State of MCP Supply-Chain Integrity & Automated Ledger Telemetry (2026-11-13)
Every figure below is computed directly from live npm release tarballs, the official MCP Registry, and public block ledgers across 32,172 indexed tools (2,032 of 5,003 MCP packages SHA-512 inspected so far).
Key Forensic Findings Today
- 157 inspected npm MCP packages execute arbitrary
preinstall,install, orpostinstallshell scripts immediately uponnpxexecution. - 1,010 inspected MCP packages carry verifiable npm SLSA cryptographic build provenance; unattested packages lack signed CI build lineage.
- 2,032 of 5,003 MCP packages have immutable SHA-512 integrity hashes indexed so far for strict lockfile pinning (
POST /v1/lockfile). - 0 cryptographic validations recorded behind millions of raw on-chain agent reviews audited on public agent registries.
Highest-Traffic MCP Install-Hook Alerts
- @wonderwhy-er/desktop-commander (npm MCP) (0.3.3):
postinstall: node dist/track-installation.js && node dist/npm-scripts/verify-ripgrep.js || no· Sign-Off Sheet - @modelcontextprotocol/inspector (npm MCP) (2.15.0):
postinstall: node scripts/install-clients.mjs· Sign-Off Sheet - @azure/mcp (npm MCP) (4.0.0-beta.7):
postinstall: node ./scripts/post-install-script.js· Sign-Off Sheet - agentdb (npm MCP) (3.10.1):
postinstall: node scripts/postinstall.cjs || true· Sign-Off Sheet - agentic-flow (npm MCP) (3.5.5):
postinstall: node scripts/postinstall.js || true· Sign-Off Sheet - @claude-flow/cli (npm MCP) (3.77.0):
postinstall: node ./scripts/postinstall.cjs· Sign-Off Sheet - @bike4mind/cli (npm MCP) (4.0.0):
postinstall: node -e "try { require('better-sqlite3') } catch (e) { if (e.message.includes('b· Sign-Off Sheet - cline (npm MCP) (3.0.74):
postinstall: node ./postinstall.mjs || true· Sign-Off Sheet - @gitkraken/gk (npm MCP) (3.1.77):
postinstall: node install.js· Sign-Off Sheet - @tacticlaunch/mcp-linear (npm MCP) (1.4.5):
postinstall: node -e "try { require('fs').chmodSync('./dist/index.js', '755') } catch (e) {}"· Sign-Off Sheet - gitnexus (npm MCP) (1.6.12):
postinstall: node scripts/build-tree-sitter-grammars.cjs· Sign-Off Sheet - instar (npm MCP) (1.3.1745):
postinstall: node scripts/fix-better-sqlite3.cjs· Sign-Off Sheet
Multi-Chain Agent Review Inflation Audit (20 Networks ยท 4,076,671+ Upstream IDs)
| Network | Registered | Raw Reviews | Verdict | Finding |
|---|---|---|---|---|
| Base | 1,083,521 | 651,774 | HIGH-INFLATION | 98.07/100 unvalidated review average across 651,774 claims (0 cryptographic validations) |
| Arc Mainnet | 413,454 | 49,270 | HIGH-INFLATION | 100.00/100 unvalidated review average across 49,270 claims (0 cryptographic validations) |
| BSC | 385,291 | 12,225 | HIGH-INFLATION | 385,291 registered shells with minimal settled feedback activity |
| Arc Testnet | 295,621 | 3,810,150 | TESTNET-FARM | Non-commercial test network (3,810,150 synthetic test reviews stripped) |
| Ethereum Mainnet | 36,606 | 37,231 | CLEAN | Moderate organic registration density |
| Billions | 26,276 | 592 | HIGH-INFLATION | 26,276 registered shells with minimal settled feedback activity |
| Robinhood Chain | 25,340 | 13,654 | CLEAN | Moderate organic registration density |
| X Layer | 15,653 | 29,635 | CLEAN | Moderate organic registration density |
| Ethereum Sepolia | 10,937 | 15,661 | TESTNET-FARM | Non-commercial test network (15,661 synthetic test reviews stripped) |
| Monad | 10,343 | 9,435 | CLEAN | Moderate organic registration density |
| Base Sepolia | 10,023 | 38,027 | TESTNET-FARM | Non-commercial test network (38,027 synthetic test reviews stripped) |
| Celo | 10,004 | 29,709 | CLEAN | Moderate organic registration density |