Rule reference
agentgate scan runs seven rules, one per finding category. Each rule can inspect up to four surfaces:
- config — MCP client config entries (static, always runs).
- tool — a single tool’s name/description/input schema (
--liveor lockfile audit). - toolset — a server’s whole tool surface at once.
- source — files in a repo target (
agentgate scan path/to/repo).
| Rule | Category | Detects |
|---|---|---|
| AG-TP-001 | tool-poisoning |
Hidden Unicode and prompt-injection patterns in tool descriptions |
| AG-CL-001 | credential-leak |
Hardcoded secrets in configs; tools soliciting credentials |
| AG-OP-001 | overprivileged |
Dangerous capability combos; overly broad filesystem grants |
| AG-AM-001 | auth-missing |
Remote servers without auth or over plain HTTP |
| AG-SS-001 | ssrf |
Cloud-metadata endpoints; unrestricted URL-fetching tools |
| AG-RC-001 | rce-vectors |
Shell-wrapped launches, curl|sh, arbitrary code-execution tools |
| AG-SC-001 | supply-chain |
Unpinned npx pkg@latest launches, unpinned docker images |
Severities: critical > high > medium > low > info. Gate on them with agentgate scan --fail-on <severity> or agentgate ci.