Inkog MCP server

Inkog MCP Server

Security companion for AI agent development in Claude, Cursor, and Claude Code.

Ask your AI pair-programmer to build an agent. Inkog checks it as you code — scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.

Available in Claude Desktop, Cursor, Claude Code, ChatGPT, and any MCP-compatible client.

The Dev-Flow Loop

Inkog is designed to live inside the conversation where you build the agent — not as a post-hoc gate:

1. Ask Claude to build a piece of agent logic.
2. Ask Claude to scan it with Inkog — "Scan this with Inkog and show me any CRITICAL or HIGH findings."
3. Ask Claude to explain each finding in plain English — "Explain the top finding. What's the risk, and how do I fix it?"
4. Ask Claude to apply the fixes. Review the diff, approve, re-scan.
5. Before shipping, verify governance — "Verify my AGENTS.md against the code" and "Audit the agent-to-agent delegation".

Read the full walkthrough: Building Secure AI Agents with Claude Code and the Inkog MCP.

Recommended prompts

• "Scan the current directory with Inkog and show me any CRITICAL or HIGH findings."
• "Explain the top finding in plain English. What's the risk, and how do I fix it?"
• "Verify my AGENTS.md against the code."
• "Audit the agent-to-agent delegation in this crew."
• "Run a compliance report and map the findings to EU AI Act Articles 12, 14, and 15."
• "Audit the MCP servers I'm integrating with."

When to Use Inkog

• Building an AI agent — Scan during development to catch infinite loops, prompt injection, and missing guardrails before they ship
• Adding security to CI/CD — Add inkog-io/inkog@v1 to GitHub Actions for automated security gates on every PR
• Preparing for EU AI Act — Generate compliance reports mapping your agent to Article 14, NIST AI RMF, OWASP LLM Top 10
• Reviewing agent code — Use from Claude Code, Cursor, or any MCP client to get security analysis while you code
• Auditing MCP servers — Check any MCP server for tool poisoning, privilege escalation, or data exfiltration before installing
• Verifying AGENTS.md — Validate that governance declarations match actual code behavior
• Building multi-agent systems — Detect delegation loops, privilege escalation, and unauthorized handoffs between agents

What Inkog Does

• Logic Flaw Detection: Find infinite loops, recursion risks, and missing exit conditions
• Security Analysis: Detect prompt injection paths, unconstrained tools, and data leakage risks
• AGENTS.md Governance: Validate that code behavior matches governance declarations
• Compliance Reporting: Generate reports for EU AI Act, NIST AI RMF, OWASP LLM Top 10
• MCP Server Auditing: Audit any MCP server before installation
• Multi-Agent Analysis: Audit Agent-to-Agent communications for logic and security issues

Installation

Claude Desktop

Add to your claudedesktopconfig.json:

{
  "mcpServers": {
    "inkog": {
      "command": "npx",
      "args": ["-y", "@inkog-io/mcp"],
      "env": {
        "INKOG_API_KEY": "sk_live_your_api_key"
      }
    }
  }
}

Cursor

Add to your Cursor MCP settings:

{
  "mcpServers": {
    "inkog": {
      "command": "npx",
      "args": ["-y", "@inkog-io/mcp"],
      "env": {
        "INKOG_API_KEY": "sk_live_your_api_key"
      }
    }
  }
}

Global Installation

npm install -g @inkog-io/mcp

Shortened. The full README is on GitHub.