Path traversal
Filesystem calls built from request-like input with no visible path normalization. Heuristic.
THR-PATH-01agent tool security
The scan security runs before agents get tools.
Every scan runs in a disposable Firecracker microVM created for your server and destroyed after the verdict. The output is not a warning label. It is a finding with reproduction and release impact.
submit target
single-use microVM
client replay
static rules
sealed verdict
rule catalog
Eight static security rules for MCP.
Eight rules run over the source. They are heuristics and say so. A ninth (rate limiting) needs runtime analysis and is not run today. Findings are review material; a HIGH finding blocks a clean ship verdict.
Hardcoded secrets
Live-looking tokens or keys in source (AWS, GitHub, Slack, private keys). Placeholder values are excluded.
THR-SECRET-02Install-time execution
npm preinstall, install, or postinstall scripts that run arbitrary code on every install.
THR-INSTALL-03Command execution
exec, spawn, or subprocess built from dynamic, argument-like input. Heuristic.
THR-EXEC-04Outbound endpoints
Hardcoded non-local hosts referenced in code, surfaced for review.
THR-NET-05Obfuscated payloads
Large base64-like blobs, flagged higher when the same file also decodes or executes data.
THR-OBF-06Prompt injection
Injection-style phrases or invisible unicode characters in tool-facing strings.
THR-PROMPT-07Outdated SDK pins
Pre-1.0 MCP SDK pin or obsolete protocol version strings in source.
THR-VER-11what a finding contains
Enough evidence to fix it, not just fear it.
Each finding ships with the offending line or surface, a reproduction, the observed result, and the fix pattern.
ruleTHR-PATH-01 / MEDIUM
input{ "path": "../.ssh/id_rsa" }
resultescaped declared root
fixresolve, normalize, compare root, deny symlinks