AgentGate
Open source · Apache-2.0

Scan, lock, and gate your MCP servers

The npm audit + lockfile + CI drift gate for the MCP era. One command against tool poisoning, rug-pulls, credential leaks, and known advisories.

Get startedGitHub
npm version badge for mcp-agentgateRelease notes
npm i -g mcp-agentgate
agentgate scan
$ agentgate ci --fail-on high

✔ filesystem-server      12 tools · matches lock
✔ github-server          8 tools · matches lock
⚠ web-fetch-server       SSRF vector: unrestricted URL fetch
✖ postmark-mcp@1.0.16    MCPA-2025-0002 · hidden BCC backdoor
✖ notes-server           tool description drift from lock

2 critical · 1 warning · exit code 1
Gate closed. Review drift with `agentgate diff`.

One loop, five gates

Everything fragmented across five point tools today, in a single coherent workflow.

scan

Static + live analysis: tool poisoning, hidden Unicode, credential leaks, SSRF/RCE vectors, over-privileged combos — plus agent skill files (SKILL.md).

lock

Pin the exact tool surface — names, descriptions, schemas — of stdio and remote (hosted) servers into agentgate.lock. OAuth-protected servers work via agentgate auth login. Rug-pulls can’t hide.

gate

CI fails on any drift from the approved baseline. Human-readable diffs, not binary allow/deny.

deps

Catch AI-hallucinated (slopsquatted) and typosquatted dependencies — live npm/PyPI verification before anything installs.

advise

Cross-check every server against a public, structured MCP advisory database — free API, CLI-integrated.

Why not Snyk or Cisco?

Every claim verified against the competitor’s public repo and README —sources & dates.

Feature comparison between AgentGate, Snyk Agent Scan, and Cisco scanners
CapabilityAgentGateSnyk agent-scanCisco skill-scanner + mcp-scanner
Account / API keyNone — fully localSnyk account + SNYK_TOKENLLM engines need API keys
Executes your MCP serversNever — static by defaultYes (stdio scans run commands)No
Coverage in one toolConfigs + skills + commands + plugins + lockfile + depsConfigs + skillsSplit across two tools
Public advisory database110 structured advisories, free APIProprietary platformNone
Lockfile + CI drift gateagentgate.lock + SARIF + exit codesNoNo
Full comparison vs Snyk →Full comparison vs Cisco →

Gate your agent in three steps

  1. 1

    Install

    One global install; auto-discovers Claude, Cursor, VS Code, Codex, OpenCode, Windsurf, Cline, Gemini CLI, Kiro, Roo Code, Kilo Code, Zed, Continue.dev, Amp, Warp, LM Studio, Trae, Qoder, Amazon Q, Qwen Code, Copilot CLI, Junie, Factory Droid, Antigravity, Goose, and Crush MCP configs.

  2. 2

    Scan & lock

    Audit every configured server, then pin the approved tool surface to agentgate.lock.

  3. 3

    Gate in CI

    Add one CI step (or the GitHub Action). Any upstream drift turns the build red.

terminal
# 1. install
$ npm i -g mcp-agentgate

# 2. scan and lock
$ agentgate scan
$ agentgate lock

# 3. gate in CI
$ agentgate ci --fail-on high

Public MCP advisory database

Structured JSON advisories for known-malicious and vulnerable MCP servers. Free API, automatically cross-checked on every scan.

Advisories
110
Malicious packages
33
Critical severity
47
Browse advisories
CVE-2025-6514critical

mcp-remote remote code execution via crafted server responses (CVSS 9.6).

MCPA-2025-0002critical

postmark-mcp patch release silently BCC’d every outgoing email to an attacker.

CVE-2026-26118high

Azure MCP server-side request forgery enabling privilege elevation.

Case files: caught in the wild

Real packages from our advisory sweeps — tarballs pulled apart, payloads documented, advisories published. Every case links to the full write-up.

mangomind-agentMCPA-2026-0078

Hidden autostart daemon rewrites your OpenCode config so model traffic routes through the author’s endpoint; relay messages are executed via execSync.

agenthub-aiMCPA-2026-0080

Installs an OS service, opens a WebSocket to a hardcoded relay, and drives a Claude agent session in your working directory. Self-updates globally.

aclade-agentMCPA-2026-0079

Detached daemon polls a remote API and runs server-supplied shell strings with shell: true — remotely replaceable code.

postmark-mcpMCPA-2025-0002

A patch release silently BCC’d every outgoing email to the author. The lockfile catches exactly this: drift in an already-approved server.

Frequently asked questions

Does scanning execute my MCP servers?

No. The default scan is pure static analysis of configs, skills, commands, plugins and lockfiles. Live probing exists but is opt-in and clearly flagged.

Do I need an account or token?

No. Everything runs locally; the advisory API is free and unauthenticated — and optional, scans work offline.

What exactly gets scanned?

MCP client configs (Claude, Cursor, VS Code, Codex, OpenCode and more), SKILL.md and agent/command/plugin files, agentgate.lock drift, and npm/PyPI dependencies for typosquats and known-malicious packages.

How is this different from a point-in-time scanner?

Scanners find known-bad patterns once. AgentGate also pins the approved tool surface into a lockfile and fails CI when it drifts — catching rug-pulls that one-shot scans miss.

What’s out of scope?

Runtime behaviour monitoring — that’s a gateway/proxy’s job. AgentGate secures what your agent is configured to trust, before it runs.