Agent tooling

Six small tools for the boundary between an autonomous agent and the actions it can take.

An agent that executes actions sits outside role-based access control: the identity is authenticated, and nothing asks whether this action should happen. The tools here work on that gap from four directions — find the boundary bugs, audit what a server declares before an agent connects to it, gate the calls at runtime, and measure whether any of it actually works. Each one states what it cannot do, because a scanner that only advertises its recall is a scanner people switch off.

Detect and audit

agentbound — static detector for tool-boundary bugs

A third-party tool, a confirmation gate or a CI trigger crossing a security boundary the framework meant to enforce: reserved-name shadowing, last-wins tool dicts, fail-open gates, untrusted authors steering an agent that holds a write scope. Precision 1.00 measured against 14 real frameworks — the survey has the measurement and the four false-positive modes found getting there.

pip install "git+https://github.com/sushant-me/agentbound.git@v0.1.16"
agentbound scan /path/to/repo --fail-on high

In CI:

- uses: sushant-me/agentbound@v1
  with: { path: ., fail-on: high }

mcpaudit — audit an MCP server's declarations before you connect

What a client receives from tools/list is injected into the model's context, so it can carry instructions. Reports reserved-name collisions, instruction-shaped text, invisible Unicode with the tag-block payload decoded, look-alike names, destructive tools declaring readOnlyHint. A lock file with per-field hashes turns a description that changes after approval into a diff.

pip install "git+https://github.com/sushant-me/mcpaudit.git@v0.1.3"
mcpaudit audit tools.json --lock mcpaudit.lock.json

In CI, with the lock committed — drift fails the build:

- uses: sushant-me/mcpaudit@v1
  with: { source: tools.json, lock: mcpaudit.lock.json }

mcp-nameguard — tool names against the ones frameworks reserve

Checks the names a server advertises against the names agent frameworks put on the wire themselves, and distinguishes guarded (the framework refuses the name, so the tool is dropped) from unguarded (the framework does not, so the server can simply take it). Reads a saved payload, stdin, or a live server over stdio.

pip install "git+https://github.com/sushant-me/mcp-nameguard.git@v0.4.9"
mcp-nameguard check tools.json --json

In CI:

- uses: sushant-me/mcp-nameguard@v1
  with: { source: tools.json }

Gate and measure

policygate — a fail-closed gate for tool calls

A model can deny or escalate, and cannot authorise: a failing evaluator falls through to a refusal, and every decision lands in a hash-chained audit log. Written because of a measurement — a locally served 3.8B model approved 23.5% of the proposals the policy would have blocked.

pip install "git+https://github.com/sushant-me/policygate.git@v0.1.1"

trajectorycheck — grade the trajectory, not the answer

Grades the tools an agent calls, the arguments it passes, the side effects it causes, and whether it behaves the same across runs — with a deliberately broken agent as a control, so every failure mode is exercised. --min-pass-rate turns it into a gate.

pip install "git+https://github.com/sushant-me/trajectorycheck.git@v0.1.2"
trajectorycheck run --runs 100 --min-pass-rate 0.95

tool-boundary-corpus — score a detector against labelled cases

A labelled corpus and a detector-agnostic harness: the detector is any command that reads a path and prints findings, so a number produced here can be compared with one produced next year, or by somebody else, on a detector that does not exist yet.

pip install "git+https://github.com/sushant-me/tool-boundary-corpus.git@v0.1.2"
python3 -m corpus.cli run --kind tool-list --detector 'your-scanner {input}' --min-precision 0.9

In CI — the floors are the gate:

- uses: sushant-me/tool-boundary-corpus@v1
  with:
    detector: my-scanner --json {input}
    kind: tool-list
    min-precision: '0.9'

What these do not do

A clean report is not a safe server. The audits review declarations, not behaviour: a server can declare a perfectly clean tool list and do something else when called. Absence of evidence, stated plainly.
The corpus is self-authored. It is a regression gate, not an independent benchmark; the harness prints that caveat with every score so the number travels with its limit.
Neither audit runs the server. No network, no credentials, no SDK — which is also why the declarations are never uploaded anywhere.

Every claim is re-checked

sushant-me/reputation lists each claim I make about this work, names the public source it came from, and checks it weekly — the badge turns red the moment one stops being true. It also audits every public repository in the account for committed credentials and checks that the four Action claims above are true at the tags they name.

The install tags above are checked against the latest release of each repository every Monday, and the Action refs are checked to resolve — .github/workflows/check.yml fails the build when one goes stale, rather than leaving it for a reader to discover.