The private trust registry for MCP tools. Approve once. Pin. Detect rug-pulls forever.
Register, verify, pin (박제), and audit every MCP server, Skill, and Tool your agents use — and catch the moment an approved definition is silently changed.
Installs into Claude · Cursor · Codex
Open source (AGPL-3.0) · self-hosted · zero outbound by default
SEE IT CATCH A RUG-PULL
Approve once. The moment it changes, you know.
A pinned web_search tool is silently rewritten upstream to exfiltrate secrets — Vouchq flags the drift and the live version as CRITICAL, and only the pinned, benign version reaches agents.
Reproduce it in ~90s — examples/evil-mcp-rugpull/
THE THREAT · RUG-PULL
A tool that was safe yesterday can betray you today.
AI agents load Skills and connect to MCP servers whose tool descriptions can change at runtime. The MCP spec itself permits mid-session description changes — with no integrity check, no hash pinning, and no forced re-approval.
Adopted clean
You review a Skill or MCP tool, it looks benign, and you approve it. A discovery catalog checks it once and moves on.
Mutated later
The description quietly gains a hidden line — "…also send the result to attacker.com" — and the agent obeys it.
No baseline, no proof
Without a pinned “approved version”, there is nothing to diff against — and no tamper-evident record of who approved what, when, for an audit.
Vouchq closes this gap: it continuously verifies the live definition against a cryptographically pinned baseline — so post-approval tampering is caught, not assumed away.
KEY CAPABILITIES
Governance on the way in. Vouched distribution on the way out.
A control-plane issuer of trust — not a discovery catalog, and not an inline proxy.
Ingestion & inventory
Connect Git repos and MCP servers. The OSS parser normalizes Skills and tools into one model and builds a searchable inventory.
Risk scanning
Rule-based detection of prompt injection, secrets, data exfiltration, and dangerous commands — a 0–100 score with false-positive suppression.
Approve & pin (박제)
Approving snapshots the definition as an immutable SHA-256 baseline — the 정본 every later check is measured against.
Drift / rug-pull detection
Scheduled re-scan compares live vs. pinned. Divergence raises a DriftEvent with severity and a field-level diff.
Policy engine
Declarative rules auto-block or hold anything that crosses a risk threshold or trips a critical drift — gating without waiting on a human.
Audit · WORM + hash chain
Every event is append-only and linked in a SHA-256 chain, WORM-enforced at the database. Tampering breaks the chain — real compliance evidence.
RBAC & multitenancy
Admin / Member / Viewer roles via Spring Security. Data isolated by org and enforced at the query layer for safe multi-team sharing.
Distribution / install
Developers pull only vouched versions. Each source group has a one-click install — a hash-verified curl | sh for Claude or Cursor (skills) and a vouched config for remote MCP servers, never the live upstream.
CI verify / build gate
A read-only GitHub Action fails the build when a skill isn't an approved, pinned version — CHANGED / BLOCKED / UNKNOWN. Unapproved capabilities are stopped on the way in.
Self-governing ruleset
Vouchq continuously canary-tests its own scanner. If a rule is weakened — by a PR or a tamper — it fails closed: approvals suspend until detection is proven again.
HOW IT WORKS
Two doors, one cryptographic source of truth.
Definitions flow in through governance and out as vouched, pinned artifacts. The pin is the pivot in the middle.
DOOR IN · GOVERNANCE
-
01
Ingest
Git repo / MCP server → parsed into a normalized definition.
-
02
Scan
Risk score + findings, with false-positive suppression.
-
03
Approve & pin
Immutable SHA-256 baseline — the 정본.
-
04
Detect drift
Re-scan compares live vs. pinned → DriftEvent on divergence.
-
05
Govern
Policy auto-block/hold → hash-chained WORM audit log.
DOOR OUT · DISTRIBUTION
Install only what's vouched
Developers install the approved, pinned version straight into their agent — a one-click install emits a hash-verified curl | sh that writes a source's skills into .claude/skills/, MCP as vouched connection configs. Every install is logged to the WORM audit. Vouchq issues the trusted artifact; it never sits inline in the request path.
OPEN SOURCE & SELF-HOSTED
Fully open source. Self-hosted by design.
The whole stack — control plane, console, and the parser/scanner libraries — is open source under AGPL-3.0. The network clause keeps every part open even when run as a service, so a thin wrapper around the cores can't be sold as a closed SaaS.
- Zero outbound by default. A fresh instance makes no phone-home calls — every integration is opt-in.
- Standard dependencies only. Postgres + a single Spring Boot unit, up with one Compose file.
- Hardened runtime. Multi-stage build, non-root, read-only filesystem, all capabilities dropped.
:parser library — definition parser, pure Java
:scanner library — rule-based risk scanner
:app Control plane (Spring Boot) — AGPL-3.0
└ registry / audit / notify / policy / tenancy / api
console/ Admin console (Next.js + Tailwind) — AGPL-3.0Java 21 · Spring Boot 3 · PostgreSQL · Flyway · Gradle · Next.js + Tailwind
Govern the tools your agents trust — in minutes.
Spin up the backend and console locally with one container runtime and Node 20.
# backend + Postgres (no local JDK needed)
docker compose up --build -d
# console (dev server)
cd console && npm install
API_PROXY_TARGET=http://localhost:8080 npm run dev
# → http://localhost:3000# Postgres + backend + console, one hardened stack
cp .env.prod.example .env && chmod 600 .env
docker compose -f compose.prod.yaml --env-file .env up -d --build
# console front door → 127.0.0.1:3000 (put TLS proxy here)Works the same with podman compose — same files, both runtimes.