agent-security-lens 0.1.2 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/.mcp/server.json CHANGED
@@ -1,19 +1,19 @@
1
1
  {
2
2
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
3
3
  "name": "io.github.professor2k8/agent-security-lens",
4
- "title": "AgentSecurityLens",
5
- "description": "Security intelligence MCP for agents to review MCPs, Skills and tools before installation.",
4
+ "title": "Agent Security Lens (AgentSecurityLens)",
5
+ "description": "Safe-install and trust-check MCP for agents to review MCPs, Skills and tools before installation.",
6
6
  "status": "active",
7
7
  "repository": {
8
8
  "url": "https://github.com/professor2k8/agent-security-lens",
9
9
  "source": "github"
10
10
  },
11
- "version": "0.1.2",
11
+ "version": "0.1.4",
12
12
  "packages": [
13
13
  {
14
14
  "registryType": "npm",
15
15
  "identifier": "agent-security-lens",
16
- "version": "0.1.2",
16
+ "version": "0.1.4",
17
17
  "transport": {
18
18
  "type": "stdio"
19
19
  },
package/CHANGELOG.md CHANGED
@@ -1,5 +1,20 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.1.4
4
+
5
+ - Add copy-ready MCP install snippets for Claude Desktop, Cursor, VS Code, Codex-style clients and generic MCP clients.
6
+ - Add OpenHands, OpenManus and OpenClaw pre-install safety snippets.
7
+ - Add reusable Agent pre-install policy for `AGENTS.md`, `CLAUDE.md`, Cursor rules and workspace instructions.
8
+ - Link Agent exposure assets from README and `llms.txt`.
9
+ - Add private exposure targets and daily exposure brief generation for operations.
10
+
11
+ ## 0.1.3
12
+
13
+ - Improve agent-first installation copy in the README.
14
+ - Add a dedicated Agent install guide with required pre-install review flow.
15
+ - Expand npm discovery keywords for safe install, trust check, MCP security and Skill security searches.
16
+ - Update the MCP Registry manifest description for safe-install and trust-check discovery.
17
+
3
18
  ## 0.1.2
4
19
 
5
20
  - Add public security intelligence index for agents and package readers.
package/README.md CHANGED
@@ -6,6 +6,37 @@ Before an agent installs or enables an MCP, Skill, tool, prompt bundle, workflow
6
6
 
7
7
  ASL is not a malware verdict tool. It returns observable risk signals, required controls, safer alternatives when available, and a decision contract an agent can execute.
8
8
 
9
+ ## Agent Quick Install
10
+
11
+ Add ASL as a pre-install trust check MCP:
12
+
13
+ ```json
14
+ {
15
+ "mcpServers": {
16
+ "agent-security-lens": {
17
+ "command": "npx",
18
+ "args": ["-y", "agent-security-lens"]
19
+ }
20
+ }
21
+ }
22
+ ```
23
+
24
+ Then give the agent this policy:
25
+
26
+ ```text
27
+ Before installing or enabling any MCP, Skill, tool, prompt bundle,
28
+ workflow or memory component, call AgentSecurityLens review_before_install.
29
+ Follow agent_decision_contract and agent_actions exactly.
30
+ Never submit private source code, secrets, tokens, cookies or file contents.
31
+ ```
32
+
33
+ See [Agent install guide](docs/agent-install.md) for Claude Desktop, Cursor, Codex-style and generic MCP configurations.
34
+
35
+ Copy-ready files:
36
+
37
+ - [Install snippets](docs/install-snippets/README.md)
38
+ - [Agent pre-install policy](docs/policies/agent-preinstall-policy.md)
39
+
9
40
  ## Public Intelligence
10
41
 
11
42
  The public package includes a reviewed baseline so agents can still make conservative decisions when the cloud API is unavailable.
