Agent Threat Rules CLI
ATR scans skills and MCP configs for prompt injection and tool poisoning with open rules, like Sigma for AI agents
- 425 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Scans the files and configs you point it at, including MCP configs that may hold tokens
- Optional event reporting turns on with --report-to-cloud and sends a SHA-256 hash of the scanned content
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/agent-threat-rulesDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Scans the files and configs you point it at, including MCP configs that may hold tokens
- Optional event reporting turns on with --report-to-cloud and sends a SHA-256 hash of the scanned content
This is third-party code. Review the repository files before installing.
What it does
Agent Threat Rules (ATR) is an open detection rule format for AI agent threats, a reference engine and the atr command line. A rule is a YAML document with an identifier like ATR-YYYY-NNNNN, a severity from informational to critical and test cases. The authors place the format next to Sigma for SIEM logs. The rules cover prompt injection, tool poisoning, context exfiltration and MCP attacks. The current format version is 4.1.5, a Working Draft. atr scan checks a SKILL.md file, an MCP server config, a tools/list result or a whole folder, and --sarif produces a report for the GitHub Security tab. atr mcp starts an MCP server for IDE integration, atr validate and atr test check your own rules, and atr convert exports the set to JSON, Splunk SPL or Elasticsearch queries. The engine installs as the npm package agent-threat-rules or the PyPI package pyatr, runs from a Docker image and plugs in through a GitHub Action.
Who it is for. Agent security specialists and developers who vet other people's skills and MCP servers before installation and in CI.
Good fit when
- Before installing someone else's skill you want to scan its SKILL.md with atr scan skill.md
- A repository of MCP servers needs a SARIF report in the Security tab through a GitHub Action
- The threat rule set has to move into Splunk or Elasticsearch
- You are writing your own rule and check its schema and test cases with atr validate and atr test
Not a fit when
- The task is finding vulnerabilities in project dependencies: ATR rules describe threats to agents
- You need a formal security guarantee: the project itself calls the format a draft
- You want a ready-made agent command interceptor with no setup: ATR is first of all a rule format and a scanner
Example request
Run atr scan over every SKILL.md in .claude/skills and show me the rules that firedLimitations
- The format is a Working Draft, project governance still rests on one maintainer, and standardization documents are marked as proposals.
- Rule maturity varies: 103 of the 823 live rules in version 4.1.5 are called stable.
- Anonymous event reporting is off and turns on with --report-to-cloud plus a receiver address through --tc-url or ATR_TC_URL. There is no built-in address.
- File contents never enter a report, but it carries the full SHA-256 of the scanned content.
How to disable. Uninstall the package with npm uninstall -g agent-threat-rules or pip uninstall pyatr. Remove the MCP server from the agent config and the GitHub Action from the workflow file.
FAQ
How do I scan a skill for threats with ATR?
Install the CLI with npm install -g agent-threat-rules and run atr scan skill.md. For a whole folder with a SARIF report use atr scan . --sarif and redirect the output into a file.
Does ATR send data anywhere?
Not by default. Anonymous reporting turns on with --report-to-cloud and an address through --tc-url or ATR_TC_URL. Without an address the flag returns an error.
How does ATR differ from skill-scanner and mcp-scanner?
ATR is an open rule format with its own engine, while skill-scanner and mcp-scanner are ready-made scanners. The project says its rules have been merged into repositories at Microsoft, Cisco and Gen Digital.
Which formats can ATR export rules to?
atr convert exports rules to JSON with match patterns, to Splunk SPL queries and to Elasticsearch Query DSL.
How do I plug ATR into GitHub Actions?
Add a workflow step with uses: Agent-Threat-Rule/agent-threat-rules@v3 and the parameters path, severity and upload-sarif. Results show up in the Security tab.
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Agent Threat Rules (this card) | yes | 425 | |
| Skill Scanner | no | 2,695 | a ready-made skill scanner, while ATR defines an open rule format and engine |
| MCP Scanner | yes | 1,109 | Cisco's MCP server scanner with three engines and no shared rule format |
README in short
The README is laid out like a specification: abstract, document status, motivation and a comparison with Sigma and YARA, rule structure, installation, usage, OWASP coverage and benchmark results. The closing sections cover security, telemetry and contributing. Numbers in the README come from data/stats.json.