Log inSubmit server
AgentSecurityLens MCP Security Trust Check logo

AgentSecurityLens MCP Security Trust Check

Checks MCPs, Skills, tools, and other agent components before installation using risk signals and structured install decisions.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install AgentSecurityLens MCP Security Trust Check

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "agentsecuritylens-mcp-security-trust-check": {
      "command": "npx",
      "args": [
        "-y",
        "agent-security-lens"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y agent-security-lens

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 4d ago.

Overview

AgentSecurityLens MCP Security Trust Check MCP server evaluates proposed MCPs, Skills, tools, workflows, prompts, and memory components before installation. It returns machine-readable decisions, risk signals, required controls, safer alternatives, and an agent decision contract. The server uses online intelligence by default and can fall back to a limited local public baseline. Reach for it when an agent needs a pre-install review, workspace scan, outcome reporting, or conservative handling of unknown components.

Use cases

  • Review an MCP before enabling it
  • Apply restrictions to filesystem or shell permissions
  • Check unknown components against available intelligence
  • Scan local Agent, MCP, and Skill environments
  • Report installation outcomes and decision feedback

Key features

  • Machine-readable pre-install decisions
  • Online intelligence with local fallback
  • Risk signals and safe-install plans
  • Alternative and mitigation recommendations
  • Workspace discovery and scanning
  • Installation outcome and feedback reporting

Tools11

What AgentSecurityLens MCP Security Trust Check lets your agent do. Expand a tool for its parameters.

Self-reported~196 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

8/8 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 11d ago via OSV.dev · agent-security-lens (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads522Package downloads in the last 30 days.
Last commit4mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed11Callable tools this server registers over MCP.

How AgentSecurityLens MCP Security Trust Check works

What the AgentSecurityLens MCP Security Trust Check MCP server does

AgentSecurityLens MCP Security Trust Check MCP server provides a pre-installation review layer for autonomous agents. It evaluates MCP servers, Skills, tools, prompt bundles, workflows, and memory components using the proposed source, installation command, intended use, and requested permissions. The result is not a malware verdict. Instead, it describes observable risk signals, controls to apply, available alternatives, and whether automatic installation is permitted.

The service distinguishes between decisions such as allow, allow_with_restrictions, ask_user, and avoid. Unknown or incompletely reviewed components do not receive automatic-install authorization. Agents are expected to follow the returned decision contract and structured actions rather than infer policy from descriptive text.

How it works

After connecting, an agent should call get_install_policy, then use review_before_install for each planned component. A review can include a component name and type, source URL, install command, planned use, requested permissions, and whether unknown metadata may be submitted. The response can include a trust score, risk signals, a safe-install plan, required user confirmation, and a one-step action.

Online mode uses public component metadata and an online intelligence API. If that service is unavailable, the package can use a local fallback containing basic rules and a limited public intelligence baseline. The online catalog includes broader coverage, while automatic assessments still cannot authorize automatic installation. get_intelligence_status exposes the current online or local state.

AgentSecurityLens MCP Security Trust Check MCP server also supports a review loop after installation. Agents can report the result with report_install_outcome, submit useful or incorrect decision feedback, and check whether an unknown component has later been researched. discover_workspace and scan_workspace help identify and assess local Agent, MCP, and Skill environments.

Setup and configuration

Node.js 20 or newer is required. A standard stdio configuration launches the package with npx -y agent-security-lens. The repository provides installation guidance for Claude Desktop, Cursor, Codex-style setups, and generic MCP configurations.

Online intelligence is enabled by default. ASL_API_URL can select an endpoint, while ASL_API_URLS accepts comma-separated endpoints that are tried in order. To use the local fallback explicitly, set ASL_MODE=local. The first policy call may record a minimal activation event when online mode is enabled; ASL_DISABLE_USAGE_TELEMETRY=1 disables that usage event.

Do not submit private source code, file contents, secrets, passwords, tokens, cookies, private prompts, memories, or customer records. Online lookup is intended for public component metadata.

Tools and capabilities

  • Check the active installation policy and intelligence availability.
  • Review a proposed component before installation.
  • Retrieve known component intelligence and suggest alternatives or mitigations.
  • Submit public metadata for unknown components and check research status.
  • Report installation outcomes and decision feedback.
  • Discover relevant local environments and run a local fallback assessment.

AgentSecurityLens MCP Security Trust Check MCP server includes a public reviewed baseline, curated fallback information, and online access to an expanded catalog. Its scoring method is documented in the repository's Agent Component Safety Standard.

Limitations and notes

The server evaluates evidence and installation context; it does not declare a component malicious without supporting evidence. Local mode has less coverage than online intelligence. Automatic assessments cannot authorize automatic installation, and unknown records should be treated conservatively.

The package does not include the complete private intelligence database. Agents should apply every item in safe_install_plan, stop for confirmation when required, and avoid automatic installation when automatic_install_allowed is false. The project is licensed under Apache-2.0.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about AgentSecurityLens MCP Security Trust Check

AgentSecurityLens MCP Security Trust Check is an MCP server that connects agents to online or local component intelligence before installation. Its main tools review proposed components, check known intelligence, recommend alternatives, report installation outcomes, discover workspaces, and scan local environments while returning structured installation decisions.

Install it by configuring an MCP client to run `npx -y agent-security-lens`. Node.js 20 or newer is required. The repository also documents client-specific examples for Claude Desktop, Cursor, Codex-style configurations, and generic MCP clients.

Yes, the repository provides an installation guide for Cursor. Configure the server as a stdio MCP process using the package command, then instruct the agent to call `get_install_policy` after connecting and `review_before_install` before each component installation.

Yes, it can run in local fallback mode by setting `ASL_MODE=local`. Local mode uses basic rules and a limited public intelligence baseline, so the current online intelligence service is preferred when available and provides broader coverage.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAgentSecurityLens MCP Security Trust Check AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/agentsecuritylens-mcp-security-trust-check?style=directory)](https://allmcps.com/mcp/agentsecuritylens-mcp-security-trust-check)
HTML Embed
<a href="https://allmcps.com/mcp/agentsecuritylens-mcp-security-trust-check"><img src="https://allmcps.com/api/badge/agentsecuritylens-mcp-security-trust-check?style=directory" alt="AgentSecurityLens MCP Security Trust Check on AllMCPs" /></a>