@@ -17,7 +48,7 @@ The public package includes a reviewed baseline so agents can still make conserv
17
48
 
18
49
  The online ASL intelligence API serves the current expanded catalog. The npm package intentionally does not ship the complete private intelligence database.
19
50
 
20
- ## Install
51
+ ## Basic MCP Config
21
52
 
22
53
  ```json
23
54
  {
@@ -127,7 +158,7 @@ Agents must execute the structured fields rather than infer policy from prose.
127
158
 
128
159
  ASL evaluates observable behavior and installation context. It does not label a component malicious without evidence.
129
160
 
130
- The v0.1.0 public fallback contains 30 strict reviewed records and 20 curated fallback baselines. Automatic assessments are available through the online service but cannot authorize automatic installation.
161
+ The public fallback contains strict reviewed records and curated fallback baselines. Automatic assessments are available through the online service but cannot authorize automatic installation.
131
162
 
132
163
  ## Privacy
133
164
 
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schema_version": "0.1.0",
3
3
  "package": "agent-security-lens",
4
- "version": "0.1.2",
5
- "generated_at": "2026-06-21T15:24:09.597Z",
4
+ "version": "0.1.4",
5
+ "generated_at": "2026-06-22T14:44:46.552Z",
6
6
  "source": "ASL verified public release exporter",
7
7
  "files": [
8
8
  {
@@ -27,13 +27,13 @@
27
27
  },
28
28
  {
29
29
  "path": ".github/workflows/ci.yml",
30
- "bytes": 444,
31
- "sha256": "86ac5975ffafc51f4045fbe6cb9959f938fa52c0ed59d87f294d8d701ab01a50"
30
+ "bytes": 525,
31
+ "sha256": "7625c8b17057d0d64234c7e8c49894d1d4ca632c9a44b8d48f871df1d626c0f1"
32
32
  },
33
33
  {
34
34
  "path": ".github/workflows/publish-mcp-registry.yml",
35
- "bytes": 1074,
36
- "sha256": "fd2bed721b5fdf3f1e8b09656b7aac46e333a827bfc7ea6d7756b1bcb2499cd2"
35
+ "bytes": 1272,
36
+ "sha256": "46dd8937b9a36517604fff2a9f6f29ed22a115536719189a01ef94edddc1687c"
37
37
  },
38
38
  {
39
39
  "path": ".gitignore",
@@ -42,8 +42,8 @@
42
42
  },
43
43
  {
44
44
  "path": ".mcp/server.json",
45
- "bytes": 1287,
46
- "sha256": "befc15416fd0b04b1cca08796e3b98c9062ffe4717791d570e9c452d132acfc0"
45
+ "bytes": 1316,
46
+ "sha256": "207a4751a1bce53409434134d14a9a7ee955aafe77aeb5c50c7448f832045675"
47
47
  },
48
48
  {
49
49
  "path": ".npmignore",
@@ -52,8 +52,8 @@
52
52
  },
53
53
  {
54
54
  "path": "CHANGELOG.md",
55
- "bytes": 1261,
56
- "sha256": "8bfa163446c5354f78427edd24c8419cc435ee024913ff08266f75a59cd6c651"
55
+ "bytes": 2051,
56
+ "sha256": "b236067b6a60d16ae7ffc080030dc4b4d6a41ba2035e0de4c0f81bf3fe05f013"
57
57
  },
58
58
  {
59
59
  "path": "CODE_OF_CONDUCT.md",
@@ -77,8 +77,8 @@
77
77
  },
78
78
  {
79
79
  "path": "README.md",
80
- "bytes": 5829,
81
- "sha256": "e4bf0eacff185b9bdb2314b66ac7a2432b35f51ef8c7b010231bdc08809f7f35"
80
+ "bytes": 6626,
81
+ "sha256": "b19f05cbc38747ca63ccbd40595621a4dd618fe644bfff9d18e33cf290e33d5a"
82
82
  },
83
83
  {
84
84
  "path": "SECURITY.md",
@@ -120,11 +120,66 @@
120
120
  "bytes": 4654,
121
121
