SkillFoxx

agentgate CLI

A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean

  • 89 ★ on the repository
  • Last commit
  • AGPL-3.0
CLI

Extended access

Why this level

  • The CLI reads MCP configuration files on the machine and fetches registry and repository data, printing no `env` values or headers.
All reasons and checks

ciceroyang/agentgateAuthor:ciceroyang

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add cli/agentgate

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • The CLI reads MCP configuration files on the machine and fetches registry and repository data, printing no `env` values or headers.

This is third-party code. Review the repository files before installing.

What it does

agentgate gathers facts about the tools agents run and checks them against company rules. It has four parts: inventory walks the registry and resolves packages, evidence joins data into one record per server with the bytes behind every claim, policy scans configs, hooks, manifests and source for what is refused, and verification checks a claim against outside data. The core project rule is that `clean` is emitted only when every check ran. What could not be measured is marked `unmeasured`, and an artifact with such a part becomes `incomplete`. The `discover` command finds MCP configurations on the machine, `inventory` builds a report, `audit` covers several repositories, `check` refuses in CI and `watch` tracks changes. The `serve` service answers over HTTP and renders badges.

Who it is for. Security engineers and platform teams who decide which MCP servers may be allowed near agents in a company.

Good fit when

  • You need a list of the MCP servers developers actually connected, without reading their keys
  • CI blocks a merge when the configuration gains a server that fails the policy
  • Several repositories are checked at once and get one verdict for the set
  • You want a public badge and an evidence page for a specific server

Not a fit when

  • You want a safety certification, while even a confirmed match is no substitute for a scan
  • You need to scan installed programs live, while agentgate reads configs and runs no tools
  • One personal project where checking a single server by hand is enough

Example request

Find MCP configurations on this machine with discover and prepare an inventory report that prints no env values

Limitations

Node.js 20 or newer is required, and there are no dependencies. Version 0.5.0 can wrongly pass a gate with required evidence when evidence is absent, so use 0.6.0 for new gates and read the upgrade guide. An unversioned `npx` command follows the `latest` tag and ignores your clone, so pin the version. A version match does not tell which build is installed, and the sample index in a clone is historical. The hosted service in the README and a local clone may run different versions.

How to disable. Stop the `serve` service, remove the clone or the `@zhiliangtech/agentgate` package, and delete the `./data` directory with accumulated snapshots separately.

FAQ

How do I run a check in a repository?

Run `npx --yes --ignore-scripts @zhiliangtech/agentgate@0.6.0 check --root .`. Without a policy file a built-in default applies that refuses nothing extra.

What does incomplete mean?

At least one check did not run or crashed. Such an artifact is never treated as clean, because `clean` is emitted only after the full set of checks.

Does discover read my keys?

It hides `env` values, headers and arguments. A remote address is cut down to its host, and the list goes to a file for `inventory --input`.

How do I run the service locally?

With `node bin/agentgate.mjs serve`: it listens on port 8080 and serves `/health`, `/v1/index/summary` and badges. `docker compose up` also works.

How does it differ from mcp-audit?

agentgate ties inventory, evidence and CI policy together in one CLI and marks the unmeasured as `incomplete`, while neighbouring scanners return a single per-server report.

Discussion

No questions or reviews yet.

CLI tools

A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10

CLIExtended access245

Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.

MCP serverExtended access123

A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.

CLIExtended access166

An MCP memory server for agents plus a free gate that stops dangerous commands before they run

MCP serverBroad access660

cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code

MCP serverBroad access711

README in short

The README states the single rule about `clean`, `unmeasured` and `incomplete`, the four parts of the system, a quick start, an upgrade warning for 0.6.0 and sections on inventory, `discover`, `audit` and `watch`.

README badge

Report a problem