AgentSecurityLens MCP Security Trust Check MCP server

AgentSecurityLens

AgentSecurityLens (ASL) is an MCP security trust-check server for autonomous agents.

Before an agent installs or enables an MCP, Skill, tool, prompt bundle, workflow, or memory component, it can ask ASL for a machine-readable safe-install decision.

ASL is not a malware verdict tool. It returns observable risk signals, required controls, safer alternatives or mitigation paths, and a decision contract an agent can execute.

For Autonomous Agents

When you plan to install or enable an MCP, Skill, tool, prompt bundle, workflow or memory component:

1. Run mcp-security-lens ..., agent-security-lens-review ..., or call the MCP tool reviewbeforeinstall.
2. Read agentdecisioncontract.
3. Do not install automatically when automaticinstallallowed is false.
4. Apply every safeinstallplan item before restricted installs.
5. Prefer recommendedalternatives when ASL returns avoid, askuser, or missing controls.
6. Report the final outcome with reportinstalloutcome.

Machine-readable agent instructions are also available in AGENTS.md.

Agent Quick Install

Check whether ASL can reach online intelligence and what local fallback is available:

npx -y agent-security-lens doctor

Try one pre-install decision first:

npx -y mcp-security-lens filesystem \
  --type mcp \
  --source-url https://github.com/modelcontextprotocol/servers \
  --install-command "npx -y @modelcontextprotocol/server-filesystem ." \
  --permission filesystem-read \
  --permission filesystem-write

The command returns an agent-readable decision, trust score, risk signals, safe install plan, and whether automatic installation is allowed.

If your shell does not expose npm temporary binaries correctly, use npm install -g agent-security-lens once, then run the same command without npx -y.

More copy-ready calls:

• MCP first-call examples

Add ASL as a pre-install trust check MCP:

{
  "mcpServers": {
    "agent-security-lens": {
      "command": "npx",
      "args": ["-y", "agent-security-lens"]
    }
  }
}

Then give the agent this policy:

Before installing or enabling any MCP, Skill, tool, prompt bundle,
workflow or memory component, call AgentSecurityLens review_before_install.
Follow agent_decision_contract and agent_actions exactly.
Never submit private source code, secrets, tokens, cookies or file contents.

See Agent install guide for Claude Desktop, Cursor, Codex-style and generic MCP configurations.

Copy-ready files:

• Install snippets
• Agent pre-install policy

Public Intelligence

The public package includes a reviewed baseline so agents can still make conservative decisions when the cloud API is unavailable.

• Public Security Index v0.1
• Top MCP Security Signals v0.1
• Top Skill Security Signals v0.1
• Agent Framework Install Decisions v0.1
• MCP First-Call Examples v0.1

The online ASL intelligence API serves the current expanded catalog. The npm package intentionally does not ship the complete private intelligence database.

Basic MCP Config

{
  "mcpServers": {
    "agent-security-lens": {
      "command": "npx",
      "args": ["-y", "agent-security-lens"]
    }
  }
}

Node.js 20 or newer is required.

Online Configuration

The public MCP uses online intelligence by default:

ASL_API_URL=https://agentsecuritylens-api.agentsecuritylens.workers.dev
ASL_API_URLS=https://agentsecuritylens-api.agentsecuritylens.workers.dev

Shortened. The full README is on GitHub.