The toolprint fingerprint guardian inspects a tool identity card with a magnifying glass, padlock in hand.

PACKAGE-LOCK.JSON FOR MCP TRUST

Pin what you trust.
Catch what changes.¶

Your agent's MCP servers can silently rewrite the tool descriptions it reads. toolprint fingerprints every definition into a committed toolprint.lock, so the next change shows up as a diff in a pull request — and hidden prompt-injection and leaked secrets fail the build.

Get started Read the checks

Claude Desktop · Claude Code · Codex · CLI · GitHub Action · Local only, no account

Rug-pulls, caught¶

A pinned tool, prompt, resource, or skill whose definition changes — above all a rewritten description — fails the scan with a readable before/after diff.

Tool poisoning, flagged¶

Eleven injection signals scan every word your agent reads, including skill bodies. Two independent high-severity signals on one capability escalate to critical.

Secrets, redacted¶

Eighteen credential formats are detected in MCP configs and capability text, always redacted in output, so a leaked key is caught before it is committed.

One command, no install¶

# Pin what you trust today (writes toolprint.lock — commit it)
npx toolprint pin ./.vscode/mcp.json

# From then on, scan to detect drift + issues
npx toolprint scan ./.vscode/mcp.json

Scan every agent client on the machine with npx toolprint scan --all-clients, and your SKILL.md bundles with npx toolprint scan --skills. See Get started.

toolprint scan detecting that a pinned tool description was rewritten to exfiltrate an SSH key

Built for the agent you use¶

The same engine ships five ways: a CLI, a GitHub Action, and an MCP server (toolprint serve) packaged as plugins for Claude Desktop, Claude Code, and Codex — so your agent can verify the very tools it is about to trust, using two tools: scan (read-only) and pin (update the lock after review).

Choose your installation · Read the source · View releases

In CI¶

- uses: jestatsio/toolprint@v1
  with:
    config: ./.vscode/mcp.json
    fail-on: high

SARIF output for GitHub code scanning, sticky PR comments, and baseline mode for adopting on a repo that is not clean yet: see CI.

Availability, without ambiguity¶

The in-repository marketplaces and release packages are community distributions by JEStats. Compatibility and a successful installation do not imply official directory approval or endorsement. See Distribution for what is published where, checksums, and submission status.

Pin what you trust.Catch what changes.¶