vigile_check_provenance
Fetch canonical provenance payload for a memory source ID.
LABSCO SUMMARY
Lookups are free; only scanning something new spends quota.
Checking a server or skill Vigile has already scored, and searching the registry, cost nothing against the monthly allowance — only vigile_scan_content, which analyses content nobody has scored yet, draws it down. That makes the useful habit a cheap one: look a package up before wiring it into a config, and spend a scan only on the claude.md or .cursorrules file that arrived from somewhere you cannot vouch for. Read the number as one input rather than a verdict; the publisher says plainly that it comes from automated analysis and does not claim to catch everything.
What it is
A client for Vigile's trust registry, which scores MCP servers and agent skills against tool poisoning, data exfiltration, prompt injection and supply-chain attacks. It covers servers from npm, Smithery, PyPI and other registries and skills from Claude Code, Cursor and OpenClaw/ClawHub, with a memory layer for recalling what an earlier investigation found.
What you get
- vigile_check_server returns a 0-100 trust score, a trust level, a findings summary and a link to the full report for a named server or package
- vigile_check_skill does the same for a skill file — claude.md, .cursorrules, skill.md and their relatives
- vigile_scan_content takes raw file content and analyses it directly, for something nobody has scored yet
- vigile_search finds servers and skills by keyword with their scores already attached
- The scale is published rather than implied: 80-100 trusted, 60-79 caution, 40-59 risky, 0-39 dangerous
- vigile_verify_location assesses location privacy and safety risk for physical-world interactions such as deliveries, meetups and transactions, preferring an H3 cell index over raw coordinates
- A memory layer sits alongside: vigile_remember records a bounded security episode, vigile_recall returns compact context and evidence chunks with provenance status, vigile_timeline assembles a timeline for an incident or topic, and vigile_check_provenance fetches the canonical payload behind a source id
Requirements
Node.js 18 or newer, run as npx -y vigile-mcp over stdio, or installed globally. It works against the public registry with no key at 10 scans a minute and 50 a month; VIGILE_API_KEY raises that to 60 a minute and 1,000 a month on Pro at $30/mo, or 300 a minute and 5,000 a month on Pro+ at $100/mo. Registry lookups — check_server, check_skill and search — do not count against the quota; only vigile_scan_content does. The publisher states that scores come from automated analysis and are not a security guarantee. MIT.
Setup effort
One command — npx -y vigile-mcp
USE CASES
01
Checking a server before you add it to your config
Look up the trust score, the level it falls into and the findings summary, with a link to the full report when the summary is not enough.
02
Vetting a skill file someone sent you
Look it up if it is already known, and submit the raw content for analysis if it is not — the second is the one that costs a scan.
03
Choosing between servers that do the same job
Search by capability and compare the trust scores that come back attached, before choosing on features alone.
04
Judging whether a location-aware interaction is safe
Pass an H3 cell rather than exact coordinates and get a risk level with the factors behind it, for deliveries, meetups or transactions.
05
Picking up an investigation where it was left
Recall what was recorded about an entity or incident with its evidence and provenance, build the timeline, and add what you learn this time.
9 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
vigile_check_server
Look up the trust score and security findings for an MCP server in the Vigile registry. Returns trust score (0-100), trust level, findings summary, and a link to the full report.
vigile_check_skill
Look up the trust score for an agent skill (claude.md, .cursorrules, skill.md, etc.) in the Vigile registry. Returns trust score, trust level, findings summary.
vigile_recall
Recall prior Vigile security memory context for an entity, pattern, or incident. Returns compact context, evidence chunks, and source references with provenance status.
vigile_remember
Record a bounded security memory episode for future recall (idempotent write path).
vigile_scan_content
Scan the content of an agent skill file for security issues. Submit raw content from a claude.md, .cursorrules, skill.md, or similar file for analysis. Returns trust score and detailed findings.
vigile_search
Search the Vigile registry for MCP servers and agent skills by keyword. Returns matching entries with trust scores. Use this when you need to find servers by description or capability.
vigile_timeline
Fetch a security timeline for an incident or topic from Vigile memory.
vigile_verify_location
Assess location-related privacy and safety risks for AI agent interactions involving physical-world context (deliveries, meetups, financial transactions). Accepts an H3 cell index (preferred, privacy-preserving) or lat/lng coordinates with optional context. Returns risk level, score, factors, and recommendation. All assessment is performed locally — no location data is transmitted to Vigile servers.
BEFORE YOU INSTALL
What to know first
Tools you get
9 tools when we connected. vigile_remember, vigile_recall, vigile_timeline and vigile_check_provenance are undocumented. Only vigile_scan_content uses the scan allowance, which without a key is 10 a minute and 50 a month.
Requires
- npx on PATH
- Node.js 18+
Where it runs
All 6 documented clients run the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 9 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y vigile-mcpMCP Clients
Claude Desktop, Cursor, Windsurf, Claude Code
JSON
{
"mcpServers": {
"vigile": {
"command": "npx",
"args": [
"-y",
"vigile-mcp"
]
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"vigile": {
"command": "npx",
"args": [
"-y",
"vigile-mcp"
]
}
}
}Any MCP client — global install
ANY MCP CLIENT — GLOBAL INSTALL · JSON
{
"mcpServers": {
"vigile": {
"command": "vigile-mcp"
}
}
}
