Atlas / MCP servers / provimedia / Chainguard

ChainguardBLOCK

Name: Chainguard
Author: provimedia

mcp/provimedia/chainguard

MCP server by provimedia · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Chainguard MCP with Long Term Memory and Different Task Modes.

Verdict

BLOCK

Grade

Trust score

60 /100

Exposed tools

62 40r · 17w · 5d

Transport

stdio

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://polyformproject.org/licenses/noncommercial/1.0.0) [](https://www.python.org/downloads/) [](https://modelcontextprotocol.io/)

Chainguard is a Model Context Protocol (MCP) server that enhances Claude Code with task tracking, syntax validation, long-term memory, and intelligent context management.

Features

Core Features

Task Scope Management - Define task boundaries, acceptance criteria, and track progress
Automatic Syntax Validation - PHP, JavaScript, JSON, Python, TypeScript validation on file changes
PHPStan Integration (v6.3) - Static analysis catches runtime errors BEFORE execution (null access, type errors)
Smart Context Tracking - Canary-based context refresh ensures Claude never loses important instructions
HTTP Endpoint Testing - Test endpoints with session support and automatic auth detection

Long-Term Memory (v5.1+, rewritten in v6.6)

Semantic Code Search - Natural language queries like "Where is authentication handled?"
Lightweight Vector Store - fastembed (ONNX Runtime) + numpy + sqlite3, ~500 MB RAM (replaced ChromaDB)
Multilingual Embeddings - paraphrase-multilingual-MiniLM-L12-v2 supports 50+ languages including German
6 Knowledge Collections - codestructure, functions, databaseschema, architecture, learnings, code_summaries
RAG Pipeline - Hybrid retrieval with semantic similarity (60%), keyword matching (25%), and recency scoring (15%)
Automatic Context Injection - UserPromptSubmit hook injects relevant memory context before every LLM call
Auto-Refresh Stale Memory (v6.8) - Detects memory older than 30 days at set_scope and incrementally re-indexes changed files
Project Isolation -

Read from source at commit 83afcba4d454OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add chainguard --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} -- uvx chainguard

claude-desktop

{
  "mcpServers": {
    "chainguard": {
      "command": "uvx",
      "args": [
        "chainguard"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}"
      }
    }
  }
}

Exposed tools (62)

40 read · 17 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`chainguard_add_source`	write	Track research source (RESEARCH mode). Log URLs and documents for later reference.
`chainguard_alert`	write	Add alert for issues that need attention.
`chainguard_analyze`	read	Pre-flight check for code analysis. Returns metrics, patterns, hotspots, and a tailored checklist.
`chainguard_analyze_code`	read	Analyze code structure using AST parsing. Extracts classes, functions, methods, imports, and relationships. Uses tree-sitter when available, falls back to regex.
`chainguard_check_criteria`	read	Mark acceptance criterion as done or view all criteria status.
`chainguard_checkpoint`	write	Create rollback checkpoint (DEVOPS mode). Save state before critical changes.
`chainguard_clear_alerts`	destructive	Acknowledge all alerts.
`chainguard_clear_session`	destructive	Clear stored session/cookies.
`chainguard_config`	write	View or set config.
`chainguard_context`	read	Full context - USE SPARINGLY. Only when you need details.
`chainguard_db_connect`	read	Connect to database. v6.4: Credentials are saved (obfuscated) per project after successful connection. Call without params to use saved credentials.
`chainguard_db_disconnect`	destructive	Disconnect from database and clear schema cache.
`chainguard_db_forget`	destructive	Delete saved DB credentials for this project. Use when password changed or to remove stored credentials.
`chainguard_db_schema`	read	Get database schema (tables, columns, types, keys). Cached for 5 minutes. Use before writing SQL queries.
`chainguard_db_table`	read	Get detailed info for a single table including optional sample data.
`chainguard_detect_architecture`	read	Detect architectural patterns in the codebase. Identifies MVC, MVVM, Clean Architecture, Layered, API-first, and more. Also detects framework (Laravel, Django, React, etc.).
`chainguard_facts`	read	List all indexed facts (RESEARCH mode). Shows facts by confidence.
`chainguard_finish`	read	Complete task with FULL validation. 2-step process with impact-check.
`chainguard_health_check`	write	Run health checks (DEVOPS mode). Quick status of endpoints and services.
`chainguard_history`	read	View recent change history for the project.
`chainguard_index_fact`	read	Index discovered fact (RESEARCH mode). Store findings with confidence level.
`chainguard_kanban`	read
`chainguard_kanban_add`	write
`chainguard_kanban_archive`	read	Archive a card. Removes from board but keeps in archive.yaml for history.
`chainguard_kanban_delete`	destructive	Delete a card permanently. Use for cards created by mistake.
`chainguard_kanban_detail`	read	Get detailed information for a card, including linked markdown content.
`chainguard_kanban_history`	read	View archived cards. Shows cards that were completed and archived.
`chainguard_kanban_init`	read
`chainguard_kanban_move`	write	Move a card to a different column. Use to update task status.
`chainguard_kanban_show`	read
`chainguard_kanban_update`	write	Update card properties (title, priority, tags, dependencies).
`chainguard_learn`	read	Document a fix/resolution for the most recent error. Teaches the system for future Auto-Suggest.
`chainguard_list_exports`	read	List available memory export files.
`chainguard_log_command`	read	Log executed command (DEVOPS mode). Tracks CLI commands for audit trail.
`chainguard_login`	read	Login to application and store session.
`chainguard_memory_export`	read	Export project memory to a portable JSON or JSONL file. Useful for backup or transfer between machines.
`chainguard_memory_import`	write	Import project memory from an exported JSON or JSONL file.
`chainguard_memory_init`	read
`chainguard_memory_query`	read
`chainguard_memory_status`	read	Show Long-Term Memory status and statistics. Shows indexed documents, storage size, and last update.
`chainguard_memory_summarize`	read
`chainguard_memory_update`	write
`chainguard_projects`	read	List all tracked projects.
`chainguard_recall`	read	Search error history for similar issues and fixes. Use when encountering a problem.
`chainguard_run_checklist`	write	Execute all checklist checks. Returns pass/fail summary.
`chainguard_run_tests`	write	Run tests using configured command. Auto-detects PHPUnit/Jest/pytest output.
`chainguard_set_base_url`	write	Set base URL for HTTP tests
`chainguard_set_phase`	write	Set phase: planning, implementation, testing, review, done
`chainguard_set_scope`	write
`chainguard_sources`	read	List all tracked sources (RESEARCH mode). Shows sources by relevance.
`chainguard_status`	read	Ultra-compact one-line status. USE THIS for quick checks.
`chainguard_symbol_mode`	read
`chainguard_test_config`	read	Configure test command. Stores command for chainguard_run_tests.
`chainguard_test_endpoint`	read	Test HTTP endpoint with session support. Detects auth requirements.
`chainguard_test_status`	write	Show last test run status with errors.
`chainguard_track`	read	Track file change + AUTO-VALIDATE syntax (PHP/JS/JSON/Python/TS). Returns errors immediately. Silent if OK.
`chainguard_track_batch`	read	Track multiple files at once with syntax validation. More efficient than multiple track calls.
`chainguard_track_chapter`	write	Track chapter progress (CONTENT mode). Set chapter status: draft, review, done.
`chainguard_validate`	read	Record validation result. Resets change counter.
`chainguard_validate_packages`	read
`chainguard_validate_symbols`	read
`chainguard_word_count`	read	Get word count statistics (CONTENT mode). Shows total words and chapter progress.

