Skip to content

v0.3.0 — everything your agent reads

Choose a tag to compare

View all tags
@erichare erichare released this 22 Aug 20:02
· 15 commits to main since this release
v0.3.0
1eff343
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Widens toolprint from "the MCP config in this repo" to everything the agent reads — every agent client on the machine, and the skill bundles your agent loads — then makes findings actionable when they're wrong.

Note: this release supersedes 0.2.0, which was merged but never published. Everything in the 0.2.0 changelog — opt-in --probe, the critical tier, --baseline, PR comments — ships here.

Scan every client, not just this repo

npx toolprint scan --all-clients
npx toolprint scan --client cursor --client zed

Knows where 15 agent clients keep their MCP config across macOS, Linux, and Windows, vendored from SkillRoute's harness manifests — so there's still no Python and no install. Server ids are namespaced by client (claude-code:github) so one lockfile holds several clients without collisions.

The four clients that store servers as TOML or YAML are reported as explicitly skipped, never silently counted as covered.

Skill rug-pull detection

npx toolprint pin  --skills
npx toolprint scan --skills

A SKILL.md body is text your agent reads and then follows — the same trust surface as a tool description. The entire file is hashed, frontmatter and body, so a bundle whose name and description are untouched while its instructions are rewritten is still caught:

  HIGH rug-pull  skills:.claude/skills · skill "pdf-export"
      Skill "pdf-export" definition changed (body/frontmatter) since it was pinned

  CRIT tool-poisoning  skills:.claude/skills · skill "pdf-export"
      Multiple independent injection vectors in skill "pdf-export"
      vectors: Covert precondition referencing other tools, Instruction to read sensitive files

Nothing else covers this today. skillroute validate checks bundles for spec compliance; toolprint checks them for security.

Handle false positives without lowering the gate

Reviewed exceptions go in a committed toolprint.ignore.json, keyed by the stable finding id. A suppressed finding is still reported — just not enforced. reason is required, expired entries warn and re-gate, and unused entries are reported so the file can be pruned.

Adopt on a repo that isn't clean

npx toolprint scan --baseline baseline.json --fail-on-new

Gates only on findings new since the baseline, so you can block regressions today and work the backlog on your own schedule.

Fixes

  • False negative in Claude Code discovery. ~/.claude.json has no top-level mcpServers; the servers an agent actually reaches live under projects.<dir>.mcpServers. These were silently missed. Found by dogfooding this release on a real machine.
  • Non-portable lockfile paths for skills (absolute machine paths would churn across machines).
  • --no-telemetry was a phantom flag — advertised "disable anonymous usage telemetry" while no telemetry code has ever existed. Removed from the docs and --help; still accepted as a hidden no-op so workflows pinned to @v1 keep working.
  • jestatsio/toolprint@v1 never existed as a ref. It does now, and moving it is a documented release step.
  • A config with no MCP servers no longer aborts a multi-config run.

Docs

README rebuilt around the attack it catches, with a banner, badges, and terminal captures transcribed from real CLI output. Adds a 12-guide docs site, plus SECURITY.md and CONTRIBUTING.md.

Full changelog: https://github.com/jestatsio/toolprint/blob/main/CHANGELOG.md

Assets 2
Loading