{
  "markdown": "# Inkog MCP Server\n\n**Security companion for AI agent development in Claude, Cursor, and Claude Code.**\n\nAsk your AI pair-programmer to build an agent. Inkog checks it as you code — scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.\n\nAvailable in Claude Desktop, Cursor, Claude Code, ChatGPT, and any MCP-compatible client.\n\n[![npm version](https://img.shields.io/npm/v/@inkog-io/mcp)](https://www.npmjs.com/package/@inkog-io/mcp)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-brightgreen.svg)](https://modelcontextprotocol.io)\n\n## The Dev-Flow Loop\n\nInkog is designed to live inside the conversation where you build the agent — not as a post-hoc gate:\n\n1. **Ask Claude to build a piece of agent logic.**\n2. **Ask Claude to scan it with Inkog** — `\"Scan this with Inkog and show me any CRITICAL or HIGH findings.\"`\n3. **Ask Claude to explain each finding in plain English** — `\"Explain the top finding. What's the risk, and how do I fix it?\"`\n4. **Ask Claude to apply the fixes.** Review the diff, approve, re-scan.\n5. **Before shipping, verify governance** — `\"Verify my AGENTS.md against the code\"` and `\"Audit the agent-to-agent delegation\"`.\n\nRead the full walkthrough: [Building Secure AI Agents with Claude Code and the Inkog MCP](https://inkog.io/labs/building-secure-agents-with-claude-code).\n\n### Recommended prompts\n\n- *\"Scan the current directory with Inkog and show me any CRITICAL or HIGH findings.\"*\n- *\"Explain the top finding in plain English. What's the risk, and how do I fix it?\"*\n- *\"Verify my AGENTS.md against the code.\"*\n- *\"Audit the agent-to-agent delegation in this crew.\"*\n- *\"Run a compliance report and map the findings to EU AI Act Articles 12, 14, and 15.\"*\n- *\"Audit the MCP servers I'm integrating with.\"*\n\n## When to Use Inkog\n\n- **Building an AI agent** — Scan during development to catch infinite loops, prompt injection, and missing guardrails before they ship\n- **Adding security to CI/CD** — Add `inkog-io/inkog@v1` to GitHub Actions for automated security gates on every PR\n- **Preparing for EU AI Act** — Generate compliance reports mapping your agent to Article 14, NIST AI RMF, OWASP LLM Top 10\n- **Reviewing agent code** — Use from Claude Code, Cursor, or any MCP client to get security analysis while you code\n- **Auditing MCP servers** — Check any MCP server for tool poisoning, privilege escalation, or data exfiltration before installing\n- **Verifying AGENTS.md** — Validate that governance declarations match actual code behavior\n- **Building multi-agent systems** — Detect delegation loops, privilege escalation, and unauthorized handoffs between agents\n\n## What Inkog Does\n\n- **Logic Flaw Detection**: Find infinite loops, recursion risks, and missing exit conditions\n- **Security Analysis**: Detect prompt injection paths, unconstrained tools, and data leakage risks\n- **AGENTS.md Governance**: Validate that code behavior matches governance declarations\n- **Compliance Reporting**: Generate reports for EU AI Act, NIST AI RMF, OWASP LLM Top 10\n- **MCP Server Auditing**: Audit any MCP server before installation\n- **Multi-Agent Analysis**: Audit Agent-to-Agent communications for logic and security issues\n\n## Installation\n\n### Claude Desktop\n\nAdd to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"inkog\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@inkog-io/mcp\"],\n      \"env\": {\n        \"INKOG_API_KEY\": \"sk_live_your_api_key\"\n      }\n    }\n  }\n}\n```\n\n### Cursor\n\nAdd to your Cursor MCP settings:\n\n```json\n{\n  \"mcpServers\": {\n    \"inkog\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@inkog-io/mcp\"],\n      \"env\": {\n        \"INKOG_API_KEY\": \"sk_live_your_api_key\"\n      }\n    }\n  }\n}\n```\n\n### Global Installation\n\n```bash\nnpm install -g @inkog-io/mcp\n```\n\n## Getting Your API Key\n\n1. Sign up for free at [app.inkog.io](https://app.inkog.io)\n2. Copy your API key from the dashboard\n3. Set it as `INKOG_API_KEY` environment variable\n\n## Available Tools\n\n### P0 - Core Analysis (Essential)\n\n| Tool | Description |\n|------|-------------|\n| `inkog_scan` | Static analysis for logic flaws and security risks |\n| `inkog_verify_governance` | Validate AGENTS.md declarations match actual code behavior |\n\n### P1 - Enterprise Features\n\n| Tool | Description |\n|------|-------------|\n| `inkog_compliance_report` | Generate EU AI Act, NIST, OWASP compliance reports |\n| `inkog_explain_finding` | Get detailed remediation guidance for findings |\n| `inkog_audit_mcp_server` | Audit any MCP server before installation |\n| `inkog_generate_mlbom` | Generate ML Bill of Materials (CycloneDX, SPDX) |\n\n### P2 - Multi-Agent Analysis\n\n| Tool | Description |\n|------|-------------|\n| `inkog_audit_a2a` | Audit Agent-to-Agent communications |\n\n## Tool Details\n\n### inkog_scan\n\nStatic analysis for AI agent code - finds logic flaws and security risks.