Trust audit

BLOCKgrade F · trust 60/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (8 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (17)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/mcp-server/chainguard/symbol_patterns.py:932

r'eval\s*\(',               # eval()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/mcp-server/chainguard/symbol_patterns.py:933

r'Function\s*\(',           # new Function()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/mcp-server/chainguard/symbol_patterns.py:958

r'exec\s*\(',               # exec()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/mcp-server/chainguard/symbol_patterns.py:959

r'eval\s*\(',               # eval()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/mcp-server/chainguard/memory.py:101

".pem", ".key", "id_rsa",

Why it matters. touches a credential store

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/mcp-server/chainguard/ast_analyzer.py:668

lang_module = __import__(package_name)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

chainguard_clear_alerts, chainguard_clear_session, chainguard_db_disconnect, chainguard_db_forget, chainguard_kanban_delete

Why it matters. 5 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/mcp-server/tests/test_symbol_validation.py:700

code = "eval(code);"

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/mcp-server/chainguard/data/php_builtins.json:18702

"MCRYPT_MODE_ECB",

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/mcp-server/chainguard/db_credentials.py:61

return hashlib.md5(normalized.encode()).hexdigest()[:12]

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/mcp-server/tests/test_memory.py:308

assert should_index_file("id_rsa") is False

Why it matters. touches a credential store

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

src/mcp-server/chainguard/db_credentials.py:52

data_bytes = base64.b64decode(obfuscated)

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

src/mcp-server/tests/test_db_credentials.py:103

decoded = base64.b64decode(obfuscated)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

requirements.txt

mcp, pyyaml, anthropic

Why it matters. 3 requirement(s) not pinned with ==

Fix. pin exact versions

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

src/mcp-server/requirements.txt

mcp, aiofiles, aiohttp, aiomysql, pyyaml, fastembed, numpy

Why it matters. 7 requirement(s) not pinned with ==

Fix. pin exact versions

INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/TESTING.md:418

| `TestCredentialStore` | 15 | Save/Load/Delete Credentials |

Why it matters. asks the agent to read credentials

INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357

README.md:104

curl -fsSL https://raw.githubusercontent.com/provimedia/chainguard/main/installer/install.sh | bash

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 83afcba4d454full audit observations/trust-audit/mcp-server/provimedia__chainguard.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-08	`83afcba4d454`	BLOCK	F	60	first audit

Questions

What is the Chainguard MCP server?

Chainguard MCP with Long Term Memory and Different Task Modes.

What tools does Chainguard expose?

62 in total: 40 read-only, 17 that write, and 5 that can delete or overwrite (chainguard_clear_alerts, chainguard_clear_session, chainguard_db_disconnect, chainguard_db_forget, chainguard_kanban_delete). Every one is listed on this page with its risk.

Is Chainguard safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (60/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Chainguard need?

It reads ANTHROPIC_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Chainguard run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as chainguard.

How current is this page?

The grade is for one exact copy of the source (83afcba4d454), read on 2026-10-08. The repository is watched and re-audited when it changes.

Source	provimedia/provimedia-mcp
PyPI	`chainguard`
Transports	stdio
Credentials it reads	`ANTHROPIC_API_KEY`
License	NOASSERTION
Activity	pushed 247d ago