No. npm provenance links a published package to its source code and build, and records who published it. npm's own documentation says this does not guarantee the package has no malicious code. Treat provenance as one useful signal when you vet an MCP server, then still review, scan and sandbox it.
What provenance is
npm describes two attestations. A provenance attestation is supplied by the publisher and connects the package to its source repository and build instructions. A publish attestation is generated by the registry when an authorized user publishes, signed with Sigstore and recorded in a public transparency ledger.
For an MCP server shipped as an npm package, this answers a narrow question: was this tarball built from the repository it claims, by the account that claims it?
What it proves and what it does not
| Question | Provenance helps? |
|---|---|
| Was the package built from the named repository | Yes |
| Who published it | Yes |
| Is the source code free of malicious logic | No |
| Are its dependencies safe | No |
| Will the next release behave the same | No |
| Does the tool list match what you approved | No |
A malicious maintainer can publish a package with perfectly valid provenance. The attestation proves the origin, not the intent.
How to check it
- Run npm audit signatures in the project. It reports how many packages have verified registry signatures and verified attestations.
- Note any package that has no attestation and decide whether you accept that.
- Keep the npm client current, since npm warns that the attestation format may change.
- Compare the source repository named in the attestation with the one the server vendor documents.
What to add on top
Provenance belongs in a short checklist, not in place of one.
- Pin the exact version and review changes before you upgrade.
- Inventory the transitive dependencies of the server and scan them for known vulnerabilities.
- Read the install scripts and the startup command before you run them.
- Run the server in a sandbox with narrow credentials.
- Watch for the tool list changing after an update.
A note on npx
Many MCP servers are launched with a command that downloads and runs the latest package. That makes every launch a fresh trust decision. Pinning a version, or installing once and reviewing, turns it into a decision you make on purpose.
Safeguard includes SBOM and dependency scanning for the packages behind your tools, with a free scan at https://gold.safeguard.sh/scan.
Try it yourself
Open the dependency inventory and expand a package to see its transitive dependencies, which provenance on the top package does not cover.
Click through it at your own pace, or open it full screen.
Quick check
Does a package without provenance mean it is malicious?
No. Many safe packages have no attestation. It means one verification option is missing, so you rely more on review and scanning.
Does provenance cover dependencies?
The attestation is about the package you installed. You still need to scan the dependency tree separately.
Sources
Last reviewed: 19 October 2026.
