Rule reference
agentgate scan runs twelve rules across seven finding categories. Each rule can inspect up to four surfaces:
- config — MCP client config entries (static, always runs).
- tool — a single tool’s name/description/input schema (
--liveor lockfile audit). - toolset — a server’s whole tool surface at once.
- source — files in a repo target (
agentgate scan path/to/repo), including agent skill files (SKILL.md).
| Rule | Category | Detects |
|---|---|---|
| AG-TP-001 | tool-poisoning |
Hidden Unicode and prompt-injection patterns in tool descriptions |
| AG-XS-001 | tool-poisoning |
Cross-server tool-name shadowing and hijacking instructions |
| AG-SK-001 | tool-poisoning |
Hidden Unicode and prompt-injection patterns in agent skill files (SKILL.md) |
| AG-CL-001 | credential-leak |
Hardcoded secrets in configs; tools soliciting credentials |
| AG-OP-001 | overprivileged |
Dangerous capability combos; overly broad filesystem grants |
| AG-TF-001 | overprivileged |
Cross-server toxic flows (read + exfiltrate + untrusted input) |
| AG-SK-002 | overprivileged |
Unscoped dangerous allowed-tools grants in skill frontmatter |
| AG-AM-001 | auth-missing |
Remote servers without auth or over plain HTTP |
| AG-SS-001 | ssrf |
Cloud-metadata endpoints; unrestricted URL-fetching tools |
| AG-RC-001 | rce-vectors |
Shell-wrapped launches, curl|sh, arbitrary code-execution tools |
| AG-SK-003 | rce-vectors |
Dangerous load-time dynamic-context commands in skill files |
| AG-SC-001 | supply-chain |
Unpinned npx pkg@latest launches, unpinned docker images |
Severities: critical > high > medium > low > info. Gate on them with agentgate scan --fail-on <severity> or agentgate ci.