v0.4.1 — directory metadata fixes + bundled Codex directory package

toolprint 0.4.1 — directory-listing patch

Fixes from submitting 0.4.0 to the Claude and OpenAI plugin directories. No scanner behavior changes: same checks, same exit codes, same lockfile format.

Highlights

• Privacy policy and terms of service pages on the docs site, linked from the Codex/OpenAI manifests with a support URL — required by the OpenAI directory, useful everywhere.
• New release asset toolprint-0.4.1-codex-directory.zip: the desktop-only local-MCP package OpenAI's directory expects — server and dependencies bundled, declared in a root mcp.json. (That listing also needs OpenAI's local-MCP organization allowlist; status tracked in Distribution.)
• Codex subtitle shortened to the directory's 30-character cap.
• Claude directory: submitted — now in Anthropic's security scan and review queue.
• Development baseline moved to TypeScript 7, Vitest 5, and actions/* v7 (Dependabot, all green).

Checksums (SHA-256)

efc9b98d24fba4a63762722526ec8ad2f671872df18efac775c4e764c1edfcfa  toolprint-0.4.1.mcpb
998f93b7240436b4caa3c7584d7d05cf6b6489ec9115da8b25b1e4951651d22b  toolprint-0.4.1-claude-code.zip
561d257beb67c03c313520015b2bfba3d557060828f1dc591b4aba9804b322c3  toolprint-0.4.1-codex.zip
183d2a89a137bbb870b646cbf79ab3a675112cca925169090ed2645b008cfb3f  toolprint-0.4.1-codex-directory.zip
61ad28669aa9d54933bf9e320411d21e701bf517d628609cff4bf75c43c03760  toolprint-0.4.1-marketplace.zip

v0.4.0 — MCP server mode, Claude/Codex/Desktop plugins, docs site

toolprint 0.4.0 — now a plugin your agent can call

The theme is meet agents where they live: the same scanning engine, now as an MCP server with plugins for Claude Desktop, Claude Code, and Codex — plus a documentation site and a mascot.

Install in your agent

Assistant	Quick install
Claude Desktop	Download toolprint-0.4.0.mcpb below, open it, confirm Install
Claude Code	/plugin install toolprint --marketplace jestatsio/toolprint
Codex	codex plugin marketplace add jestatsio/toolprint then codex plugin add toolprint@toolprint

Full guide: https://jestatsio.github.io/toolprint/install/

Highlights

• toolprint serve — local MCP server with scan (read-only) and pin (lockfile write after review), sharing one scan core with the CLI so verdicts are identical. Structured results carry the gate decision (failing, exitCode); no credential is accepted as a tool argument.
• Plugins — in-repo Claude Code and Codex marketplaces, a toolprint skill, scan/pin commands, and the release packages attached below. The launcher is pinned to the exact npm version.
• MCP Registry — published as io.github.jestatsio/toolprint, automatically after npm.
• Docs site — https://jestatsio.github.io/toolprint/
• Branding — an original fingerprint-guardian mascot, seal icon, and install buttons.
• Dependencies at zero audit findings (MCP SDK 1.32.1 fixes GHSA-6qxp-vccf-f47h), CI on Node 20/22/24, Dependabot enabled.

Checksums (SHA-256)

c41c8f324ff6e752011e5a505cf346d44b1ed4850ab21788a5078d974dee124a  toolprint-0.4.0.mcpb
94e20a8ec4aa53d4d23c0bde516d924e68b3c3a5b4100e26a7ebeab457bacfc1  toolprint-0.4.0-claude-code.zip
90657c9e07558f70f3944503449bf2a6baf5c4b281c4277cd15e2f58a94844a1  toolprint-0.4.0-codex.zip
cdc966b32565f8480fc2bb476d287e88214193bd5341c07f96dd5e37a5ee5dec  toolprint-0.4.0-marketplace.zip

These are JEStats community distributions. Anthropic's and OpenAI's official plugin directories are manual web portals; prepared submission checklists and current status are tracked in Distribution.

v0.3.1 — Marketplace-ready Action metadata

A metadata-only patch. No behavior change — if you are on 0.3.0, nothing about scanning differs.

Fixed

GitHub Marketplace caps an Action's description at 125 characters and refuses the release when it is longer. Ours was 128, so publishing was rejected at the form:

Scan MCP servers and skill bundles for tool poisoning, secret leaks, and silent rug-pulls; enforc... — Description must be less than 125 characters.

Shortened to 114, keeping toolprint.lock — the distinctive part, and the package-lock.json analogy the whole tool is built on:

Scan MCP servers and skill bundles for tool poisoning, secret leaks, and silent rug-pulls; enforce toolprint.lock.

Why this needed its own release

Marketplace validates action.yml at the release tag, not on the default branch. A commit to main could not fix it, and moving the v0.3.0 tag was not an option — npm had already published from it with a provenance attestation.

Guard

action/metadata.test.mjs now checks the Marketplace rules that are otherwise invisible until publish time: the 125-character description cap and the required branding icon/color. It was verified to fail against the old 128-character string rather than assumed to work. The gotcha is also recorded in the release process in CONTRIBUTING.md.

Upgrading

Workflows pinned to @v1 pick this up automatically — the tag has moved.

- uses: jestatsio/toolprint@v1

Full changelog: https://github.com/jestatsio/toolprint/blob/main/CHANGELOG.md

v0.3.0 — everything your agent reads

Widens toolprint from "the MCP config in this repo" to everything the agent reads — every agent client on the machine, and the skill bundles your agent loads — then makes findings actionable when they're wrong.

