superagent_

// context guardrails

MCP repositories

Statically score a public GitHub MCP repository without connecting to or executing the server.

Score a public GitHub repository that contains an MCP server before an agent installs or connects to it. Superagent inspects repository contents only. It does not connect to a live MCP endpoint or execute the server.

How scoring works

An MCP scan accepts owner/repository or a repository URL in the form https://github.com/owner/repository with an optional .git suffix. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of manifests, MCP configuration, tool definitions, schemas, source, scripts, and install hooks. The scanner checks for tool shadowing, credential harvesting, exfiltration, excessive scope, secrets, remote execution, and hidden instructions.
  3. Semantic analysis — reviews tool names, descriptions, schemas, instructions, and relevant source for description injection, instruction injection, output poisoning, schema abuse, and silent capability escalation.

The identifier is the lowercase SHA-256 digest of the canonical owner/repository identity. Superagent resolves the current Git commit and treats every fetched file as untrusted data.

Limits

MCP scans are GitHub only and require the Superagent Security GitHub App. Only public repositories are supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total. Materialization and scan failures fail closed, producing mcp_unscannable rather than a safe result.

Threats

When details=true or the verdict is suspicious / dangerous, MCP scans may emit mcp_tool_shadowing, mcp_description_injection, mcp_instruction_injection, mcp_schema_abuse, mcp_output_poisoning, mcp_silent_capability_escalation, mcp_credential_harvesting, mcp_exfiltration, mcp_excessive_scope, mcp_hidden_encoded_instructions, mcp_remote_execution, mcp_secrets, mcp_install_hooks, and mcp_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a public GitHub MCP repository, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/mcp to score a repository and GET /api/v1/context/mcp/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_mcp.
curl "https://superagent.sh/api/v1/context/mcp?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"modelcontextprotocol/servers"}'
curl "https://superagent.sh/api/v1/context/mcp/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Next steps