Dredd MCP — Pre-Flight Security for the MCP Ecosystem

"Jeevesus saves. Dredd judges."

Dredd MCP is a pre-invocation security check for the Model Context Protocol ecosystem. Before your agent calls a tool on any other MCP server, Dredd renders a verdict: BLOCK, ADVISORY, or ALLOW. Every verdict is HMAC-signed and cites the IOC or behavioral signal that drove the decision.

The MCP ecosystem has had no defender. Three PyPI ML packages were compromised in eight days during late April 2026. Twenty-plus MCP-named GitHub repositories were caught serving SmartLoader malware in the wild. The official MCP Registry was clean of those when we measured — but the typosquat surface is wide open.

Dredd is the layer that catches the next compromise before the malicious tool gets called.

What's New — Dependency-Graph Checking (Shai-Hulud class)

Dredd no longer stops at the named server. It walks the transitive dependency graph.

The Shai-Hulud worm taught the ecosystem the hard lesson: the malicious code is rarely in the package you installed — it's three levels down, in a transitive dependency that got its publish token stolen. A check that only vets the server you named is blind to exactly the attack that's been hitting npm and PyPI.

So every preflight now resolves the target server's full npm/pypi dependency graph and joins every transitive package against our continuously updated IOC corpus — including the OSV malicious-package feeds for npm and PyPI. If a known-malicious package is buried anywhere in the tree, Dredd blocks the call before the tool runs.

The verdict is signed (HMAC-SHA256) and now carries a dep_graph field telling you whether transitive supply-chain risk was actually evaluated for that target:

{
  "verdict": "BLOCK",
  "severity": "critical",
  "dep_graph": { "evaluated": true, "packages_checked": 247, "malicious_transitive": 1 },
  "signature": "sha256=..."
}

If the server doesn't expose a resolvable manifest, dep_graph.evaluated is false and Dredd drops to the advisory tier — it tells you it couldn't see the tree rather than pretending it's clean.

What Dredd Checks

Every preflight call evaluates these signals:

1. Compromised dependency — including transitive (Shai-Hulud class). The target server's package manifest is parsed, its full npm/pypi dependency graph is resolved, and every package — direct and transitive — is joined against our continuously updated IOC corpus (Socket, Aikido, GitGuardian, ReversingLabs, Phylum, StepSecurity, Wiz, plus OSV malicious-package feeds for npm and PyPI). If the server, or anything it pulls in transitively, pins lightning==2.6.2 or any other known-compromised version, the call is blocked. The dep_graph field on the verdict reports whether the transitive tree was evaluated.
2. Tool surface drift. The list of tools the server exposes today versus the snapshot the user originally approved. New tools that appeared since the last review trigger an advisory. Mid-session rugpull is the threat model.
3. Remote URL drift. The server's runtime endpoint compared against the URL it published in the registry. A server quietly calling out to a different host than the one you signed up for is a hijack signature.
4. Permission escalation. A server requesting write or exec permissions it did not have last week.

The verdict comes back signed in under 200 ms (Cloudflare-edge cached, 5-minute TTL). The hook fails open by default — if our endpoint is ever down, Dredd does not brick your tooling.

Install — Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "dredd": {
      "url": "https://analytics.dugganusa.com/api/v1/dredd/mcp"
    }
  }
}

Restart Claude Desktop. You'll see Dredd available with one tool: check_mcp_server.

Install — Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "

... [View full README on GitHub](https://github.com/pduggusa/dredd-mcp#readme)