Agent Guard Mcp

io.github.liminalpepePublished by GitHub account liminalpepev0.2.1Updated Oct 24, 2026

Verify-before-act safety checks for AI agents: packages, lockfiles, manifests, CI workflows.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that gives an AI assistant pre-install safety checks on npm/PyPI packages, lockfiles, skill manifests and CI workflows.

What you can do
Check a single npm or PyPI package before adding it, returning OK, SUSPICIOUS or DANGER with typosquat and slop flags. Scan a lockfile (npm, yarn, pnpm, poetry, requirements) across direct and transitive dependencies before running install. Score a Cursor/Claude skill or MCP plugin manifest 0–100 for poison signatures, scope overreach and drift. Review a GitHub Actions workflow for mutable action pins, compromised actions, curl|bash, pwn-requests and secret exposure.
When to use it
Use it when an agent is about to install a dependency, run an install from an LLM-generated lockfile, add a third-party skill or plugin, or merge a PR touching CI workflows, so it can stop on a suspicious verdict and show findings first.
Requirements
Runs as a local stdio process on the user's machine, launched via npx from the npm package; Node.js is needed. No API keys, configuration, environment variables or headers are declared. An optional HTTP mirror runs locally on port 8402.
Before you install
It only advises; the agent still performs the install or merge, so a rule telling it to stop on SUSPICIOUS, REVIEW or DANGER verdicts must be added separately. Verdicts are heuristic and may miss real risks or flag benign packages. Lockfile, manifest and workflow contents are sent to the tool for analysis.

Installation

In SourceWeft

  1. Open Agent Guard Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

agent-guard-mcp

[npm] [License: MIT]

One line: Verify-before-act safety for AI agents — check packages, lockfiles, skill manifests, and CI workflows before install or merge. Zero API keys. Zero config.

Scores Cursor/Claude skill manifests + GitHub Actions workflows — not just npm dependencies.

When you…Call
npm install foo / agent suggests a new depcheck_package
Review an LLM-generated lockfileverify_lockfile
Install a Cursor skill or MCP pluginscore_manifest
Merge a PR touching .github/workflows/*check_workflow

Call these before installing a dependency, merging a CI change, or installing a third-party skill/plugin — so an agent refuses hallucinated packages, typosquats, poisoned manifests, and compromised CI actions.

Exposes four MCP tools (also available as a plain HTTP service):

ToolUse before…Returns
check_packageadding a single npm/PyPI dependencyOK / SUSPICIOUS / DANGER + typosquat/slop flags
verify_lockfilerunning npm/pip/yarn installscans every direct + transitive dep in a lockfile
score_manifestinstalling a Cursor/Claude skill or MCP/Smithery pluginpoison-signature + scope-overreach + drift score 0–100
check_workflowmerging a PR that touches CIflags mutable action pins, compromised actions, curl|bash, pwn-requests, secret exposure

Why

AI agents routinely hallucinate package names (slopsquatting), trust LLM-generated lockfiles, install unvetted skill packs, and pin CI actions to mutable tags. Each is a live supply-chain vector. This server gives an agent a cheap "is this safe?" call before it acts.

Install (MCP client)

json
{  "mcpServers": {    "agent-guard": { "command": "npx", "args": ["-y", "@liminallablibs/[email protected]"] }  }}

Agent rule (paste into Cursor Rules / CLAUDE.md)

Before installing any npm/PyPI package, running install from a lockfile, installing a third-party skill/MCP plugin, or merging CI workflow changes, call the agent-guard MCP tools (check_package, verify_lockfile, score_manifest, check_workflow). If verdict is SUSPICIOUS, REVIEW, or BLOCK/DANGER, stop and show findings to the user — do not proceed.

Quick demo

bash
npx -y @liminallablibs/[email protected]   # MCP clients spawn this via npx# HTTP mirror:npm run http && curl "http://localhost:8402/check?name=reactt&ecosystem=npm"# → DANGER — typosquat of "react"

Or run directly:

bash
npm installnode src/mcp-server.mjs        # stdio MCP servernpm run http                   # optional HTTP mirror on :8402

HTTP endpoints (mirror of the MCP tools)

  • GET /check?name=<pkg>&ecosystem=<npm|pypi>
  • POST /check-lockfile {lockfile_content, format} — format ∈ package-lock.json | yarn.lock | pnpm-lock.yaml | poetry.lock | requirements.txt
  • POST /score-manifest {manifest_type, manifest_content}
  • POST /check-workflow {workflow_content}

License

MIT.

Source: README.md at commit 67300e0

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts