Proof-of-diligence · not a security guarantee

Your client won't ask if you used AI. They'll ask for proof it was checked.

We don't tell you your code is safe — no honest tool can. We tell you, provably, that it was inspected, and hand you a receipt your client can verify themselves, offline, without trusting us.

npx -y @graneth/mcp-server · MIT · no account required
Certificate of inspectionQC·992
TARGET_REFapi-gateway/auth.ts
COMMIT7a1b9f0c2e4d…
TIMESTAMP2026-07-21T10:47:03Z
sha256:7a1b9f0c2e4d8a61b3f09c7e5d2a4b8f1c6e0d93a7b5f2c8e14d6a0b9f3c7e2d
Hardcoded_SecretsCLEARED
Supply_Chain_RiskCLEARED
Taint_ReachabilityNOT_REACHED
ED25519 · 0x9f88…e1a2PASSED
SPECIMEN · MUSTER — illustrative243 installs / wk · npm
100% recall
Every bad name caught
250 / 250 hallucinated or malicious names flagged — 0 false negatives
0 false positives
On real packages
0 / 284 legitimate packages wrongly flagged in the benchmark
534 packages
In the public benchmark
Across 6 registries · npm, PyPI, crates, RubyGems, Go, Packagist
Confusion matrix TP 250 · FN 0 · FP 0 · TN 284 · measured 2026-07-09 · negatives partly drawn from our own popular-package list — disclosed, not an independent benchmark. Full methodology → /benchmark
01 / Problem

AI invents package names. The registry doesn't care that they're invented.

When a model hallucinates a dependency, the name doesn't error — it's just unclaimed. That gap is the whole attack, and AI made it far wider. Here's the mechanism, then the history.

1
The model writes a name that doesn't exist

It looks plausible — flask-gpt-helper — so it slips past review.

2
The registry returns 404, not an error

The name isn't blocked. It's simply unowned — free for anyone to claim.

3
An attacker registers it and owns your install

Now their code runs on every developer machine and CI box that resolves it.

The history is real & dated
2016 · 03
left-pad

An 11-line package unpublished, breaking builds across npm.

2017 · 08
crossenv + ~40 typosquats

Typosquats that exfiltrated environment variables on install.

2018 · 11
event-stream

A maintainer handover shipped a malicious payload widely.

2021 · 10
ua-parser-js

A hijacked release, millions of weekly downloads, shipped a stealer.

2022 · 12
torchtriton

Dependency-confusion on PyPI shadowed a PyTorch nightly.

02 / Catch

So we check the name before it becomes a line of code.

The MCP tool runs inside your agent loop and checks each proposed dependency against the real registry at generation time — before the diff, before install, before CI. The hallucinated package never enters your tree.

Works with Claude Code, Cursor and Copilot agent mode. No account, no key.

agent · pre_flight_check python
diff --git a/requirements.txt
+ requests==2.31.0
+ flask-gpt-helper==0.4.1
✕ FLAG flask-gpt-helper — 404 on PyPI, likely hallucinated
✓ OK requests — first published 2011-02-13 · provenance ok
$ _
03 / Coverage

Everything it actually looks at. All of it.

No feature here is aspirational — each maps to a check that runs in the shipped detector. Where a check can't be certain, it says so.

Registry existence

404 → flagged. Fails open on network error and says so — never a silent pass.

404fail-open

Slop & typosquat

One character or one token off a real name, and lookalike glyphs.

1↔l0↔orn↔m

New & unproven

Under 30 days old is surfaced, not blocked — your call.

< 30 days

Install-time risk

postinstall hooks, missing SLSA provenance, deprecated, no source repo.

scriptsSLSA

Hardcoded secrets

Real key shapes + Shannon entropy; doc-example keys downgraded.

AKIAghp_sk-ant-sk_live_

Reachability

Cross-file taint: is this critical actually reachable from an entry point?

call graphtaint

LLM triage

A second pass explains context and marks what the static layer over-called.

L1 SASTL2

Signed receipt

Ed25519 certificate, verifiable offline, without us.

Ed25519offline
04 / Position

Earlier than the tools you already run — not instead of them.

Generation · Graneth
The agent writes it

Checked before the line reaches your tree. The bad name never becomes a commit.

Install
The package resolves

Where install-time scanners act. By now it's already written down.

PR
CI reviews the diff

Where SAST runs. Graneth posts a verdict here too — plus the signed receipt.

05 / Proof

The receipt is the product. Your client verifies it, not us.

Under NIS2 and the CRA your DACH client pushes their obligations down to you. "Show me you checked" is answerable with a signed artifact; a PDF scan report isn't. The verifier is open source with zero runtime dependencies.

What it proves

Which checks ran, against which commit, at which UTC instant. Signed.

What it doesn't

That the code is secure. No scanner can sign that.

client · verify offline
# they run this — no account, no call to us
$ npx @graneth/verify qc-992.receipt
✓ signature valid · ED25519 0x9f88…e1a2
  commit 7a1b9f0c2e4d
  issued 2026-07-21T10:47:03Z
  checks secrets, supply-chain, taint
06 / Pricing

Free where it funnels. Paid where it proves.

Free
€0
forever · no account for the MCP tool

  • MCP pre_flight_check — unlimited
  • 30 Quick scans / month
  • Signed receipt on every scan
  • 6 registries · offline verifier
Recommended
Pro · for teams
€99 / month
per team · cancel anytime

  • 1 000 Deep scans / month
  • 100 Auto-Fix pull requests / month
  • Policy enforcement + Rego studio
  • Compliance evidence export
Extra credits — bought once, never expire · Deep scan = 2 credits, Auto-Fix = 3 credits
12credits€19= 6 Deep scans or 4 Auto-Fix PRs
35credits€49= 17 Deep scans or 11 Auto-Fix PRs
120credits€149= 60 Deep scans or 40 Auto-Fix PRs
07 / Honesty

What we won't claim.

Does a passed receipt mean my code is secure?

No. It means the checks we ran, ran — and names which. Proof of diligence, not a guarantee.

Is the benchmark independent?

No — we run it. The dataset and matrix are published so you can judge it, including two failures it caught in our own product.

Isn't this install-time scanning?

Complementary. They act when the package resolves; we act when the agent writes the name. Run both.

Do you see our source?

The MCP tool checks staged manifests locally. Deep scans need repo access — data-flow is on /trust.

Is the free tool really account-less?

Yes. npx -y @graneth/mcp-server — no signup, no key.

Why should I trust a security vendor's colours?

You shouldn't. Trust the signature. Everything else is just legible.

>_ GRANETH

A security layer for AI coding agents. Catch what the model invents, then prove you checked.