mcpm

Overview

mcpm is an MCP package manager that brings trust scoring, runtime guards, and Sigstore provenance verification to your AI toolkit. By implementing the Model Context Protocol, it lets Claude, Cursor, and other AI assistants call mcpm as native tools instead of requiring manual workflows between separate applications.

The server runs locally via the npm package @getmcpm/cli, communicating over stdio with zero configuration or external credentials needed. Version v0.30.0 is available now under the MIT license, with full source code at getmcpm/cli on GitHub.

mcpm is listed in the AI & Agents category on mcp.site and works with all major MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain mcpm for getmcpm, you can claim this listing to verify ownership and keep information up to date.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "mcpm": {
      "command": "npx",
      "args": [
        "-y",
        "@getmcpm/cli"
      ]
    }
  }
}