Scan, lock, and gate your MCP servers — npm audit + lockfile + CI drift gate for the MCP era.
English | 简体中文
Adding an MCP server to Claude/Cursor today is "paste JSON, hope for the best." AgentGate is the open-source trust & supply-chain gate that closes that gap: it scans your MCP servers for real attack patterns, locks the exact tool surface your agent sees, gates CI on any drift from that baseline, and cross-checks everything against a public advisory database of verified MCP incidents.
No install needed (the npm package is mcp-agentgate; the installed command is agentgate):
# Scan every MCP config on this machine — 26+ clients auto-discovered
# (Claude Desktop/Code, Cursor, VS Code, Codex, OpenCode, Windsurf, Cline, Gemini CLI, Zed, …)
npx mcp-agentgate scan
# Pin the current tool surface into agentgate.lock
npx mcp-agentgate lock
# In CI: exit non-zero if anything drifted from the lock
npx mcp-agentgate ci
# Catch AI-hallucinated (slopsquatted) and typosquatted dependencies (npm + PyPI)
npx mcp-agentgate deps
# Ask the MCP advisory database about a package before you install it
npx mcp-agentgate advisory check mcp-remote@0.1.10Works offline, no account or token required. All commands and exit codes: docs/spec/cli-contract.md. Docs, rule reference, and a shareable report viewer: https://agentgate.zalize.com.
| Step | What it does |
|---|---|
| Scan | Static + opt-in live analysis of MCP servers: tool poisoning (hidden Unicode, prompt injection), credential leaks, SSRF/RCE vectors, over-privileged tool combos |
| Lock | Pin the exact tool surface (names, descriptions, input schemas) your agent sees — and optionally every skill/instruction file (--skills) — into agentgate.lock: rug-pull defense |
| Gate | Fail CI on any drift from the approved baseline; diff-based review, not binary allow/deny |
| Deps | Catch AI-hallucinated (slopsquatted) and typosquatted dependencies — live npm/PyPI verification of manifests and source imports before anything installs |
| Advise | Cross-check servers against a public, structured MCP advisory database |
This is not a rules demo — the advisory pipeline and scanner run against the real npm ecosystem continuously:
- 110 verified advisories in the public MCP advisory database (JSON feed · RSS · queryable Workers API), every entry backed by an authoritative source and re-verified against the actual package or fix commit.
- 30+ of them are malicious npm packages (credential stealers, reverse
shells, traffic interceptors) targeting the MCP/agent ecosystem — each one
verified by unpacking the published npm tarball, and several were still
live on npm at verification time (e.g.
anthropic-setup, which silently reroutes all Claude Code traffic through an attacker's proxy;remote-claude-daemon, a remote-controlledclaude --dangerously-skip-permissionsrelay;@guangnao/claude-cli, a concealed remote-job hub). - CVE-grade incidents covered end-to-end: the postmark-mcp BCC backdoor, mcp-remote RCE (CVE-2025-6514, CVSS 9.6), MCP Inspector RCE (CVE-2025-49596), filesystem-server sandbox escapes (CVE-2025-53109/53110), and the ongoing GHSA/OSV window is swept on a fixed cadence.
- AgentGate scans itself in CI on every PR (dogfood job).
The MCP security landscape splits into scanners with no drift defense and lockfiles with no scanner. AgentGate is the only tool that ships the whole loop. Star counts and capabilities verified 2026-08-16; full source-verified matrix against 9 tools in docs/COMPARISON.md:
| AgentGate | Snyk Agent Scan (2.9k★) | Cisco MCP Scanner (1.0k★) | ToolPin | |
|---|---|---|---|---|
| Security scan (static + live) | ✅ 12 rules, deterministic | ✅ | ✅ (YARA + LLM judge) | |
| Lockfile of the tool surface | ✅ agentgate.lock (+ skills) |
❌ | ❌ | ✅ |
| CI drift gate + readable diff | ✅ ci / diff |
❌ | ❌ | ✅ |
| Public advisory DB + auto cross-check | ✅ 110 entries, open JSON | ❌ | ||
| Hallucinated/typosquat dep check | ✅ deps (npm + PyPI) |
❌ | ❌ | ❌ |
| No account/token required | ✅ | ❌ SNYK_TOKEN required |
✅ | |
| Runs your server commands by default | ❌ opt-in --live, asks first |
— | pin |
# .github/workflows/mcp-gate.yml
steps:
- uses: actions/checkout@v4
- uses: wookat/agentgate/packages/action@v0.67.61
with:
command: ciFindings show up inline on the PR diff automatically — under GitHub Actions, ci/scan/deps emit one workflow-command annotation per finding, no extra permissions needed. See packages/action for SARIF upload to GitHub code scanning and all inputs.