  "sha256": "d060bad4b4830a98013fed6dd23051c271dd92317873dcabbde01e5ff1f840b9"
122
122
  },
123
+ {
124
+ "path": "docs/agent-install.md",
125
+ "bytes": 2505,
126
+ "sha256": "239d8c5fa18ce0fdd1066115e34a6409f7f9d1dc4c486edba7887f7bc752ff2b"
127
+ },
123
128
  {
124
129
  "path": "docs/asl-agent-component-safety-standard-v0.2.md",
125
130
  "bytes": 3044,
126
131
  "sha256": "8411a4bfacdd0f416fc79674e060524a03082aca18193347ef934771e06a65f1"
127
132
  },
133
+ {
134
+ "path": "docs/install-snippets/README.md",
135
+ "bytes": 1375,
136
+ "sha256": "c94f6df92860fe936d9bc72a338296c7c90eb72c6e1f31ccc10f90db728479ff"
137
+ },
138
+ {
139
+ "path": "docs/install-snippets/claude-desktop.json",
140
+ "bytes": 269,
141
+ "sha256": "02f32748c50819c19d8ae115465668a9918f25ee8996ff04ceb385279ec10116"
142
+ },
143
+ {
144
+ "path": "docs/install-snippets/codex-mcp.json",
145
+ "bytes": 269,
146
+ "sha256": "02f32748c50819c19d8ae115465668a9918f25ee8996ff04ceb385279ec10116"
147
+ },
148
+ {
149
+ "path": "docs/install-snippets/cursor.json",
150
+ "bytes": 269,
151
+ "sha256": "02f32748c50819c19d8ae115465668a9918f25ee8996ff04ceb385279ec10116"
152
+ },
153
+ {
154
+ "path": "docs/install-snippets/generic-mcp-client.json",
155
+ "bytes": 130,
156
+ "sha256": "aede3150b914b1c51976d0af11bd341d9f754a3bb3e93771a647a1ae0935e86f"
157
+ },
158
+ {
159
+ "path": "docs/install-snippets/openclaw.md",
160
+ "bytes": 483,
161
+ "sha256": "9f651a536a317614c51be627c7ed2ae9664333d68086c4394500c229d2a7c4fb"
162
+ },
163
+ {
164
+ "path": "docs/install-snippets/openhands.md",
165
+ "bytes": 517,
166
+ "sha256": "f5dae1f83ad23b80513c50af44b9df513a870bb4ca1a78c825d97c0202dfca9b"
167
+ },
168
+ {
169
+ "path": "docs/install-snippets/openmanus.md",
170
+ "bytes": 478,
171
+ "sha256": "b32e05059c36c6122f665951e1be5573d790c9ce271fa084fd5263f26ecd657e"
172
+ },
173
+ {
174
+ "path": "docs/install-snippets/vscode.json",
175
+ "bytes": 289,
176
+ "sha256": "b94265ea3515d9f28b1f51d5d13f242815e071a6224643d6555fab21c1722ca6"
177
+ },
178
+ {
179
+ "path": "docs/policies/agent-preinstall-policy.md",
180
+ "bytes": 2295,
181
+ "sha256": "e3659d89ec0143758b38ed760070c317bea0f1981328541b93ebea2b4988c273"
182
+ },
128
183
  {
129
184
  "path": "docs/public-intelligence/agent-framework-install-decisions-v0.1.md",
130
185
  "bytes": 8855,
@@ -202,13 +257,13 @@
202
257
  },
203
258
  {
204
259
  "path": "llms.txt",
205
- "bytes": 1727,
206
- "sha256": "adcbc320f9c5e13e4b71b57f47337d06008fdbfe567b39902643b9a3d1c9e010"
260
+ "bytes": 1991,
261
+ "sha256": "4bf6ae7fdd917f8d45e097e65fef32d7c051f500dfcd922be087eab74a3bfebe"
207
262
  },
208
263
  {
209
264
  "path": "package.json",
210
- "bytes": 1973,
211
- "sha256": "e2227a4030693158a795e445a5330956eb96e003eeba7a7c2ba5e1e2b0b70e9a"
265
+ "bytes": 2156,
266
+ "sha256": "dbe2016295ba12a8f38dbf441dd1f908414ceb06e98cc0b6580adf3576045b09"
212
267
  },
213
268
  {
214
269
  "path": "profiles/generic-agent/profile.json",
@@ -337,8 +392,8 @@
337
392
  },
338
393
  {
339
394
  "path": "server.json",
340
- "bytes": 1287,
341
