Agent Sec

ai.kernoraPublished by kernora.aiOfficial publisherv0.1.0Updated Oct 24, 2026

Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote, zero-install MCP server that gives AI coding agents a cited security baseline and advisory checks on actions they are about to take.

What you can do
Retrieve the full curated security baseline of known-good rules covering secrets, injection, supply-chain, destructive operations, permissions, transport, data protection, exfiltration, authorization and version-control safety, each citing OWASP, CWE or regulatory sources. Submit a described action or command and get back the baseline rules that plausibly apply, so the agent can self-correct before proceeding.
When to use it
Useful when you want a coding agent to consult a known-good security checklist during sessions, for example to catch hardcoded secrets, pipe-to-shell installs or prompt-injected exfiltration attempts. It is advisory grounding, not enforcement, so it suits developers who want guidance rather than a blocking control.
Requirements
A remote MCP endpoint; no install, signup, API key or environment variable is needed. The README notes it works with Claude Code today and can also be self-hosted as a Cloudflare Worker.
Before you install
Advisory only: it does not block actions, and an unmatched action is not an assurance of safety. check_action sends the short action text you pass to the remote service, so avoid including secrets or sensitive code. Real-time blocking and audit ledgers are a separate paid product.

Installation

In SourceWeft

  1. Open Agent Sec in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ai.kernora%2Fagent-sec/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agent-sec": {
      "type": "http",
      "url": "https://agentsec.kernora.ai/mcp"
    }
  }
}

README

Kernora Agent Security

[Add to Cursor] [MCP] [License]

A zero-install security baseline for AI coding agents. Point Claude Code, Cursor, or any MCP-capable agent at one URL and it reads a curated, cited security baseline every session (via a minimal JSON-RPC-over-HTTP MCP subset — works with Claude Code today) — so it stops shipping the mistakes that cause incidents (a hardcoded secret, a curl | bash, a prompt-injected "send this to that URL"). When it catches one, it cites the exact rule.

Advisory grounding, free and open. Real-time blocking against your organization's own decisions — plus a tamper-evident audit ledger for EU AI Act / SOC-2 — is the paid Kernora Axiora Integrity Plane.

Live: https://agentsec.kernora.ai

Connect in one line

Add it as an MCP server in your agent's config:

json
{  "mcpServers": {    "agentsec": { "url": "https://agentsec.kernora.ai/mcp" }  }}

That's it — no install, no signup. It's read-only: get_security_baseline sends nothing, and check_action sends only the short action text you choose to pass it (never your files, repo, or environment).

Tools exposed:

  • get_security_baseline — the full known-good rule set.
  • check_action — pass an action/command; get back the baseline rules that apply, so the agent can self-correct. Advisory only — it does not block.

Or read the rules directly: /baseline.json · /baseline.yaml

What's inside

15 rules across categories including secrets, injection, supply-chain, destructive ops, permissions, transport, data protection, exfiltration, authz, and VCS safety. Every rule cites a real source — OWASP (incl. the LLM Top 10), CWE identifiers, and regulations (EU AI Act, PCI-DSS, HIPAA).

Self-host

It's a single Cloudflare Worker with no dependencies, no storage, and no secrets.

bash
npm install -g wrangler   # if needednpm test                  # runs the local test suite (node test.mjs)wrangler deploy           # deploy to your own Cloudflare account

Air-gapped or privacy-strict? Run it on your own infrastructure and point your agents at it.

Free grounds. Paid blocks.

Kernora Agent Security (this, free)Kernora Axiora — Integrity Plane (paid)
WhatGrounds the agent: it knows the baseline and cites itBlocks in real time against your org's decisions
HowAdvisory MCP groundingTiered verifier, real-time block + attested audit ledger
ForAny developer, any agentEnterprises with agent fleets and compliance obligations

Talk to us about blocking + attestation: [email protected]

How it relates to endpoint monitors

Endpoint agent monitors (e.g. Perplexity's Numbat) watch for generically suspicious behavior. Kernora Agent Security supplies what they lack: what's known-good for your codebase. The two are complementary — this project can even export its rules for a monitor to enforce.

Honesty note

This endpoint provides advisory grounding only. A matched rule is guidance; an unmatched action is not an assurance of safety. Real-time enforcement and audit are the paid Integrity Plane.

Claude Code plugin (optional, one command)

Instead of the manual MCP config, install the plugin — it bundles the MCP server, a skill that tells your agent to consult the baseline, an advisory PreToolUse hook (warns before risky commands), and helper commands:

/plugin marketplace add kernora-ai/agent-sec/plugin install kernora-agent-security

Commands: /agentsec-rules (show every rule), /agentsec-check <action>, /agentsec-report (a LOCAL view of how many risky actions it caught — nothing is sent to us). Disable the hook anytime with AGENTSEC_HOOK=0.

See every rule / how effective / how to remove

  • See the rules: readable at https://agentsec.kernora.ai/rules · raw at /baseline.json (or .yaml) · or the get_security_baseline MCP tool. Nothing is hidden.
  • Effectiveness / reporting: the free tier is stateless and private — we store nothing. The plugin logs flags LOCALLY (~/.agentsec/flags.log); /agentsec-report summarizes them. Full per-action reporting with a tamper-evident audit ledger is the paid Kernora Axiora plane.
  • Remove it: Claude Code — claude mcp remove agentsec (+ /plugin uninstall kernora-agent-security if installed). Cursor — delete the agentsec entry from ~/.cursor/mcp.json and restart. It's read-only and stores nothing, so nothing is left behind.

About

Kernora Agent Security is built by Kernora on the open Factlet Protocol. Licensed Apache-2.0 (see LICENSE).

Source: README.md at commit 32b1d09

Tools

2

get_security_baseline

Return Kernora Agent Security's curated security baseline — the known-good rules an AI coding agent should follow (secrets, injection, supply-chain, destructive ops, data protection). Advisory grounding.

Takes no parameters.

check_action

Advisory check: given a described action or command the agent is about to take, return the baseline security factlets that plausibly apply, so the agent can self-correct. Advisory only — does NOT block. Real-time blocking is Kernora Agent Security's paid Integrity Plane.

Parametersactionrequired

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts