THRONE
See report Verify server

Resources

Everything behind a Throne verdict.

How to run Throne, how a verdict is made, the security checks it applies, a real report, and why the tools your agents call need to be vetted. One place, in the order you would read it.

Quickstart

Run a public package, repo, or local config. The first run returns the client matrix, security findings, verdict, and a report link.

npx throne run @modelcontextprotocol/server-everything
npx throne run github.com/acme/files-mcp
npx throne run ./mcp.config.json

Accepted targets

TypeExampleBest for
npm@scope/serverpublished Node MCP servers
uvxuvx mcp-serverPython packages
GitHubgithub.com/acme/serversource scans before publish
config./mcp.config.jsoncustom launch commands

Minimal config

{
  "name": "files-mcp",
  "command": "node",
  "args": ["dist/server.js"],
  "cwd": ".",
  "security": {
    "root": "./fixtures/workspace",
    "failOn": ["high"]
  }
}

CI gate

Use the GitHub Action to block merges when the verdict regresses.

- uses: usethrone/throne-ci@v1
  with:
    target: ./mcp.config.json
    api-key: ${{ secrets.THRONE_API_KEY }}

Replay a failing cell

npx throne replay run_4821 \
  --client cursor \
  --step streaming \
  --trace traces/cursor-streaming-timeout.json

Exit codes

CodeVerdictMeaning
0passAll requested release gates passed.
1reviewWarnings were found and strict mode is enabled.
2failA client failure, blocked launch, or high security finding exists.

how it works

Every verdict comes from a run you can inspect.

Throne does not grade README claims. It starts the artifact, replays calibrated client behavior, records raw traces, scans risk, and seals the evidence. Vendor neutral: no hosting, no IDE, no framework lock-in.

01Resolve target

GitHub repo, npm package, uvx command, or JSON config.

02Boot microVM

Install and launch the server in a single-use sandbox.

03Replay clients

Server behavior is replayed under Claude Code and Cursor identities, calibrated from recorded Claude Code 2.1.172 and Cursor 3.4.20 traffic, with serial vs pipelined dispatch and Cursor's 2 connections.

04Run nine compatibility checks

Connect, discover, schema, tools, errors, streaming, resources, parallel, reconnect.

05Scan security

Path, shell, prompt, secret, obfuscation, network, dependency, and install heuristics.

06Seal evidence

Publish scan id, raw trace, timestamp, verdict, and evidence hash.

Client coverage

Tested against Claude Code and Cursor client profiles with recorded behavior. Compatible with Claude Code and Cursor profiles as tested. Planned clients are visible so you understand the roadmap, but they never produce a false pass or fail.

liveClaude Code

nine compatibility checks

liveCursor

nine compatibility checks

coming soonChatGPT Desktop

profile pending real-traffic capture

plannedCodex CLI

emulation profile not yet calibrated

plannedZed

emulation profile not yet calibrated

Verdict model

Compatibility and security stay separate until the release call. They are never blended into one number.

FIT

Ship

Live client checks pass and no release-blocking security finding is present.

REVIEW

Fix or approve

The server runs, but needs credentials, launch arguments, or security review before trust.

BLOCK

Do not release

A real client fails, the server never launches, or a high severity finding is present.

security

The eight static rules.

Each scan downloads the source (never executes it) and runs eight static rules over it. They are heuristics and say so. A ninth (rate limiting) needs runtime analysis and is not run today. Findings are review material; a HIGH finding blocks a clean ship verdict.

MEDIUM

Path traversal

Filesystem calls built from request-like input with no visible path normalization. Heuristic.

THR-PATH-01
HIGH

Hardcoded secrets

Live-looking tokens or keys in source (AWS, GitHub, Slack, private keys). Placeholder values are excluded.

THR-SECRET-02
HIGH

Install-time execution

npm preinstall, install, or postinstall scripts that run arbitrary code on every install.

THR-INSTALL-03
HIGH

Command execution

exec, spawn, or subprocess built from dynamic, argument-like input. Heuristic.

THR-EXEC-04
LOW

Outbound endpoints

Hardcoded non-local hosts referenced in code, surfaced for review.

THR-NET-05
MEDIUM

Obfuscated payloads

Large base64-like blobs, flagged higher when the same file also decodes or executes data.

THR-OBF-06
MEDIUM

Prompt injection

Injection-style phrases or invisible unicode characters in tool-facing strings.

THR-PROMPT-07
LOW

Outdated SDK pins

Pre-1.0 MCP SDK pin or obsolete protocol version strings in source.

THR-VER-11

Anatomy of a finding

Each finding ships with the offending surface, a reproduction, the observed result, and the fix pattern. Enough evidence to fix it, not just fear it.

ruleTHR-PATH-01 / MEDIUM
input{ "path": "../.ssh/id_rsa" }
resultescaped declared root
fixresolve, normalize, compare root, deny symlinks

evidence

A sample report.

One artifact for engineering, security, and release: client matrix, raw trace, security findings, and a sealed receipt. Open the live, interactive sample to click through the matrix, trace, security, and receipt tabs.

Open the sample report Run one on your server

The public registry

Every server Throne executes is recorded publicly: verdict, security state, sealed date, and evidence hash. Browse the records, filter by verdict, and open any one to inspect the proof.

Browse the registry

Why this matters

AI agents now act through MCP servers that can read files, call APIs, move data, and touch credentials, and almost none of them have been independently run before someone trusted them. A broken server fails silently for everyone who installed it; an unsafe one becomes a breach vector the moment an agent drives it.

Read: the tools your agents use are unvetted Governance for teams