inspect

inspect tells you whether an MCP server is safe to add, with one verdict.

vulkro-live inspect @scope/server-x
vulkro-live inspect 'npx -y @scope/server-x'
vulkro-live inspect 'uvx mcp-server-git'
vulkro-live inspect 'npx -y @scope/server-x' --manifest ./tools.json

$ vulkro-live inspect "npx -y @modelcontextprotocol/server-filesystem"

GREEN  npx -y @modelcontextprotocol/server-filesystem
  package  @modelcontextprotocol/server-filesystem (npm)  OK  latest 2026.1.14, 404643 weekly downloads

Give it a package name or the install command. It finds the package behind it (npm, PyPI or crates), runs verify on it, and with --manifest also runs warden on the server's tools. It never starts the server. Local scripts, git sources and anything else it cannot check get REVIEW, never a pass.

Verdict	Meaning
`GREEN`	Real, established package and a clean manifest
`REVIEW`	New or little-used package, a medium finding, or a source it cannot check
`AVOID`	Missing or malicious package, or a high-severity manifest finding

Flags

Flag	Effect
`<SERVER>`	Package name or install command (`npx -y ...`, `uvx ...`, `pip install ...`)
`--manifest <file>`	The server's tool manifest, scanned with warden
`--min-age-days <n>`	Newer than this is SUSPICIOUS (default 30)
`--min-downloads <n>`	Fewer downloads than this is SUSPICIOUS (default 100)
`--no-cache`	Skip the local cache
`--format <FORMAT>`	`text` (default), `json` or `sarif`

Exit codes: 0 GREEN, 1 REVIEW or AVOID, 2 error.

After a GREEN verdict, lock the manifest you approved.

Flags​

Flags