Note: this release supersedes 0.2.0, which was merged but never published. Everything in the 0.2.0 changelog — opt-in --probe, the critical tier, --baseline, PR comments — ships here.

Scan every client, not just this repo

npx toolprint scan --all-clients
npx toolprint scan --client cursor --client zed

Knows where 15 agent clients keep their MCP config across macOS, Linux, and Windows, vendored from SkillRoute's harness manifests — so there's still no Python and no install. Server ids are namespaced by client (claude-code:github) so one lockfile holds several clients without collisions.

The four clients that store servers as TOML or YAML are reported as explicitly skipped, never silently counted as covered.

Skill rug-pull detection

npx toolprint pin  --skills
npx toolprint scan --skills

A SKILL.md body is text your agent reads and then follows — the same trust surface as a tool description. The entire file is hashed, frontmatter and body, so a bundle whose name and description are untouched while its instructions are rewritten is still caught:

  HIGH rug-pull  skills:.claude/skills · skill "pdf-export"
      Skill "pdf-export" definition changed (body/frontmatter) since it was pinned

  CRIT tool-poisoning  skills:.claude/skills · skill "pdf-export"
      Multiple independent injection vectors in skill "pdf-export"
      vectors: Covert precondition referencing other tools, Instruction to read sensitive files

Nothing else covers this today. skillroute validate checks bundles for spec compliance; toolprint checks them for security.

Handle false positives without lowering the gate

Reviewed exceptions go in a committed toolprint.ignore.json, keyed by the stable finding id. A suppressed finding is still reported — just not enforced. reason is required, expired entries warn and re-gate, and unused entries are reported so the file can be pruned.

Adopt on a repo that isn't clean

npx toolprint scan --baseline baseline.json --fail-on-new

Gates only on findings new since the baseline, so you can block regressions today and work the backlog on your own schedule.

Fixes

• False negative in Claude Code discovery. ~/.claude.json has no top-level mcpServers; the servers an agent actually reaches live under projects.<dir>.mcpServers. These were silently missed. Found by dogfooding this release on a real machine.
• Non-portable lockfile paths for skills (absolute machine paths would churn across machines).
• --no-telemetry was a phantom flag — advertised "disable anonymous usage telemetry" while no telemetry code has ever existed. Removed from the docs and --help; still accepted as a hidden no-op so workflows pinned to @v1 keep working.
• jestatsio/toolprint@v1 never existed as a ref. It does now, and moving it is a documented release step.
• A config with no MCP servers no longer aborts a multi-config run.

Docs

README rebuilt around the attack it catches, with a banner, badges, and terminal captures transcribed from real CLI output. Adds a 12-guide docs site, plus SECURITY.md and CONTRIBUTING.md.

Full changelog: https://github.com/jestatsio/toolprint/blob/main/CHANGELOG.md

v0.1.1

package-lock.json for MCP trust — patch release rolling up the work since v0.1.0.

Added

• Authenticate to remote MCP servers. scan/pin now reach authenticated http(s)/sse servers (hosted gateways, your own staging/prod) via --bearer <token>, repeatable --header "Name: Value", and TOOLPRINT_BEARER / TOOLPRINT_HEADER_* environment passthrough (keeps secrets off the command line and out of CI logs). Runtime auth is never written to the lockfile and never flagged by the secret-leak check. (#12, #14)
• Explicit pass/fail outcome line in human output, so a finding below --fail-on is never misread as a clean run.

Changed

• Rug-pulls now gate the default --fail-on high. Any drift to a capability you pinned is high: a changed description (as before), a changed input/output schema or metadata, or a removal — previously the schema/metadata and removal cases were medium and silently slipped past the default. Drift is a deterministic hash comparison, so this adds no false positives. New (never-pinned) capabilities stay low. (#13)

Chore

• Upgrade vitest to 4.1.8 (dev-only), fixing GHSA-5xrq-8626-4rwp. (#15)

Published to npm via OIDC trusted publishing, with provenance.

Full changelog: v0.1.0...v0.1.1

v0.1.0 — package-lock.json for MCP trust

toolprint is package-lock.json for MCP trust — scan Model Context Protocol servers for tool poisoning, leaked secrets, and silent rug-pulls, and pin what you trust into a committed, reviewable toolprint.lock.

npx toolprint scan ./.vscode/mcp.json

Highlights

• Scan any MCP server — stdio, Streamable HTTP, or legacy SSE; from a config file, http(s) URL, npx:<package>, or a raw command. It lists every tool, prompt, resource, and resource template and never executes a tool.
• Three checks
  • Rug-pull — a definition that changed since you pinned it (the classic silent-tool-swap vector), shown as a before/after diff.
  • Tool poisoning — instruction-injection hidden in any description, title, schema field, or prompt argument of any capability kind, including invisible / bidirectional-control unicode.
  • Secret leak — live-looking credentials in config or descriptions, always redacted.
• toolprint.lock — a committed, diff-friendly lockfile. pin / scan --update re-pins to reality; pinning accepts drift while poisoning and secret findings still gate; writes are idempotent.
• Reporting — human, JSON, and SARIF 2.1.0 for GitHub code scanning.
• CI — a GitHub Action (jestatsio/toolprint@v1) with a sarif-file input, and a documented exit-code contract.
• Hardened — recursive walkers over untrusted server JSON are depth-bounded, so a hostile server can't crash a scan.

Install

npx toolprint scan <target>
# or
npm install -g toolprint

Full details in the CHANGELOG and README. Published to npm with build provenance.