Trustabl Probe

io.github.trustablPublished by GitHub account trustablv0.5.0Updated Nov 3, 2026

Drafts a network allow list for agent tools and runs them in a network-blocked sandbox.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs Trustabl Probe on agent tool code: static analysis, a draft network allow list, and an optional network-blocked sandbox run with fix hints.

What you can do
  • Check setup readiness for the Probe binary, Docker, sandbox images and OpenShell, with fix commands
  • Download the checksum-verified Probe binary and pull sandbox images
  • Scan a tool directory for a readiness score, draft network allow list and worst-first findings with fix hints
  • Run the tool in an isolated, network-blocked sandbox to catch runtime crashes, missing dependencies and blocked connections
When to use it
Useful when you are building or reviewing an agent tool and want to know what network access it really needs and which problems only appear at runtime. It suits developers who want a static and sandboxed check with concrete fix hints before shipping.
Requirements
Node.js 18 or later; runs as a local stdio process. Docker is optional and enables the sandbox (OpenShell is an alternative runner). Network access to GitHub for the Probe release, Docker Hub for images, and PyPI when a Python tool declares dependencies. Optional variables PROBE_VERSION, PROBE_BIN and GITHUB_TOKEN.
Before you install
probe_install downloads a binary into the user home directory and pulls Docker images; probe_scan writes four report files into the scanned directory. Tools that look destructive (payments, deletes, network writes) are only run in the sandbox with allow_write_tools set to true. It never installs Docker, OpenShell or Python itself and returns commands for you to approve. Code is analyzed locally and not uploaded.

Installation

In SourceWeft

  1. Open Trustabl Probe in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Trustabl Probe MCP server

Gives your coding agent Trustabl Probe: it drafts a network allow list for an agent tool and runs the tool in a network-blocked sandbox to catch problems that only show up at runtime. Every finding comes with a fix hint, and your agent applies the fixes, so no model or API key is needed.

Tools

ToolWhat it doesChanges anything?
probe_check_setupReports whether the Probe binary, Docker and the sandbox images are ready, which languages can run in the sandbox, and the exact command to fix each missing piece.No
probe_installDownloads the Probe binary (checksum-verified) and pulls the sandbox images. For Docker, OpenShell or Python it only returns the command to run, with its caveats.Yes, see below
probe_scanScans a tool directory and returns a readiness score, the draft network allow list, and findings worst-first with fix hints.Writes four report files into the scanned directory

Static and sandbox

  • Static reads the code and flags problems such as missing timeouts, hardcoded credentials or unfiltered tool output. It also drafts the network allow list (an OpenShell network policy) from the code. It always runs and needs nothing extra.
  • Sandbox also runs the tool with its network blocked, catching crashes, missing dependencies and blocked connection attempts. It needs Docker (or NVIDIA OpenShell). With sandbox: "auto", the default, it runs whenever a runner is ready. Tools that look destructive (payments, deletes, network writes) are not run unless you pass allow_write_tools: true.

Docker covers Python, JavaScript/TypeScript, Go and Ruby; the OpenShell image runs Python and Node. Shell scripts are always analyzed statically only.

Install

Requires Node.js 18 or later. Docker is optional and enables the sandbox.

The server is the npm package @trustabl/agent-network-access-probe, and every Probe release also attaches it as trustabl-agent-network-access-probe-<version>.tgz and .mcpb.

Cursor (.cursor/mcp.json):

json
{  "mcpServers": {    "agent-network-access-probe": {      "command": "npx",      "args": ["-y", "@trustabl/agent-network-access-probe"]    }  }}

Claude Code:

bash
claude mcp add agent-network-access-probe -- npx -y @trustabl/agent-network-access-probe

Claude Desktop: download trustabl-agent-network-access-probe-<version>.mcpb from the release and open it to install. Or use the same command and args as the Cursor example under mcpServers in claude_desktop_config.json.

To pin one release instead of following the latest, replace the package name in args with that release's .tgz URL.

Then ask your agent to run probe_check_setup.