\n\n```\nArguments:\n  path     (required) File or directory path to scan\n  policy   (optional) Analysis policy: low-noise, balanced, comprehensive, governance, eu-ai-act\n  output   (optional) Output format: summary, detailed, sarif\n```\n\n**Example**: \"Scan my LangChain agent for logic flaws\"\n\n### inkog_verify_governance\n\nValidate that AGENTS.md declarations match actual code behavior. **This is Inkog's unique differentiator** - no other tool does governance verification.\n\n```\nArguments:\n  path     (required) Path to directory containing AGENTS.md and agent code\n```\n\n**Example**: \"Verify my agent's governance declarations\"\n\n### inkog_compliance_report\n\nGenerate compliance reports for regulatory frameworks.\n\n```\nArguments:\n  path      (required) Path to scan\n  framework (optional) eu-ai-act, nist-ai-rmf, iso-42001, owasp-llm-top-10, all\n  format    (optional) markdown, json, pdf\n```\n\n**Example**: \"Generate an EU AI Act compliance report for my agent\"\n\n### inkog_explain_finding\n\nGet detailed explanation and remediation guidance for a security finding.\n\n```\nArguments:\n  finding_id (optional) Finding ID from scan results\n  pattern    (optional) Pattern name (e.g., prompt-injection, infinite-loop)\n```\n\n**Example**: \"Explain how to fix prompt injection vulnerabilities\"\n\n### inkog_audit_mcp_server\n\nSecurity audit any MCP server from the registry or GitHub.\n\n```\nArguments:\n  server_name    (optional) MCP server name from registry (e.g., \"github\", \"slack\")\n  repository_url (optional) Direct GitHub repository URL\n```\n\n**Example**: \"Audit the GitHub MCP server for security issues\"\n\n### inkog_generate_mlbom\n\nGenerate a Machine Learning Bill of Materials listing all AI components.\n\n```\nArguments:\n  path                     (required) Path to agent codebase\n  format                   (optional) cyclonedx, spdx, json\n  include_vulnerabilities  (optional) Include known CVEs (default: true)\n```\n\n**Example**: \"Generate an MLBOM for my AI project\"\n\n### inkog_audit_a2a\n\nAudit Agent-to-Agent communications for security risks.\n\n```\nArguments:\n  path                    (required) Path to multi-agent codebase\n  protocol                (optional) a2a, crewai, langgraph, auto-detect\n  check_delegation_chains (optional) Check for infinite loops (default: true)\n```\n\n**Example**: \"Audit my CrewAI multi-agent system for security risks\"\n\n## Supported Frameworks\n\nInkog works with all major AI agent frameworks:\n\n- LangChain / LangGraph\n- CrewAI\n- AutoGen\n- n8n\n- Flowise\n- Dify\n- Microsoft Copilot Studio\n- Custom implementations\n\n## Configuration\n\nAll configuration is done via environment variables:\n\n| Variable | Description | Default |\n|----------|-------------|---------|\n| `INKOG_API_KEY` | Your API key (required) | - |\n| `INKOG_API_URL` | API base URL | `https://api.inkog.io` |\n| `INKOG_API_VERSION` | API version | `v1` |\n| `INKOG_API_TIMEOUT` | Request timeout (ms) | `30000` |\n| `INKOG_LOG_LEVEL` | Log level | `info` |\n| `INKOG_LOG_FORMAT` | Log format (json/text) | `json` |\n\n## Development\n\n```bash\n# Install dependencies\nnpm install\n\n# Build\nnpm run build\n\n# Run in development mode\nnpm run dev\n\n# Run tests\nnpm test\n\n# Lint\nnpm run lint\n```\n\n## Why Inkog?\n\n### Security in the Dev-Flow, Not After It\n\nMost AI agent security tools run after the code is written. Inkog lives inside the conversation where you build the agent — so findings get fixed before they land in a PR, not three weeks later.\n\n### The Only Tool with AGENTS.md Verification\n\nInkog is the **only tool** that can validate your agent's governance declarations against its actual code behavior. This is essential for:\n\n- **EU AI Act Article 14** compliance (human oversight)\n- **Enterprise governance** requirements\n- **Preventing governance drift** as code evolves\n\n### Purpose-Built for AI Agents\n\nUnlike traditional code scanners (Snyk, Semgrep, SonarQube), Inkog understands AI-specific issues:\n\n- Infinite loops and recursion risks\n- Prompt injection paths\n- Unconstrained tool access\n- Missing exit conditions\n- Cross-tenant data leakage\n\n### Multi-Framework Support\n\nInkog's Universal IR (Intermediate Representation) works with any agent framework. Add one integration, get analysis for all frameworks.\n\n## License\n\nApache-2.0 - see [LICENSE](LICENSE)\n\n## Links\n\n- [Documentation](https://docs.inkog.io)\n- [Dashboard](https://app.inkog.io)\n- [Website](https://inkog.io)\n- [GitHub](https://github.com/inkog-io/inkog-mcp)\n\n---\n\nBuilt with security by [Inkog.io](https://inkog.io)\n",
  "bytes": 9525,
  "sha": "d4824f59f57d4fc4dd4cfa537d8d651dc32f5fab638c0cd32ed6cf891e5e8e7c",
  "repo_slug": "inkog-io/inkog-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_inkog_io_inkog_d17f12c6/readme"
}