository with provenance.trustedPublishers and any build that comes from anywhere else is blocked, even if the signature is valid:

$

... [View full README on GitHub](https://github.com/mickdownunder/safeinstall#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked tsc against OSV.dev.

Inventory

Tools (12)

Click any tool to inspect its schema.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Mickdownunder/safeinstall safe to use?: io.github.Mickdownunder/safeinstall has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install io.github.Mickdownunder/safeinstall?: io.github.Mickdownunder/safeinstall supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.Mickdownunder/safeinstall do?: io.github.Mickdownunder/safeinstall provides 12 tools: node_modules, Install, Quickstart, Usage, Configuration and 7 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.Mickdownunder/safeinstall?: io.github.Mickdownunder/safeinstall is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.Mickdownunder/safeinstall actively maintained?: io.github.Mickdownunder/safeinstall is actively maintained — last commit was 10 days ago. It has 3 GitHub stars.