Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Heron scan this MCP server for security issues"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Heron gives a signed, 0–100 trust score for what an AI agent actually runs — the skills it installs, the MCP servers it connects to, and the agent itself under red-team. Every scan is free, every result is wallet-signed (EIP-191), and the scoring methodology is public.
A SKILL.md is an unsigned binary: you install it and your agent runs whatever
it says. An MCP server's tool names and descriptions are injected straight into
your context, so your agent will obey instructions hidden there ("tool
poisoning"). Almost none of it is checked before it runs. Heron checks it.
Website: https://heronapp.io
Remote MCP endpoint: https://heronapp.io/mcp
In the official MCP registry as io.heronapp/heron
Remote server — one line, nothing to install:
claude mcp add --transport http heron https://heronapp.io/mcpOr add it to any MCP client config:
{
"mcpServers": {
"heron": {
"type": "streamable-http",
"url": "https://heronapp.io/mcp"
}
}
}Prefer to run it locally (stdio)? It's a thin client over the public API:
pip install -r requirements.txt
python heron_mcp.pyRelated MCP server: AgentAudit
Security (the core):
Tool | What it answers |
| Is this |
| Is this MCP server safe to connect before I add it? |
| How injection-resilient is this agent's system prompt? |
| Inspect untrusted text (user msg, tool output, RAG doc, email) at runtime — allow/flag/block before your agent trusts it |
| One signed 0-100 security posture for a whole agent — its system prompt, skills, and MCP servers, combined with a weakest-link rule |
| Is a token contract safe to buy/approve/interact with? On-chain + verified-source scan: owner mint/pause/blacklist powers, changeable fees, upgradeability, honeypot patterns |
| An agent's wallet-signed passport + portable attestations |
| The public index of already-scanned skills |
| Verify a Heron signature yourself (EIP-191) — no trust required |
| The open scoring rules, weights and formula |
Each scan returns a 0–100 score, a verdict (trusted / caution /
dangerous), the specific findings (remote code execution, secret/credential
access, data exfiltration, tool poisoning, prompt-injection, obfuscated payloads
— Morse, base64, invisible Unicode, homoglyphs), and a wallet-signed attestation
anyone can verify.
A signature proves integrity, not correctness — it proves Heron's wallet scored this exact input, and nobody altered the result. Correctness comes from the method being public and auditable. So both are open: read the methodology, verify the signature, and don't trust a score you can't check.
Reputation is built from real, signed results an agent binds to its identity — not a popularity contest, which is gameable.
Show what your agent runs is checked. Free, links back to Heron:
[](https://heronapp.io)Scanned a specific skill or MCP server? Its detail page carries a live-score
badge: https://heronapp.io/badge/skill/<hash>.svg.
Heron is a security layer for the agent economy, operated under İçerikçi Medya.
Free to use; the methodology is published; contributions and threat reports are
welcome — open an issue or reach hello@heronapp.io.
MIT — see LICENSE.
This server cannot be deployed
Signed security scores for what an AI agent runs and reads: skills, MCP servers, prompts, tokens.
Scan any website or MCP server for agent-trust-readiness; returns a signed, verifiable scorecard.
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Scan agent skills and MCP servers for malicious patterns before you load them
