agent-guard-mcp

Verify-before-act safety tools for AI coding agents: check packages, lockfiles, skill/plugin manifests, and CI workflows before installing or merging.

该来源不提供完整文件导出（国内平台多为平台内托管），仅存元数据与原链

接入信息

传输形态: http
鉴权方式: 鉴权未知
端点: https://agent-guard-mcp--theliminalguy.run.tools

鉴权方式未标注，请核对官方文档后再接入——不要直接使用以下片段

{
  "mcpServers": {
    "agent-guard-mcp": {
      "url": "https://agent-guard-mcp--theliminalguy.run.tools"
    }
  }
}

能力清单

工具	说明
check_package	Check whether a single package exists and assess slopsquat/typosquat risk BEFORE installing it. Returns OK/SUSPICIOUS/DANGER + risk + flags. Nonexistent names are likely hallucinated; names 1-2 chars from a popular package are likely typosquats.
verify_lockfile	Scan an entire lockfile (direct + transitive deps) for hallucinated / typosquatted / suspicious packages BEFORE running install. Call this instead of trusting an LLM-generated lockfile.
score_manifest	Score a Cursor/Claude skill or MCP/Smithery plugin manifest for poison/backdoor signatures, credential scope over-reach, and drift BEFORE installing a third-party agent extension. Returns risk 0-100 + install recommendation (PROCEED/REVIEW/BLOCK).
check_workflow	Validate a CI workflow (GitHub Actions / GitLab CI YAML) BEFORE merging a PR that touches it. Flags mutable action pins, known-compromised actions, untrusted owners, curl\|bash fetch-exec, pull_request_target pwn-requests, and secret exposure. Returns risk 0-100 + merge recommendation (PROCEED/REVIEW/BLOCK).

纠错与举报（发现条目失效、署名有误或涉及侵权？）

提交举报 / 纠错

侵权举报经核验成立后，我们会即时下线该条目并删除已存的内容副本。