AgentSecurityLens

AgentSecurityLens (ASL) is an MCP security trust-check server for autonomous agents.

Before an agent installs or enables an MCP, Skill, tool, prompt bundle, workflow, or memory component, it can ask ASL for a machine-readable safe-install decision.

ASL is not a malware verdict tool. It returns observable risk signals, required controls, safer alternatives or mitigation paths, and a decision contract an agent can execute.

For Autonomous Agents

When you plan to install or enable an MCP, Skill, tool, prompt bundle, workflow or memory component:

1. Run mcp-security-lens ..., agent-security-lens-review ..., or call the MCP tool review_before_install.
2. Read agent_decision_contract.
3. Do not install automatically when automatic_install_allowed is false.
4. Apply every safe_install_plan item before restricted installs.
5. Prefer recommended_alternatives when ASL returns avoid, ask_user, or missing controls.
6. Report the final outcome with report_install_outcome.

Machine-readable agent instructions are also available in AGENTS.md.

Agent Quick Install

Check whether ASL can reach online intelligence and what local fallback is available:

npx -y agent-security-lens doctor

Try one pre-install decision first:

npx -y mcp-security-lens filesystem \
  --type mcp \
  --source-url https://github.com/modelcontextprotocol/servers \
  --install-command "npx -y @modelcontextprotocol/server-filesystem ." \
  --permission filesystem-read \
  --permission filesystem-write

The command returns an agent-readable decision, trust score, risk signals, safe install plan, and whether automatic installation is allowed.

If your shell does not expose npm temporary binaries correctly, use npm install -g agent-security-lens once, then run the same command without npx -y.

More copy-ready calls:

• MCP first-call examples

Add ASL as a pre-install trust check MCP:

{
  "mcpServers": {
    "agent-security-lens": {
      "command": "npx",
      "args": ["-y", "agent-security-lens"]
    }
  }
}

Then give the agent this policy:

Before installing or enabling any MCP, Skill, tool, prompt bundle,
workflow or memory component, call AgentSecurityLens review_before_install.
Follow agent_decision_contract and agent_actions exactly.
Never submit private source code, secrets, tokens, cookies or file contents.

See Agent install guide for Claude Desktop, Cursor, Codex-style and generic MCP configurations.

Copy-ready files:

• Install snippets
• Agent pre-install policy

Public Intelligence

The public package includes a reviewed baseline so agents can still make conservative decisions when the cloud API is unavailable.

• Public Security Index v0.1
• Top MCP Security Signals v0.1
• Top Skill Security Signals v0.1
• Agent Framework Install Decisions v0.1
• MCP First-Call Examples v0.1

The online ASL intelligence API serves the current expanded catalog. The npm package intentionally does not ship the complete private intelligence database.

Basic MCP Config

{
  "mcpServers": {
    "agent-security-lens": {
      "command": "npx",
      "args": ["-y", "agent-security-lens"]
    }
  }
}

Node.js 20 or newer is required.

Online Configuration

The public MCP uses online intelligence by default:

ASL_API_URL=https://agentsecuritylens-api.agentsecuritylens.workers.dev
ASL_API_URLS=https://agentsecuritylens-api.agentsecuritylens.workers.dev

`ASL_API_UR

... View full README on GitHub