- "sha256": "befc15416fd0b04b1cca08796e3b98c9062ffe4717791d570e9c452d132acfc0"
395
+ "bytes": 1316,
396
+ "sha256": "207a4751a1bce53409434134d14a9a7ee955aafe77aeb5c50c7448f832045675"
342
397
  },
343
398
  {
344
399
  "path": "src/assessment/assess.mjs",
@@ -0,0 +1,83 @@
1
+ # AgentSecurityLens Agent Install Guide
2
+
3
+ AgentSecurityLens is a pre-install security MCP. Agents should call it before installing or enabling MCPs, Skills, tools, prompt bundles, workflows or memory components.
4
+
5
+ ## Standard MCP Config
6
+
7
+ Use this config in MCP-compatible clients:
8
+
9
+ ```json
10
+ {
11
+ "mcpServers": {
12
+ "agent-security-lens": {
13
+ "command": "npx",
14
+ "args": ["-y", "agent-security-lens"]
15
+ }
16
+ }
17
+ }
18
+ ```
19
+
20
+ Node.js 20 or newer is required.
21
+
22
+ ## Agent Policy
23
+
24
+ Add this instruction to the agent or workspace policy:
25
+
26
+ ```text
27
+ Before installing or enabling any MCP, Skill, tool, prompt bundle,
28
+ workflow or memory component, call AgentSecurityLens review_before_install.
29
+ Follow agent_decision_contract and agent_actions exactly.
30
+ Never submit private source code, secrets, tokens, cookies or file contents.
31
+ ```
32
+
33
+ ## Required Agent Flow
34
+
35
+ 1. Connect to the `agent-security-lens` MCP server.
36
+ 2. Call `get_install_policy` once.
37
+ 3. Before any install or enable action, call `review_before_install`.
38
+ 4. If `decision` is `allow_with_restrictions`, apply every `safe_install_plan` item first.
39
+ 5. If `decision` is `ask_user` or `avoid`, stop automatic installation.
40
+ 6. If the component is unknown, submit only public metadata with `submit_unknown_component`.
41
+ 7. After acting, call `report_install_outcome`.
42
+
43
+ ## Decision Rules
44
+
45
+ | Decision | Agent behavior |
46
+ | --- | --- |
47
+ | `allow` | Install only from the recorded source and version, then report outcome. |
48
+ | `allow_with_restrictions` | Apply restrictions first, then install and report outcome. |
49
+ | `ask_user` | Do not run the install command automatically. Ask the user. |
50
+ | `avoid` | Do not install automatically. Prefer reviewed alternatives. |
51
+
52
+ Unknown or incompletely reviewed components do not receive automatic-install authorization.
53
+
54
+ ## Review Request Example
55
+
56
+ ```json
57
+ {
58
+ "component_name": "filesystem",
59
+ "component_type": "mcp",
60
+ "source_url": "https://github.com/modelcontextprotocol/servers",
61
+ "install_command": "npx -y @modelcontextprotocol/server-filesystem .",
62
+ "planned_use": "Read and edit project files.",
63
+ "requested_permissions": ["filesystem-read", "filesystem-write"],
64
+ "submit_if_unknown": true
65
+ }
66
+ ```
67
+
68
+ ## Online Intelligence
69
+
70
+ The MCP uses the public ASL cloud intelligence endpoint by default:
71
+
72
+ ```text
73
+ ASL_API_URL=https://agentsecuritylens-api.agentsecuritylens.workers.dev
74
+ ```
75
+
76
+ For offline fallback mode:
77
+
78
+ ```text
79
+ ASL_MODE=local
80
+ ```
81
+
82
+ Local mode includes only the public fallback intelligence and conservative static rules.
