← All rules

mcp-scan rule

Potential typosquatting

typosquat-detectionhigh

What mcp-scan saw

The typosquat scanner resolved the package name, stripped version tags, and skipped it if it is in the official or trusted-community sets. It then compared the base name (the part after a scope slash) against every trusted base name three ways: homoglyph normalization mapping Cyrillic, Greek, and accented lookalikes plus digit substitutions back to ASCII; Levenshtein distance of 1 or 2; and equality after removing all hyphens.

Why it fires

Homoglyph and one-character substitution attacks work because the name is read once during setup and never again. The base-name comparison is what makes the check useful against scoped packages: an attacker publishing @evil/server-filesystem gets the same visual weight as the official one in a config file, and only the scope differs.

When this is a false positive

  • The homoglyph branch compares base names after normalization, so any legitimate fork or vendored republish keeps the base name and matches at distance zero. @yourorg/server-filesystem is flagged against @modelcontextprotocol/server-filesystem by design of the comparison.
  • Short base names collide easily at distance 2. Any name within two edits of a trusted base, for example mcp-fetcher against mcp-fetch, matches without intent.
  • The hyphen-insensitive branch flags a package that differs from a trusted one only by hyphenation, which is a common independent naming choice rather than an attack.
  • The trusted sets are hardcoded lists with a LAST_UPDATED date, so a package that has since become official is still compared as an outsider.

How to fix it

  1. Read the finding: it names the trusted package it resembles and the reason (homoglyph substitution, character substitution or omission, or missing or extra hyphen).
  2. Copy the package name out of your config and paste it into npmjs.com. Do not retype it, since retyping is how the substitution gets normalized away.
  3. Check the publisher and the repository link on the package page against the trusted package's.
  4. If it is a lookalike, remove the server and rotate anything in its env block.
  5. If it is your own fork, keep it and add 'typosquat-detection' to suppressRules in .mcp-scan.json, or add the server's config key to .mcp-scan-ignore so only that server is downgraded.
  6. This finding is marked not fixable, so mcp-scan fix will not touch it.