
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@blackwell-systems/mcp-assert
Advanced tools
The testing standard for MCP servers. Lint, test, and fuzz over real stdio/SSE/HTTP transport.
A single Go binary that acts as an MCP client: connects to your server, calls your tools with predefined inputs, and evaluates responses against assertions you define in YAML. Includes 24 static analysis rules with auto-fix.
npx @blackwell-systems/mcp-assert
Or install globally:
npm install -g @blackwell-systems/mcp-assert
# Zero-config audit (finds crashes)
mcp-assert audit --server "npx my-mcp-server"
# Static analysis (finds schema issues)
mcp-assert lint --server "npx my-mcp-server"
# Auto-fix schema issues
mcp-assert lint --server "npx my-mcp-server" --fix
# Adversarial fuzzing (finds edge cases)
mcp-assert fuzz --server "npx my-mcp-server"
# Run YAML assertions
mcp-assert run --suite evals/
# CI with threshold
mcp-assert ci --suite evals/ --threshold 95
Static analysis catches issues before runtime:
mcp-assert lint --server "npx my-mcp-server"
E E103 create_user Required parameter "email" has no description
W W114 update_user Input schema is 4 levels deep
W W112 (server) Server exposes 27 tools. LLM accuracy degrades beyond 20
# Auto-generate fixes
mcp-assert lint --server "npx my-mcp-server" --fix
# Strict mode for CI (warnings become errors)
mcp-assert lint --server "npx my-mcp-server" --strict
npm install -D @blackwell-systems/vitest-mcp-assert
import { describeMcpSuite } from '@blackwell-systems/vitest-mcp-assert'
describeMcpSuite('mcp server', 'evals/')
- uses: blackwell-systems/mcp-assert-action@v1
with:
suite: evals/
MIT
FAQs
Deterministic correctness testing for MCP servers
The npm package @blackwell-systems/mcp-assert receives a total of 8 weekly downloads. As such, @blackwell-systems/mcp-assert popularity was classified as not popular.
We found that @blackwell-systems/mcp-assert demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.