{"name":"io.github.ciceroyang/agentgate","slug":"ciceroyang-agentgate","title":"agentgate","description":"Read-only evidence for the tools agents run: MCP server records, coverage and policy.","url":"https://mcp.market/server/ciceroyang-agentgate","rating":null,"grade":"B","score":77,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":32,"stars":0,"forks":0,"downloads_week":626,"last_push_at":"2026-09-19T09:42:41.000Z","license":"AGPL-3.0"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/ciceroyang/agentgate","website":"https://xn--5kvo87g.com/","version":"0.3.0","remotes":[],"packages":[{"registryType":"npm","identifier":"@zhiliangtech/agentgate","version":"0.3.0","runtimeHint":"npx","transport":{"type":"stdio"},"packageArguments":[{"description":"Run the read-only MCP server instead of the CLI.","value":"mcp","type":"positional"}]}],"tools":[{"name":"check_project","description":"Run agentgate's own checks over a local directory: MCP client configuration, hooks, manifests and source patterns a policy would refuse. It only reads files; it does not install, execute or upload anything, and it does not scan the network.","write_action":true,"price_micros":0,"input_schema":null},{"name":"coverage_report","description":"Report the coverage distribution of the whole index: how many records are fully measured, what stopped the rest, and how many findings came out of the work that ran. It is the same number the project quotes in public.","write_action":false,"price_micros":0,"input_schema":null},{"name":"inventory_tools","description":"Given the MCP servers and agent tools you actually use, report which ones the index has evidence for, which need your exact version, and which it has never measured. Nothing is uploaded and nothing is executed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"lookup_server","description":"Look up one MCP server, or one package, in the local agentgate evidence index. Returns the verdict, the coverage block (which scanners ran, which did not, and why), and the findings. A record that is incomplete is reported as incomplete, never as clean.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":77,"grade":"B","scanned_at":"2026-09-19T21:13:50.028Z","report":{"scannerVersion":"0.1.8","scannedAt":"2026-09-19T21:13:50.055Z","components":{"code":{"score":15,"max":25,"notes":["64 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"packages/guard/src/checks/source-injection.mjs: …True/, message: \"subprocess called with shell=True\" }, { rule: \"AG-SRC-002\", severity: \"…"},{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"packages/guard/src/checks/source-injection.mjs: ….\\w])eval\\s*\\(\\s*[A-Za-z_$]/, message: \"eval() on a non-literal argument\" }, { rule…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@zhiliangtech/agentgate","version":"0.3.0","found":true,"license":"AGPL-3.0-only","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-09-18T07:47:04.411Z","repositoryUrl":"git+https://github.com/ciceroyang/agentgate.git","weeklyDownloads":626}],"repo":{"found":true,"owner":"ciceroyang","repo":"agentgate","archived":false,"pushedAt":"2026-09-19T09:42:41Z","stars":0,"forks":0,"openIssues":3,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/196330369?v=4","ownerCreatedAt":"2025-01-24T13:27:12Z","license":"AGPL-3.0"},"icon":{"url":"https://xn--5kvo87g.com/favicon.svg","source":"registry"},"presence":{"stars":0,"forks":0,"downloadsWeek":626,"license":"AGPL-3.0","lastPushAt":"2026-09-19T09:42:41.000Z","score":32}}}},"grade_history":[{"kind":"restore","fromGrade":"D","toGrade":"B","reason":"score 77: subprocess with shell=True; eval / new Function used","createdAt":"2026-09-19T21:13:50.499Z"},{"kind":"restore","fromGrade":"F","toGrade":"D","reason":"score 54: curl | sh in a script; Base64 decoded then executed; subprocess with shell=True","createdAt":"2026-09-19T20:40:44.447Z"}],"reviews":[]}