Or as a pre-commit hook:
# .pre-commit-config.yaml
repos:
- repo: https://github.com/wookat/agentgate
rev: v0.67.61
hooks:
- id: agentgate-ciGitLab CI / CircleCI / Jenkins / Azure Pipelines recipes: agentgate.zalize.com/docs/guides/ci.
| Platform | Status |
|---|---|
| Linux | CI-verified on every PR (ubuntu-latest) |
| macOS | CI-verified on every PR (macos-latest) |
| Windows | CI-verified on every PR (windows-latest) |
| Node.js | >= 22 (enforced via engines) |
The full test suite — including a live stdio MCP fixture server — runs on all three operating systems in CI. Client config discovery covers the platform-specific paths of Claude Desktop, Claude Code, Cursor, VS Code, Codex, OpenCode, Windsurf, Cline, Gemini CLI, Kiro, Roo Code, Kilo Code, Zed, Continue.dev, Amp, Warp, LM Studio, Trae, Qoder, Amazon Q Developer, Qwen Code, GitHub Copilot CLI, JetBrains Junie, Factory Droid, Antigravity, Goose, and Crush on each OS.
Move your MCP server config between clients without retyping JSON/TOML by hand (the official MCP 2026 roadmap names config portability as an open gap):
npx mcp-agentgate config convert --from cursor --to vscode --in .cursor/mcp.json --out .vscode/mcp.jsonSupports Claude Desktop, Claude Code, Cursor, VS Code, Codex, OpenCode, Windsurf, Cline, Gemini CLI, Kiro, Roo Code, Kilo Code, Zed, Continue.dev, Amp, Warp, LM Studio, Trae, Qoder, and Amazon Q Developer, with explicit warnings on any lossy conversion. Also available as the standalone mcp-agentgate-config-convert package.
Scanners find known-bad patterns at scan time but can't see an approved server that quietly changes next week. Lockfiles catch drift but don't judge whether what you locked was safe to begin with. AgentGate does both, plus cross-checks a public advisory DB. The full, source-verified feature matrix vs mcp-scan (now Snyk Agent Scan), Cisco MCP Scanner, MCTS, ToolPin, mcp-warden, and both mcp-locks: docs/COMPARISON.md.
Developing from source (contributors)
Requires Node.js >= 22 and pnpm.
git clone https://github.com/wookat/agentgate.git
cd agentgate
pnpm install
pnpm build
alias agentgate="node $PWD/packages/cli/dist/index.js"Scan every MCP server your clients (Claude Desktop / Claude Code / Cursor / VS Code / Codex / OpenCode / Windsurf / Cline / Gemini CLI / Kiro / Roo Code / Kilo Code / Zed / Continue.dev / Amp / Warp / LM Studio / Trae / Qoder / Amazon Q Developer / Qwen Code / GitHub Copilot CLI / JetBrains Junie / Factory Droid / Antigravity / Goose / Crush) are configured to use — config paths are discovered automatically:
agentgate scan # static config analysis, terminal table
agentgate scan --live # also connect to servers (stdio + remote) and audit their live tool surface
# (asks before starting them; add --yes in CI)
agentgate auth login <server> # OAuth login for hosted servers — live scans pick up the cached tokens
agentgate scan --format json # machine-readable report
agentgate scan --format sarif -o report.sarif # for GitHub code scanning
agentgate scan path/to/repo # scan an MCP server repo for source-level issues
agentgate scan path/to/repo --ignore 'vendor/**' 'test/**' # exclude paths from repo scansAdd --debug to any command for diagnostics on stderr. Exit codes: 0 clean, 1 gate failure (drift / findings at --fail-on), 2 usage or environment error — see docs/spec/cli-contract.md.
Pin the tool surface your agent sees, then gate on drift:
agentgate lock # connect to configured servers, write agentgate.lock
agentgate lock --skills # also pin agent skill/instruction files (lockfile v2)
agentgate diff # exit 1 + human-readable diff if any tool name/description/schema changed
agentgate ci --fail-on high # CI gate: drift OR high-severity findings → non-zero exitPoint at a specific config instead of auto-discovery with --config path/to/mcp.json (Codex config.toml and OpenCode opencode.json are also understood).
Twelve scan rules across seven categories, aligned with real-world MCP incidents: tool-poisoning (hidden Unicode, prompt injection — in tool descriptions and agent skill files), credential-leak, overprivileged (dangerous capability combos, unscoped skill allowed-tools grants), auth-missing, ssrf, rce-vectors (including load-time skill dynamic-context commands), supply-chain (unpinned npx -y pkg@latest rug-pull exposure).
Lockfile formats: v1 (servers only, frozen) and v2 (adds optional pinned skill files via lock --skills), with JSON Schemas in docs/spec/.
packages/cli/ # agentgate CLI (scan / lock / diff / ci) [route A]
packages/core/ # rule engine, lockfile spec implementation [route A]
packages/action/ # GitHub Action [route C]
packages/config-convert/ # MCP client config converter [route C]
advisories/ # public MCP advisory database (structured JSON)[route B]
website/ # docs site + report viewer (Cloudflare Pages) [route B]
docs/ # specs and project docs
See SECURITY.md for the vulnerability disclosure process. CI actions are SHA-pinned, dependencies are frozen-lockfile installed, releases ship with npm provenance, and AgentGate scans itself in CI (dogfood job).
PRs welcome. Cross-cutting interfaces (CLI JSON output, advisory schema, lockfile schema) live in docs/spec/ — update the spec in the same PR as the code.