agentic-guard-mcp
Static security analysis for MCP servers and AI-agent workspace configurations.
Part of the agentic-guard family — extending its taint-graph model (the LLM as an adversarially-controlled edge) from agent pipelines to the Model Context Protocol ecosystem.
Status: v0.1 in active development. This package currently reserves the name and ships a CLI stub. Follow this repo for the first release.
What it will do
agentic-guard-mcp audits the agent-facing surface of an MCP server or developer workspace and reports reachable attack paths — not just suspicious patterns:
- Tool-description injection linting — detects imperative instructions to the model, hidden Unicode/encoding tricks, cross-tool manipulation, and out-of-scope references embedded in MCP tool descriptions and parameter docs.
- Capability analysis — flags mismatches between a tool's declared purpose and what its schema and code can actually reach (filesystem, network, shell).
- Exfiltration-path detection — models sensitive sources (files, env vars, credentials) and sinks (network calls, outbound tool parameters) and reports reachable source→sink paths through the agent.
- Workspace composition analysis — evaluates
.cursor/mcp.json, rules files (.cursorrules,copilot-instructions.md,AGENTS.md), and auto-run settings together, because a finding's severity depends on what the configured agent can actually do. - Definition drift / rug-pull checks — hashes tool definitions and flags changes between versions.
- SARIF output — integrates with GitHub code scanning and CI.
Why
Existing scanners treat rules files and manifests in isolation with signature matching. Real incidents are compositional: benign-looking content becomes an exploit only in the context of a specific agent's permissions and tool access. That is a reachability problem, and reachability is what taint analysis is for.
Install (stub)
pip install agentic-guard-mcp
agentic-guard-mcp --version
Roadmap
- v0.1 — description-injection linter + capability-mismatch checks
- v0.2 — workspace composition analysis, SARIF output, GitHub Action
- v0.3 — ecosystem scan results, benchmark corpus release
License
Apache-2.0
Author
Sanjay Krishnegowda
1 maintainer
Metadata
1 maintainer
Release files for agentic-guard-mcp 0.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| agentic_guard_mcp-0.0.1.tar.gz | 8.0 kB | Without provenance | Details for agentic_guard_mcp-0.0.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| agentic_guard_mcp-0.0.1-py3-none-any.whl | Python 3 | none | any | Details for agentic_guard_mcp-0.0.1-py3-none-any.whl |
Total release size: 15.8 kB
Release files / agentic_guard_mcp-0.0.1.tar.gz
| Download URL | agentic_guard_mcp-0.0.1.tar.gz |
|---|---|
| Size | 8.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3dfd0953495f33b03f40fd47b46f16c1831d934d98b25037c27a5f2050b9366e
|
|
BLAKE2b-256 checksum How to use checksums |
800d3736570d0b7aadd56ae9c47b7217fe639c86e3bc84645dc5b3cb2ef4bcb6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.12
|
Release files / agentic_guard_mcp-0.0.1-py3-none-any.whl
| Download URL | agentic_guard_mcp-0.0.1-py3-none-any.whl |
|---|---|
| Size | 7.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
93004b257f4bde16705a7ca77de91e7988d28274fe996dcae0f03f8dd443e905
|
|
BLAKE2b-256 checksum How to use checksums |
c9d19fd4dc10e899992d6ead63cea59f48af4b974a793086e3cacc594a1a8b79
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.12
|
Security for agentic-guard-mcp 0.0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
