package-lock.json for MCP trust: catch MCP rug-pulls, tool poisoning, and leaked secrets.
Connect Runs on your machine
claude mcp add toolprint -e TOOLPRINT_WORKDIR=<TOOLPRINT_WORKDIR> -e TOOLPRINT_BEARER=<TOOLPRINT_BEARER> -- npx -y [email protected]{
"mcpServers": {
"toolprint": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TOOLPRINT_WORKDIR": "<TOOLPRINT_WORKDIR>",
"TOOLPRINT_BEARER": "<TOOLPRINT_BEARER>"
}
}
}
}{
"mcpServers": {
"toolprint": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TOOLPRINT_WORKDIR": "<TOOLPRINT_WORKDIR>",
"TOOLPRINT_BEARER": "<TOOLPRINT_BEARER>"
}
}
}
}{
"servers": {
"toolprint": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TOOLPRINT_WORKDIR": "<TOOLPRINT_WORKDIR>",
"TOOLPRINT_BEARER": "<TOOLPRINT_BEARER>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
TOOLPRINT_WORKDIROptional | Default project directory for relative paths and lockfile discovery when a scan does not name one. |
TOOLPRINT_BEAREROptional, secret | Optional bearer token for authenticated remote MCP servers you ask toolprint to scan. Never written to the lockfile. |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 15 Oct 2026 |
| Last updated | 15 Oct 2026 |
| Registry name | io.github.jestatsio/toolprint |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.