{
  "markdown": "# Kernora Agent Security\n\n[![Add to Cursor](https://img.shields.io/badge/Add%20to-Cursor-000?logo=cursor)](cursor://anysphere.cursor-deeplink/mcp/install?name=agentsec&config=eyJ1cmwiOiAiaHR0cHM6Ly9hZ2VudHNlYy5rZXJub3JhLmFpL21jcCIsICJ0eXBlIjogImh0dHAifQ==) [![MCP](https://img.shields.io/badge/MCP-server-8b5cf6)](https://agentsec.kernora.ai/mcp) [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)\n\n\n\n**A zero-install security baseline for AI coding agents.** Point Claude Code, Cursor, or any\nMCP-capable agent at one URL and it reads a curated, cited security baseline every session (via a minimal JSON-RPC-over-HTTP MCP subset — works with Claude Code today) — so it\nstops shipping the mistakes that cause incidents (a hardcoded secret, a `curl | bash`, a\nprompt-injected \"send this to that URL\"). When it catches one, it cites the exact rule.\n\n**Advisory grounding, free and open.** Real-time *blocking* against your organization's own\ndecisions — plus a tamper-evident audit ledger for EU AI Act / SOC-2 — is the paid **Kernora Axiora**\nIntegrity Plane.\n\nLive: **https://agentsec.kernora.ai**\n\n---\n\n## Connect in one line\n\nAdd it as an MCP server in your agent's config:\n\n```json\n{\n  \"mcpServers\": {\n    \"agentsec\": { \"url\": \"https://agentsec.kernora.ai/mcp\" }\n  }\n}\n```\n\nThat's it — no install, no signup. It's read-only: `get_security_baseline` sends nothing, and `check_action` sends only the short action text you choose to pass it (never your files, repo, or environment).\n\nTools exposed:\n- `get_security_baseline` — the full known-good rule set.\n- `check_action` — pass an action/command; get back the baseline rules that apply, so the agent can\n  self-correct. **Advisory only** — it does not block.\n\nOr read the rules directly: [`/baseline.json`](https://agentsec.kernora.ai/baseline.json) ·\n[`/baseline.yaml`](https://agentsec.kernora.ai/baseline.yaml)\n\n## What's inside\n\n15 rules across categories including secrets, injection, supply-chain, destructive ops, permissions,\ntransport, data protection, exfiltration, authz, and VCS safety. **Every rule cites a real source** —\nOWASP (incl. the LLM Top 10), CWE identifiers, and regulations (EU AI Act, PCI-DSS, HIPAA).\n\n## Self-host\n\nIt's a single Cloudflare Worker with no dependencies, no storage, and no secrets.\n\n```bash\nnpm install -g wrangler   # if needed\nnpm test                  # runs the local test suite (node test.mjs)\nwrangler deploy           # deploy to your own Cloudflare account\n```\n\nAir-gapped or privacy-strict? Run it on your own infrastructure and point your agents at it.\n\n## Free grounds. Paid blocks.\n\n| | Kernora Agent Security (this, free) | Kernora Axiora — Integrity Plane (paid) |\n|---|---|---|\n| **What** | Grounds the agent: it knows the baseline and cites it | Blocks in real time against *your org's* decisions |\n| **How** | Advisory MCP grounding | Tiered verifier, real-time block + attested audit ledger |\n| **For** | Any developer, any agent | Enterprises with agent fleets and compliance obligations |\n\nTalk to us about blocking + attestation: **hello@kernora.ai**\n\n## How it relates to endpoint monitors\n\nEndpoint agent monitors (e.g. Perplexity's Numbat) watch for *generically suspicious* behavior.\nKernora Agent Security supplies what they lack: what's *known-good* for your codebase. The two are\ncomplementary — this project can even export its rules for a monitor to enforce.\n\n## Honesty note\n\nThis endpoint provides **advisory grounding only**. A matched rule is guidance; an *unmatched* action\nis **not** an assurance of safety. Real-time enforcement and audit are the paid Integrity Plane.\n\n## Claude Code plugin (optional, one command)\n\nInstead of the manual MCP config, install the plugin — it bundles the MCP server, a skill that tells\nyour agent to consult the baseline, an advisory PreToolUse hook (warns before risky commands), and\nhelper commands:\n\n```\n/plugin marketplace add kernora-ai/agent-sec\n/plugin install kernora-agent-security\n```\n\nCommands: `/agentsec-rules` (show every rule), `/agentsec-check <action>`, `/agentsec-report` (a LOCAL\nview of how many risky actions it caught — nothing is sent to us). Disable the hook anytime with\n`AGENTSEC_HOOK=0`.\n\n## See every rule / how effective / how to remove\n\n- **See the rules:** readable at https://agentsec.kernora.ai/rules · raw at `/baseline.json` (or\n  `.yaml`) · or the `get_security_baseline` MCP tool. Nothing is hidden.\n- **Effectiveness / reporting:** the free tier is stateless and private — we store nothing. The plugin\n  logs flags LOCALLY (`~/.agentsec/flags.log`); `/agentsec-report` summarizes them. Full per-action\n  reporting with a tamper-evident audit ledger is the paid Kernora Axiora plane.\n- **Remove it:** Claude Code — `claude mcp remove agentsec` (+ `/plugin uninstall\n  kernora-agent-security` if installed). Cursor — delete the `agentsec` entry from\n  `~/.cursor/mcp.json` and restart. It's read-only and stores nothing, so nothing is left behind.\n\n## About\n\nKernora Agent Security is built by [Kernora](https://kernora.ai) on the open\n[Factlet Protocol](https://factlet.ai). Licensed Apache-2.0 (see [LICENSE](./LICENSE)).\n",
  "bytes": 5153,
  "sha": "31d72061bd972e41a298ca25db33669b67f8e81d412982e3ee6739677d463685",
  "repo_slug": "kernora-ai/agent-sec",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_kernora_agent_sec_564d67c9/readme"
}