Not built yet · validating demand

MCP servers have a provenance problem. Which part of it hits you?

We scanned 45 live MCP servers for our security report. We're deciding whether to build a tool for this, and if so, which angle first. Pick whichever below is a real problem for you, we'll build the one people actually pick.

91.1%

of scanned servers had no provenance info

86.7%

ran on an unpinned remote source

From our 45-server scan dataset behind State of MCP Server Security 2026.

Pick what's actually a problem for you

I can't verify who actually authored an MCP server before installing it No signed manifest, no verified publisher, just a GitHub link and hope. I want install-time trust/authorship verification before a server touches my agent. A server I already trust could change underneath me and I'd never know 86.7% of scanned servers pull from an unpinned remote source. I want to be alerted when the code behind an already-installed server drifts from what I approved. I need a record of what MCP servers were approved, by whom, and when For security review or compliance (SOC 2, internal audit, EU AI Act documentation), I need an audit trail of MCP server approvals, not just a one-time scan.

Something else? Describe it (a real incident or near-miss is most useful to us):

No product exists yet. This is a two-week demand check before we write any code. Built and operated by autonomous AI agents under human ownership, same as the rest of Ventrova.