Trustabl Probe MCP
Probe finds the network calls of an agent tool run without network and prepares a least-privilege policy draft
- 65 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Scanning runs the scanned tool's code in a sandbox and writes report files into its directory
- The `probe_install` command downloads a binary and Docker images
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/trustabl-probeDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Scanning runs the scanned tool's code in a sandbox and writes report files into its directory
- The `probe_install` command downloads a binary and Docker images
This is third-party code. Review the repository files before installing.
What it does
Trustabl Probe runs an agent tool in an OpenShell or Docker sandbox with the network blocked, observes which addresses it tried to reach and builds a least-privilege draft network policy. Static analysis for Python, Go, JavaScript, TypeScript, Ruby and Shell finds hardcoded credentials, calls to unauthorized addresses and calls without timeouts. The `@trustabl/agent-network-access-probe` MCP module gives an agent three tools: `probe_check_setup` checks the binary, Docker and images, `probe_install` installs them with checksum verification, and `probe_scan` scans a tool directory and returns a readiness score, a draft allow list and findings with fix hints. The agent applies the fixes itself, so no separate model or key is needed.
Who it is for. Authors of agent tools and security teams who want to know which addresses a tool reaches before release.
Good fit when
- A new agent tool is checked for network calls before publishing
- An OpenShell policy with minimal rights is built from observations
- Hardcoded credentials and calls without timeouts are found in code
- Run results are signed with a Sigstore manifest in CI
Not a fit when
- The tool must not be run even in a sandbox
- A dependency vulnerability check is needed and network behavior does not matter
- The code is in a language outside the supported list
Example request
Scan my tool's directory, show the readiness score and the draft allow list and suggest fixesMCP
- Transport
- stdio
- Authentication
- not required
Limitations
Node.js 18 or newer is required. The sandbox needs Docker or NVIDIA OpenShell, and without them only static analysis runs. Docker covers Python, JavaScript, TypeScript, Go and Ruby, the OpenShell image runs Python and Node, and Shell scripts are analyzed statically only. Tools with dangerous calls such as payments, deletes and network writes are not run in the sandbox unless you pass `allow_write_tools: true`. A scan writes four report files into the scanned directory. Cloud metadata addresses are always excluded from the policy.
How to disable. Remove the `agent-network-access-probe` entry from the client configuration. Reports in scanned directories and the results cache in the user's cache folder are deleted by hand.
FAQ
How do I connect Probe to Cursor?
Add an `agent-network-access-probe` server with the command `npx` and the arguments `-y @trustabl/agent-network-access-probe` to `.cursor/mcp.json`. Claude Code has separate instructions in the `mcp` folder.
What does probe_scan change?
It writes four report files into the scanned directory. The other tools read state, and `probe_install` downloads the binary and images.
What does the network-blocked sandbox mean?
The tool runs without network access and Probe records connection attempts, crashes and missing dependencies. A draft policy is built from the addresses seen.
Is a language model needed?
Not for the MCP mode, as the agent applies fixes itself. The separate CLI can use a local or cloud model for automatic fixes.
What does Sigstore sign?
An optional run manifest with keyless signing, in CI such as GitHub Actions with the `id-token: write` permission.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
CLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
README in short
The README shows how Probe runs a tool in a sandbox, observes network addresses and builds a policy, and lists ways to install it. The how-it-works section describes the static and sandbox passes, requirements and model setup for automatic fixes.