What it changes on your machine

  • Downloads the Probe binary from the same release as the server into ~/.trustabl-probe/<version>/, after checking it against the release checksums.txt. A mismatch is a hard failure.
  • Pulls the sandbox images (python:3-slim, node:20-slim, golang:1.25-alpine, ruby:3-slim) when you run probe_install, or on the first sandbox run.
  • Writes network_policies.draft.yaml, probe.findings.json, probe.profile.json and autofix-attestation.json into the scanned directory.
  • Never installs Docker, OpenShell or Python itself. It returns the command, and your agent should ask you before running it. Docker Desktop needs admin rights, may need a restart on Windows, and needs a paid subscription for larger companies.

Privacy Policy

Trustabl's privacy policy: https://trustabl.ai/privacy/

What this server does with your data:

  • Collection: none. It sends no telemetry and makes no model call.
  • Your code: it is read and analyzed on your machine and never uploaded. Attestation signing is turned off, so nothing goes to a transparency log.
  • Network access: only GitHub (to download the Probe release), Docker Hub (for the sandbox images) and, when a Python tool declares dependencies, PyPI to install them before the sandbox run. The tool under test runs with its network blocked.
  • Storage: the Probe binary is cached in ~/.trustabl-probe/, sandbox results are cached in your user cache folder under trustabl-probe/results, and the four report files are written into the scanned directory. Delete any of them at any time.
  • Third parties: nothing is shared with Trustabl or anyone else.
  • Contact: https://github.com/trustabl/agent-network-access-probe/issues

Settings

VariableDefaultPurpose
PROBE_VERSIONthe release the server came withProbe release to use instead, e.g. v0.2.3 or latest. Needs v0.2.3 or later.
PROBE_BINPath to a local Probe build; skips the download
GITHUB_TOKENOnly to avoid GitHub's anonymous rate limit when PROBE_VERSION is latest

Development

From mcp/:

bash
cd server && npm ci && npm run build   # bundles to dist/index.js, which is committednode test/smoke.mjs                    # handshake, tools/list, setup checkSMOKE_SCAN=1 node test/smoke.mjs       # also a static scan of test/fixture with the released ProbePROBE_BIN=/path/to/autofix node test/smoke.mjs   # the same scan with a local Probe build

A checkout has version 0.0.0 and uses the latest Probe release. The release workflow sets the real version when it packs the server.

License

Apache-2.0, like Probe.

Source: mcp/README.md at commit 9fe2dd1

Tools

3

probe_check_setup

Check what Probe needs on this machine

Read-only. Reports whether the Probe binary, Docker (running), the sandbox images, and the optional OpenShell runner are ready, which languages can run in the sandbox, and the exact command to fix each missing piece. Changes nothing. Run it before probe_install or when a scan says the sandbox is unavailable.

Takes no parameters.

probe_install

Install Probe's own pieces

Downloads the Probe binary from its GitHub release (checksum-verified) and, when Docker is running, pulls the sandbox base images. It never installs system software: for Docker, OpenShell or Python it returns the exact command and its caveats (admin rights, restarts, licensing) for you to show the user and run only with their permission. Pulling all images can take a few minutes; pass `languages` to pull only what the tool needs.

Parameterslanguagespull_images

probe_scan

Scan an agent tool with Probe

Runs Trustabl Probe on a directory of agent tool code (Python, Go, JavaScript/TypeScript, Ruby, Shell). Static analysis always runs; with sandbox 'auto' (default) the tool is also run in an isolated, network-blocked sandbox when Docker or OpenShell is ready, which catches problems that only show up at runtime. Returns a readiness score, the draft network allow list (an OpenShell network policy), and findings worst-first, each with a fix hint for you to apply. Writes network_policies.draft.yaml, probe.findings.json, probe.profile.json and autofix-attestation.json into the scanned directory.

Parameterspathsandboxentrypointsallow_write_tools

Version history

2
  1. v0.5.0LatestOct 29, 2026
  2. v0.3.0Oct 26, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts