v0.8.0

Aguara MCP v0.8.0 aligns the server with Aguara core v0.27.0: agents now get the full 250-detection catalog, and scan_content gains the npm install-trust surface. This release is also the first one publishable to the Official MCP Registry.

npm install-trust posture via scan_content

Aguara v0.25 added an npm-policy analyzer that reads .npmrc and the package.json allowScripts policy for npm v12 install-trust weakenings. The analyzer keys on the exact .npmrc basename, leading dot included; the MCP filename sanitizer now preserves it (the same fix class .cursorrules got in v0.7.0), so the surface actually works end to end:

scan_content(content: "dangerously-allow-all-scripts=true", filename: ".npmrc")
-> NPM_DANGEROUS_ALL_SCRIPTS_001 (HIGH): bypasses the allowScripts policy entirely

The four NPM_* rules cover the dangerously-allow-all-scripts escape hatch, unpinned approvals, and allow-git / allow-remote relaxations.

Catalog

250 detections (193 YAML pattern rules + 57 analyzer-emitted) across twelve analyzers. list_rules and explain_rule resolve the new NPM_* rules and the npm v12 readiness INFO rules. No public API changes in core between v0.24.0 and v0.27.0; scan behavior is otherwise unchanged.

Official MCP Registry readiness

The Docker image now carries the io.modelcontextprotocol.server.name ownership label and server.json declares the ghcr.io/garagon/mcp-aguara:0.8.0 OCI package, so this version can be installed through registry-aware MCP clients once listed.

Install / upgrade

curl -fsSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | sh

Or Docker:

docker pull ghcr.io/garagon/mcp-aguara:0.8.0

Add to Claude Code:

claude mcp add aguara -- aguara-mcp

Compatibility

Drop-in upgrade from v0.7.0: same five tools, same parameters, same response shapes. The only behavior change is additive (.npmrc filenames now reach the npm-policy analyzer instead of being silently renamed).

Verify

Release archives are Cosign-signed with SPDX SBOMs; the multi-arch image (linux/amd64 + linux/arm64, digest sha256:8a646ba5891bf485322ddc5a1847b7ea1333df3b97bd7a9236c37047ad8d0838) is signed at digest with SLSA provenance and SBOM attestations:

VERSION=v0.8.0 .github/scripts/verify-release.sh

Full CHANGELOG

See CHANGELOG.md.

v0.7.0

Aligns mcp-aguara with Aguara v0.24.0 and unlocks the agent-trust surfaces through scan_content. An agent using this MCP can now vet the riskiest files a cloned repo ships for AI tools before trusting any of them: Claude Code project settings (.claude/settings.json, eight AGENTCFG_* rules for fetch-and-execute hooks, code-injection env vars, bypassPermissions, and more), agent instruction files (.cursorrules, .windsurfrules, .clinerules, AGENTS.md, copilot-instructions.md) as high-trust prompt surfaces, and pnpm supply-chain posture (pnpm-workspace.yaml, nine PNPM_* rules).

Two of these needed more than the core bump: the filename sanitizer used to strip paths to a bare basename, which silently kept the agent-policy analyzer and the instruction-dotfile routing out of reach. Both now have scoped exceptions, pinned end to end by a new regression suite.

Use it

Add the MCP server to your client (Claude Code, Cursor, anything that speaks MCP):

claude mcp add aguara -- aguara-mcp

Then ask the agent things like:

• "This repo ships a .claude/settings.json - is it safe to trust this workspace?"
• "Scan this .cursorrules file for prompt injection before I open the project."
• "Does this pnpm-workspace.yaml weaken pnpm's supply-chain defaults?"
• "Is this MCP config exposing credentials?"

For repository-wide dependency checks (npm, PyPI, pnpm, Go, crates.io, Composer, RubyGems, Maven, NuGet), use the Aguara CLI directly - the check_project / audit_project MCP tools remain deferred until Aguara core exposes a stable public Check API.

Install / upgrade

# Quick install (Linux / macOS)
curl -sSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | sh

# Pinned install
curl -sSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | VERSION=v0.7.0 sh

# Docker
docker pull ghcr.io/garagon/mcp-aguara:0.7.0

Provenance

• Release archives signed with Cosign (keyless OIDC), SPDX SBOM per archive via syft, -trimpath for reproducible builds.
• Multi-arch Docker image (linux/amd64, linux/arm64) at ghcr.io/garagon/mcp-aguara:0.7.0@sha256:7033d6199bcda57dea340ba0bfd52b0bf05360f10045030062895b452deb3334 signed at digest with SLSA Provenance (mode=max) and SBOM attestations. Base images pinned by multi-arch index digest. Runs as non-root UID 10001.
• Verify locally:

VERSION=v0.7.0 .github/scripts/verify-release.sh

Runs cosign verify-blob on checksums.txt, sha256 match, binary --version check, cosign verify on the image, and SBOM + SLSA Provenance presence for the host platform.

Compatibility

• Aguara core: pinned to v0.24.0. Catalog: 244 detections (193 YAML pattern rules + 51 analyzer-emitted) across eleven analyzers, including the new agent-trust category.
• MCP tool surface unchanged: scan_content, check_mcp_config, list_rules, explain_rule, discover_mcp. No input-schema changes; existing integrations keep working unchanged. Binary name unchanged (aguara-mcp).
• server.json reports 0.7.0.

CHANGELOG

Aligns mcp-aguara with the Aguara v0.24.0 backend and unlocks the new
detection surfaces through scan_content. The agent layer Aguara added
between v0.19 and v0.24 is exactly the territory this MCP serves -- an
agent deciding whether to trust a cloned repo's configuration -- so this
release also fixes two filename-sanitization gaps that would have
silently kept those analyzers out of reach.

Added

• Claude Code settings posture via scan_content. Passing
  filename: ".claude/settings.json" (or settings.local.json) now
  reaches the agent-policy analyzer and its eight AGENTCFG_* rules
  (category agent-trust): fetch-and-execute hooks, code-injection env
  vars, bypassPermissions, MCP auto-approval, broad or secret-read
  allow rules, repo-shipped credential helpers, weak default modes.
  sanitizeFilename previously stripped the path to a bare
  settings.json, which the analyzer ignores; the .claude/ suffix is
  now preserved for exactly these two filenames, the same scoped
  exception the .github/workflows/ prefix already has.
• Agent instruction files as high-trust prompt surfaces.
  .cursorrules, .windsurfrules, and .clinerules now keep their
  leading dot through sanitization, so they reach the prompt-injection
  analyzer and get the high-trust confidence weighting Aguara v0.24
  gives instruction files. Previously the sanitizer dropped the leading
  dot and the content was scanned as generic text. AGENTS.md and
  copilot-instructions.md already passed through intact.
• pnpm supply-chain posture via scan_content. Passing
  filename: "pnpm-workspace.yaml" reaches the pnpm-policy analyzer
  and its nine PNPM_* rules for settings weakened below the pnpm v11
  defaults (no sanitizer change needed; the basename was already
  preserved).
• v0.24 regression suite (v024_regression_test.go) pinning the
  new contract end to end through sanitizeFilename: agent-policy on
  .claude/ paths, pnpm-policy on pnpm-workspace.yaml,
  instruction-dotfile routing, agent-trust category size, and
  analyzer-rule metadata via explain_rule.

Aligned

• Aguara core v0.18.2 -> v0.24.0. No public API surface changes; no
  MCP input-schema changes. The catalog grows from 219 to 244 detections
  (193 YAML + 51 analyzer-emitted) across eleven analyzers: the bump
  inherits pyrisk and rsbuild (v0.22), the six Miasma-informed
  behavioral detections (v0.23), and pnpm-policy, agent-policy, and
  instruction-file weighting (v0.24).
• Tool descriptions and README updated to the v0.24.0 surface:
  catalog counts, analyzer lists, the new agent-trust category, and
  the filename hints that route content to the new analyzers.
• server.json reports version: 0.7.0.

v0.6.1

Maintenance release. Aligns mcp-aguara with Aguara v0.18.2 - same five MCP tools, same 219-detection catalog, no schema changes. The relevant pickup from core is the sensitive: true flag on MCPCFG_003 ("Hardcoded secrets in MCP server env block"), so any MCP server config with a hardcoded API token in its env block now comes back with its matched text scrubbed to [REDACTED] from two layers (core's in-place scrub + the MCP's defensive guard).

Use it

Add the MCP server to your client (Claude Code, Cursor, anything that speaks MCP):

claude mcp add aguara -- aguara-mcp

Then ask the agent things like:

• "Is this README asking me to run unsafe install commands?"
• "Does this skill try to read secrets or exfiltrate data?"
• "Which rule triggered, and why?"

For repository-wide dependency checks (npm, PyPI, pnpm, Go, crates.io, Composer, RubyGems, Maven, NuGet), use the Aguara CLI directly - those still live there until a stable public Check API lands.

Install / upgrade

# Quick install (Linux / macOS)
curl -sSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | sh

# Pinned install
VERSION=v0.6.1 curl -sSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | VERSION=v0.6.1 sh

# Docker
docker pull ghcr.io/garagon/mcp-aguara:0.6.1

Provenance

• Release archives signed with Cosign (keyless OIDC), SPDX SBOM per archive via syft, -trimpath for reproducible builds.
• Multi-arch Docker image (linux/amd64, linux/arm64) at ghcr.io/garagon/mcp-aguara signed at digest with SLSA Provenance (mode=max) and SBOM attestations. Base images pinned by multi-arch index digest. Runs as non-root UID 10001.
• Verify locally:

VERSION=v0.6.1 .github/scripts/verify-release.sh

Runs cosign verify-blob on checksums.txt, sha256 match, binary --version check, cosign verify on the image, and SBOM + SLSA Provenance presence for the host platform.

Compatibility

• Aguara core: pinned to v0.18.2. Catalog: 219 detections (193 YAML pattern rules + 26 analyzer-emitted).
• MCP tool surface unchanged from v0.6.0: scan_content, check_mcp_config, list_rules, explain_rule, discover_mcp. No input-schema changes. Binary name unchanged (aguara-mcp).
• server.json now reports 0.6.1 against the canonical io.github.garagon/mcp-aguara identifier. The packages[] entry was dropped because the v0.2.0-era .mcpb artifact has not been regenerated on subsequent releases; future releases may reintroduce it under a build pipeline that tracks it.

CHANGELOG

Aligned

• Aguara core v0.17.0 → v0.18.2. No public API surface changes. MCPCFG_003 now ships with sensitive: true at the rule level, so core's RedactSensitiveFindings scrubs MatchedText in place before the finding reaches the MCP formatter. The MCP's defensive formatScanResult guard already covered this case, so this change is defense-in-depth across two layers rather than a behaviour change.
• server.json aligned to the canonical repository. Bumped to 0.6.1 and switched to the io.github.garagon/mcp-aguara identifier. packages[] removed pending a release-flow story for .mcpb generation.

Added

• v018_regression_test.go. End-to-end test that feeds an MCP config with a hardcoded GITHUB_TOKEN through aguara.ScanContent, asserts the resulting finding has Sensitive=true, and asserts formatScanResult redacts the literal secret to [REDACTED].

Out of scope (still deferred to v0.7.0)

• check_project and audit_project MCP tools. Repository-wide dependency checks (including the May 2026 manually-curated threat intel for the AntV / Mini Shai-Hulud npm compromises) still require the Aguara CLI.

v0.6.0

mcp-aguara v0.6.0

This release aligns Aguara MCP with Aguara v0.17.0.

Aguara MCP is the local MCP adapter for Aguara: it lets agents scan untrusted content, MCP configs, and rule metadata through an in-process Go library, without shelling out to the aguara binary.

What changed

• Upgraded the embedded Aguara engine from v0.14.4 to v0.17.0.
• list_rules now exposes the current 219 detection catalog.
• explain_rule now resolves analyzer-emitted rules, including modern JS, CI trust, package metadata, NLP, toxic-flow, and rug-pull detections.
• Added a defensive MCP redaction boundary so sensitive findings cannot leak raw secrets through matched_text.
• Preserved .github/workflows/ filenames during content scans so CI-trust analyzer rules can fire correctly from MCP.
• Hardened install.sh:
  • checksum verification now fails closed;
  • archive extraction uses tar -xzof;
  • installer behavior is covered by a cap-drop Docker test.
• Hardened release distribution:
  • reproducible GoReleaser builds with -trimpath;
  • signed checksums with Cosign;
  • SPDX SBOMs;
  • signed multi-arch Docker images for linux/amd64 and linux/arm64;
  • SLSA provenance checks in verify-release.sh.
• Rewrote the README and CHANGELOG to reflect the actual v0.17 MCP surface.

What is intentionally not included

Aguara MCP does not expose repository-wide dependency checking yet.

For full project dependency checks, use the Aguara CLI:

aguara check .
aguara audit . --ci

A future MCP release can add check_project after Aguara core exposes a stable public Check API. This release keeps the MCP server in-process, offline by default, and avoids subprocess-based CLI wrapping.

Install

curl -fsSL https://raw.githubusercontent.com/garagon/mcp-aguara/main/install.sh | sh

Then register it with your MCP client, for example:

claude mcp add aguara -- aguara-mcp

v0.5.0

What's new

Aguara scanner upgraded from v0.9.1 to v0.14.4 - 5 minor releases, ~50 upstream commits, one high-severity bug fix that directly impacts this server's detection quality.

High-severity engine fix (v0.14.4)

The Aho-Corasick keyword prefilter silently dropped rule candidates whenever a shorter keyword was a prefix of a longer keyword at the same content position (e.g. bash vs bashrc). Before this upgrade, scan_content and check_mcp_config returned zero findings for content like cat payload >> ~/.bashrc even though the regex layer could have matched it. Every consumer of aguara-mcp on v0.4.0 or earlier was silently losing those detections. No user action required beyond upgrading.

NLP analysis now runs on JSON and YAML (v0.10.0)

Particularly relevant to check_mcp_config: its canonical input is a JSON MCP configuration, and until now the NLP layer was markdown-only. String values longer than 50 characters inside .json / .yaml / .yml files now go through authority-claim detection and credential-exfil-combo classification, not just pattern matching. Catches MCP tool description poisoning that pure regex rules miss.

Two new evasion decoders (v0.14.0)

Pattern matcher now decodes 8 encodings. The two new ones:

• base32 (RFC 4648, 40+ char runs, padding optional)
• C-style octal escapes (\NNN, 4+ contiguous digits)

Both feed the existing DecodeAndRescan pipeline and respect the shared per-file cap.

Upstream improvements (free with library upgrade)

• 189 rules across 13 categories (up from 177 / 13 in v0.4.0)
• Pattern matcher 3.7-6.4x speedup via Aho-Corasick keyword prefilter (v0.14.0). End-to-end impact on this server is small (overhead dominated by JSON-RPC + serialization) but scans on large inputs feel noticeably snappier.
• 4 regex-boundary fixes (PROMPT_INJECTION_004, PROMPT_INJECTION_011, UNI_001, UNI_006 in v0.14.3). Fewer false positives on legitimate documentation content.
• RiskScore (0-100) on every ScanResult with diminishing returns weighting (v0.10.0)
• Cross-file toxicflow correlation within the same directory (v0.10.0). Detects dangerous capability combinations across files.
• Proximity weighting in the NLP classifier (v0.10.0). Clustered keywords score higher, spread-out keywords score lower.
• Dynamic confidence scores replacing flat 0.85/0.70 values (v0.10.0)
• Configurable cross-rule dedup mode (v0.10.0). Consumers that need complete signal can opt into DeduplicateSameRuleOnly.
• Reproducible builds via -trimpath (v0.14.0). Signed checksums via Cosign keyless, SPDX SBOM per archive.

Compatibility

No breaking changes to the MCP tool surface. scan_content, check_mcp_config, list_rules, explain_rule, and discover_mcp all accept the same arguments and return the same shape as in v0.4.0. server.json stays on its current identifier; users who pinned uses: garagon/mcp-aguara@v0.4.0 keep working until they bump.

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's new

Aguara scanner upgraded from v0.7.0 to v0.9.1 — 3 minor releases, 26 upstream commits, security audit in 3 phases.

Context-aware scanning

New tool_name parameter on scan_content enables false-positive reduction. When the originating tool is known (e.g. Bash, Edit, WebFetch), built-in exemptions filter out findings that are always FPs for that tool. Uses the new ScanContentAs() API.

Scan profiles

New scan_profile parameter on scan_content and check_mcp_config:

• strict (default) — enforces all rules
• content-aware — reduced false positives for known tools
• minimal — flag-only mode, no blocking

Verdict and remediation

• Scan responses now include a verdict field (clean, flag, or block) for quick pass/fail decisions
• Each finding includes remediation guidance when the rule provides it

Upstream improvements (free with library upgrade)

• 177 rules across 13 categories (up from 173/12)
• New rules for .env file exposure and GitHub Actions workflow injection (community-contributed)
• Unicode NFKC normalization prevents evasion via fullwidth characters
• Security audit fixes — 12 fixes across 3 phases (performance, dedup, hardening, rules quality)
• Nil pointer fix in ListRules/ExplainRule
• Confidence scoring (0.0–1.0) on every finding

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• fix: add scan timeout and sanitize error messages by @garagon in #3
• fix: correct rule counts in coverage table by @garagon in #4
• refactor: migrate from mcp-go to official go-sdk by @garagon in #5
• docs: highlight official MCP SDK adoption by @garagon in #6

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• ci: remove redundant push trigger from CI workflow by @garagon in #1
• feat: add release infrastructure for registry listing by @garagon in #2

New Contributors

• @garagon made their first contribution in #1

Full Changelog: https://github.com/garagon/aguara-mcp/commits/v0.2.0