Supply-chain gate for AI agent skills and MCP servers: poison-scan tool definitions, hash-pin the vetted set into a lock file and verify drift in CI. truecopy-mcp is a drop-in stdio proxy that filters a live server's tools/list down to its pinned, unmodified, unpoisoned tools.
Security scanner and runtime proxy for MCP servers. Catches tool poisoning, prompt injection, and rug-pull attacks (silent tool description changes) before they reach your AI agent. Includes a static scanner and a runtime stdio proxy.
Provides a deterministic pre-install security scan for Agent skills, plugins, and MCP servers via stdio, returning verdicts, audited badges, CI gates, and reports without executing code or making network calls.
Self-hosted MCP gateway that applies deterministic, compiled policy to tool discovery, invocation, and outbound data flow, with no model in the enforcement path. Every decision emits a hash-chained receipt sealed with Ed25519 and verifiable using public keys only.
A task-scoped MCP stdio proxy that learns candidate least-privilege policies from labeled successful runs, requires human review, enforces exact decisions, detects tool-definition drift, and emits privacy-minimized JSONL events for Wazuh.
