vnx 0.0.1

Security for the AI agent supply chain — scan agent skills and MCP servers for tool poisoning, exfiltration, and rug pulls.

vnx

Security for the AI agent supply chain.

vnx scans AI agent skills (SKILL.md + scripts) and MCP servers for what static scanners miss: tool poisoning, credential exfiltration chains, rug pulls, hidden-unicode smuggling, typosquats, and prompt-injection payloads — with an evidence-based confidence engine built to keep false positives near zero.

                 ╔═══════════════════════════════════╗
                 ║   scan  ·  gate  ·  proxy         ║
                 ║   one engine, three checkpoints   ║
                 ╚═══════════════════════════════════╝

This is the 0.0.1 name-reservation build. The full scanner (v0.2.0) is in final release preparation — 839 tests, CI-enforced benchmark of 100% recall on 12 rebuilt real-world incident PoCs (postmark-mcp, ClawHavoc, SANDWORM_MODE, Invariant tool-poisoning) and 0% false positives on benign skills. Star the repo to catch the drop.

What ships in v0.2.0

• vnx scan — enumerate-everything static analysis: hidden files, .docx/zip unpacking, .pyc vs source divergence, anti-truncation. 9 analyzers + an Opengrep taint engine tracing source→sink chains (env→network, file→egress, arg→exec). Correlation grouping collapses noise into named threats.
• vnx gate — blocking security hooks for Claude Code, Cursor, Codex CLI, and VS Code: malicious skills and MCP calls get denied before execution.
• vnx proxy — a runtime MCP firewall: tool-manifest pinning (rug-pull detection), argument DLP, response injection scanning, hash-chained audit log.
• Offline-first. Zero accounts, zero telemetry, zero required API keys. Optional local-LLM (Ollama) and reputation layers are opt-in, never required.
• SARIF, GitHub Action, pre-commit, Docker, MCP-server mode — drops into whatever pipeline you already run.

Try the placeholder

uvx vnx          # or: pipx run vnx

Links

• Repo: github.com/vnxrun/vnx
• Site: vnx.run

Apache-2.0 · built in public · no telemetry, ever