Docs

MCP security

Five defenses over the MCP servers you have already configured. No server is ever executed to check it. Drift alerts catch a server definition changing under you. An allowlist pins the exact configuration you approved. Canaries plant a non-functional honeytoken and fire if it ever leaves. The red-team runner attacks your own setup with a tool-poisoning library. Skill supply chain signs and verifies what each skill and subagent is allowed to do.

Where to find it

  • Localhost: /mcp-security.html
  • API: GET /api/mcp-security/alerts and /dismiss, /allow, /canary, /redteam, GET /api/skills/manifest
  • CLI: repoops skills sign and repoops skills verify
  • Sidebar: Guard, then MCP security

What it does for you

A server that changes after you approved it does not stay approved.This is the rug-pull vector: a tool you vetted is edited later. The allowlist pins the source tool, the server name and a hash of its configuration together. Change any of them and it un-pins, which forces a re-approve. Drift becomes a standing watch you dismiss deliberately, not a line in a log.
A honeytoken that proves exfiltration rather than suggesting it.A canary is a credential-shaped string that does nothing. If it ever appears leaving the machine, something read it that should not have. There is no false-positive interpretation to argue about.
Attack your own setup before someone else does.The red-team runner runs a tool-poisoning attack library against your configuration and returns a per-attack verdict that fails closed: an attack it cannot conclusively defeat reads as a failure, not a pass.
Skills and subagents carry a signed capability manifest.Each one declares its tools, its network scope and its filesystem scope. When the tool set changes you get a drift alert, and gaining a network or filesystem-write capability escalates it to high. Unsigned, drifted, unverifiable, and deleted-but-still-signed all fail closed.

Built vs. planned

All five sections ship today. Manifests are signed with the per-install HMAC ledger key, which detects an out-of-band change by something that does not hold the key; a local key holder can still re-sign a file they edited, and the surface says so rather than implying more. Environment variable names are read to map a server to its secrets; values are never read. LLM-free throughout.

Last updated