Your MCP Servers Have No Supply Chain — Here's What That Actually Means

350k+ agent skills shipped in starting three months.
None of them had proper governance. Same happened with MCP
Developers share MCP servers via git repos and zip files.
No versioning. No scanning. No signing.
It's the container supply chain chaos all over again.
Except these artifacts take actions on your behalf.
Jozu MCP Registry solves this with OCI-compatible packaging:
→ Implements MCP registry spec natively
→ VS Code, Cursor, Claude Desktop connect directly
→ Every server scanned across 9 vulnerability classes
→ Cryptographic signatures via Cosign
→ Policy gating before production
→ Tamper-evident audit trail
For developers = curated catalog of pre-vetted tools.
Not a security ticket queue.
Runtime governance through Agent Guard:
Agent Guard sits between your agent and the host machine, running in an isolated microVM (Apple Virtualization framework on Silicon).
→ Agent Guard AI Gateway evaluates every tool call from inside the microVM
→ Tool-level policy enforcement per invocation
→ Workspace shared via virtiofs (live bidirectional mount, no sync step)
→ Network traffic goes through user-space stack, never touches host interfaces directly
→ Per-session credentials minted at boot, destroyed on exit
→ Human-in-the-loop for high-risk actions
→ Works on air-gapped environments
The binary embeds everything: Linux kernel (2.5MB), initrd (10MB), AI gateway (40MB), Debian rootfs (~500MB).
Boot takes ~1 second after first run.
No Docker, QEMU, or network fetch required.
Built on KitOps (CNCF) and ModelPack spec.
Works with Harbor, ECR, GCR, Artifactory, Docker Hub.
Same workflow you have today.
Just point your IDE at a different registry endpoint.
https://lnkd.in/g-CQV-KB

Core claims about Jozu, KitOps, and the ecosystem problem are accurate. Some granular technical specs couldn't be independently verified.

• "350k+ agent skills shipped in the first three months" — accurate, close to the actual timeline. Multiple sources track the same pattern: agent skill marketplaces crossed roughly 350,000 packages within about two months of launch in early 2026, a pace compared to npm's decade-long climb to the same milestone. "Three months" is a close approximation of the actual roughly two-month timeline.
• "None of them had proper governance" — directionally supported. Independent security research has documented real supply-chain incidents in this exact ecosystem, including a campaign where nearly 1,200 malicious skills infiltrated a major agent marketplace and exfiltrated credentials, wallets, and API keys.
• "Developers share MCP servers via git repos and zip files, no versioning, no scanning, no signing" — accurate characterization of the pre-OCI-packaging status quo that Jozu and KitOps position themselves against.
• Jozu MCP Registry / Jozu Hub: OCI-compatible packaging, MCP registry spec, VS Code/Cursor/Claude Desktop connect directly — accurate. Jozu's own materials describe exactly this: your IDE points to Jozu Hub as its MCP registry, with servers packaged as OCI-compliant artifacts.
• "Scanned across 9 vulnerability classes" — accurate, matches Jozu's own stated scanning scope, including content safety, prompt injection susceptibility, and backdoor detection.
• Cryptographic signatures via Cosign — accurate, confirmed as Jozu's actual signing mechanism.
• Policy gating before production, tamper-evident audit trail — accurate, matches Jozu Hub's described artifact policy gates and audit logging.
• Agent Guard: microVM isolation, tool-level policy enforcement, human-in-the-loop, air-gapped support — accurate at the conceptual level. Jozu's own materials confirm Agent Guard runs agents inside isolated environments with per-invocation policy enforcement, human-in-the-loop for high-risk actions, and air-gapped/no-connectivity operation. It currently runs on macOS via Apple Virtualization Framework and on Linux, with Windows support in development — the post's specific mention of Apple Virtualization on Silicon is accurate.
• Specific binary sizes (2.5MB kernel, 10MB initrd, 40MB AI gateway, ~500MB Debian rootfs) and ~1 second boot time — these precise numbers could not be independently confirmed from what's publicly available. They're plausible given the general microVM category (comparable lightweight microVM runtimes do report sub-second to low-second boot times), but treat these exact figures as unverified rather than confirmed.
• "Per-session credentials minted at boot, destroyed on exit" and "network traffic through user-space stack, never touches host interfaces directly" — plausible given Jozu's stated zero-trust design philosophy, but not independently confirmed in available sources.
• Built on KitOps (CNCF) and ModelPack spec, works with Harbor, ECR, GCR, Artifactory, Docker Hub — accurate. KitOps is confirmed as a CNCF project and the reference implementation of the ModelPack specification, and it explicitly supports all the listed registries.