mpak

What it does

mpak is a specialized package registry designed for Model Context Protocol (MCP) servers. It provides a secure, centralized repository for discovering and installing MCP server packages with comprehensive security verification. The tool automatically scans every bundle across 25 supply-chain controls and assigns trust scores (L1-L4) to help developers make informed decisions about package dependencies.

How to set up

Installation is straightforward via CLI. Users can install mpak using standard package managers for Python or TypeScript environments, then configure it to point to the registry. For self-hosted deployments, the open-source codebase can be deployed to Kubernetes clusters or local environments. CLI commands enable searching, installing, and managing MCP server packages with security checks automatically performed during installation.

Key features

• Supply-chain security scanning across 25 control points
• Trust scoring system (L1-L4 levels) for package reliability assessment
• SBOM (Software Bill of Materials) generation and analysis
• Vulnerability scanning for dependencies
• CLI interface for package discovery and installation
• Self-hosted deployment options with Kubernetes support
• Built-in security verification for all packages
• Support for Python and TypeScript MCP servers