Security

Capability-based policy enforcement for agent CLI actions

MCP Gateway — identity propagation, server card validation, policy enforcement, AEP evidence emission for MCP tool invocations

Stdio proxy that gates a third-party MCP server's tool calls behind a signed human approval — no code changes to the wrapped server.

MCP server for Self Agent ID: proof-of-human identity for AI agents

Axios-compatible HTTP client for browser and Node.js with guardrails for AI agents: secret scrubbing, allowlists, response shaping, and an MCP server.

MCP remote proxy with OAuth — Abluva fork with mid-session re-auth, reliable OAuth callback handling, and MCP 2026-07-28 stateless support

Wrap an MCP server so every tool call is gated behind a cryptographically-signed human approval (local policy + INTYGA gateway step-up).

A static scanner for MCP servers that catches the exact bug class behind most real MCP SSRF reports: a tool handler making an outbound request to a caller-controlled URL with no host validation.

Audit, optimize, and secure Claude Code, OpenClaw, and Hermes AI agent deployments. Token waste detection, security scanning, config drift, fleet SSH audit. Free to install.

Self-hosted permission-aware context layer. Search returns only what the caller may read.

Trust scoring for MCP servers, AI skills & npm packages — 15 signals + safety scanning.

Proof of what an AI agent was allowed to do, and what it then did. A passkey-signed permission with limits a machine can check, a signed receipt for each action, and a free checker. Evidence, not a verdict.

Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs

Pre-use security audit for MCP servers, with optional Docker-sandboxed runs

Scan a project for leaked secrets, risky MCP configs, and unsafe automation before handing it to an AI coding agent (Claude Code, Cursor, Codex). Zero dependencies, runs locally.

Connect Claude to Clio: 34 tools for matters, custom fields, notes, documents, folders, billing.

Primary-source lithium & battery-metals mining data (AISC, reserves, filings) via x402.

Prompt-injection scanner for AI agents: deterministic, documented rules (instruction override, jailbreaks, exfiltration URLs, tool hijack/MCP tool poisoning, hidden Unicode, encoded payloads) returning a risk score, categories and spans. Library + x402 pa

Scaffold a working LumoAuth agent app in 60 seconds.

Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.