graneth-mcp
MCP serverAI & modelsCatch fake packages and exposed secrets in AI-written code before they cause problems. This app checks what your AI coding assistant produces, flagging packages that don't actually exist and passwords or keys left in the code. It covers 6 package ecosystems and needs no account.
Available today. Use it from your connected AI after setup.
No other account needed.
Add it to your AI coding setup and run a check on your project before code goes further. No account is needed.
Then ask your AI: use graneth-mcp to scan repository
What your AI can do with it
- Flag packages your AI invented that don't actually exist
- Spot passwords and API keys accidentally left in code
- Check packages across 6 ecosystems
- Screen AI-written code before it moves forward
- Run checks without creating an account
From the project's README
As published by zubovartemiy/graneth-mcp in README.md.
Source for @graneth/mcp-server — an account-free MCP
server that checks AI-written changes before they are committed: packages that do not
exist, dependency risk shapes, and hardcoded secrets.
npx @graneth/mcp-server
Tool documentation, install snippets for Claude Code / Cursor / Windsurf, and the exact
verdicts it returns: packages/mcp-server/README.md.
What is in this repository
packages/mcp-server | the MCP server itself — stdio, hand-rolled JSON-RPC, no runtime dependencies |
packages/core-checks | the detection core it bundles: registry existence across six ecosystems, manifest parsing, secret patterns + entropy, risk scoring |
What is not
The hosted scanning service is a separate, closed codebase: pull-request scanning, the second-pass LLM triage, policy enforcement, signed receipts and billing are not here and are not open source. This repository is the free tool and the checks it runs — which is the part you install on your machine, and therefore the part worth being able to read.
How it is maintained
Generated from the internal monorepo, which is the source of truth. Edits made directly here are overwritten on the next sync, so please open an issue rather than a patch — the fix lands upstream and comes back with the next release.
Three of core-checks' test files are held back: they assert that the secret rules fire,
so their fixtures are literal example credentials, and every scanner — GitHub's push
protection and this project's own — reads them as the real thing. The rules themselves
are here in full (packages/core-checks/src/secrets.ts), as are the package's other tests.
Licence
MIT. See LICENSE.
Tools it offers (4)
What this server listed when ahel dialed its public endpoint in Sep 2026, with no key and no account of yours. The names are the server’s own.
scan_repositorypre_flight_checkget_findingsauto_remediate
Signals
- Last commit
- Sep 2026
Advanced
- Delivery
- mcp-server MCP server → your ahel gateway (mcp.ahel.ai) → every connected AI client.
- Catalog kind
- mcp-server
- Gateway key
com-graneth-mcp-server- Source
- github.com/zubovartemiy/graneth-mcp
- Hosted endpoint
https://graneth.com/api/mcp