agentic-guard-mcp 0.0.1

Static security analysis for MCP servers and AI-agent workspace configurations. Taint-graph based detection of tool-description injection, capability overreach, and exfiltration paths.

agentic-guard-mcp

Static security analysis for MCP servers and AI-agent workspace configurations.

Part of the agentic-guard family — extending its taint-graph model (the LLM as an adversarially-controlled edge) from agent pipelines to the Model Context Protocol ecosystem.

Status: v0.1 in active development. This package currently reserves the name and ships a CLI stub. Follow this repo for the first release.

What it will do

agentic-guard-mcp audits the agent-facing surface of an MCP server or developer workspace and reports reachable attack paths — not just suspicious patterns:

• Tool-description injection linting — detects imperative instructions to the model, hidden Unicode/encoding tricks, cross-tool manipulation, and out-of-scope references embedded in MCP tool descriptions and parameter docs.
• Capability analysis — flags mismatches between a tool's declared purpose and what its schema and code can actually reach (filesystem, network, shell).
• Exfiltration-path detection — models sensitive sources (files, env vars, credentials) and sinks (network calls, outbound tool parameters) and reports reachable source→sink paths through the agent.
• Workspace composition analysis — evaluates .cursor/mcp.json, rules files (.cursorrules, copilot-instructions.md, AGENTS.md), and auto-run settings together, because a finding's severity depends on what the configured agent can actually do.
• Definition drift / rug-pull checks — hashes tool definitions and flags changes between versions.
• SARIF output — integrates with GitHub code scanning and CI.

Why

Existing scanners treat rules files and manifests in isolation with signature matching. Real incidents are compositional: benign-looking content becomes an exploit only in the context of a specific agent's permissions and tool access. That is a reachability problem, and reachability is what taint analysis is for.

Install (stub)

pip install agentic-guard-mcp
agentic-guard-mcp --version

Roadmap

• v0.1 — description-injection linter + capability-mismatch checks
• v0.2 — workspace composition analysis, SARIF output, GitHub Action
• v0.3 — ecosystem scan results, benchmark corpus release

License

Apache-2.0

Author

Sanjay Krishnegowda