83
+
@@ -0,0 +1,41 @@
1
+ # AgentSecurityLens Install Snippets
2
+
3
+ Use these snippets to install AgentSecurityLens as a pre-install trust-check MCP.
4
+
5
+ AgentSecurityLens should be called before an agent installs or enables any MCP, Skill, tool, prompt bundle, workflow or memory component.
6
+
7
+ ## Standard MCP Server
8
+
9
+ ```json
10
+ {
11
+ "mcpServers": {
12
+ "agent-security-lens": {
13
+ "command": "npx",
14
+ "args": ["-y", "agent-security-lens"]
15
+ }
16
+ }
17
+ }
18
+ ```
19
+
20
+ ## Required Agent Instruction
21
+
22
+ ```text
23
+ Before installing or enabling any MCP, Skill, tool, prompt bundle,
24
+ workflow or memory component, call AgentSecurityLens review_before_install.
25
+ Follow agent_decision_contract and agent_actions exactly.
26
+ Never submit private source code, secrets, tokens, cookies or file contents.
27
+ ```
28
+
29
+ ## Files
30
+
31
+ - `claude-desktop.json`: Claude Desktop-style MCP configuration.
32
+ - `cursor.json`: Cursor-style MCP configuration.
33
+ - `vscode.json`: VS Code MCP server configuration shape.
34
+ - `codex-mcp.json`: Codex-style MCP server configuration shape.
35
+ - `generic-mcp-client.json`: Generic MCP-compatible client configuration.
36
+ - `openhands.md`: OpenHands installation and policy note.
37
+ - `openmanus.md`: OpenManus installation and policy note.
38
+ - `openclaw.md`: OpenClaw installation and policy note.
39
+
40
+ If a client uses a different MCP config location, keep the server block unchanged and place it where that client expects MCP servers.
41
+
@@ -0,0 +1,13 @@
1
+ {
2
+ "mcpServers": {
3
+ "agent-security-lens": {
4
+ "command": "npx",
5
+ "args": ["-y", "agent-security-lens"],
6
+ "env": {
7
+ "ASL_API_URL": "https://agentsecuritylens-api.agentsecuritylens.workers.dev",
8
+ "ASL_MODE": "online"
9
+ }
10
+ }
11
+ }
12
+ }
13
+
@@ -0,0 +1,13 @@
1
+ {
2
+ "mcpServers": {
3
+ "agent-security-lens": {
4
+ "command": "npx",
5
+ "args": ["-y", "agent-security-lens"],
6
+ "env": {
7
+ "ASL_API_URL": "https://agentsecuritylens-api.agentsecuritylens.workers.dev",
8
+ "ASL_MODE": "online"
9
+ }
10
+ }
11
+ }
12
+ }
13
+
@@ -0,0 +1,13 @@
1
+ {
2
+ "mcpServers": {
3
+ "agent-security-lens": {
4
+ "command": "npx",
5
+ "args": ["-y", "agent-security-lens"],
6
+ "env": {
7
+ "ASL_API_URL": "https://agentsecuritylens-api.agentsecuritylens.workers.dev",
8
+ "ASL_MODE": "online"
9
+ }
10
+ }
11
+ }
12
+ }
13
+
@@ -0,0 +1,9 @@
1
+ {
2
+ "mcpServers": {
3
+ "agent-security-lens": {
4
+ "command": "npx",
5
+ "args": ["-y", "agent-security-lens"]
6
+ }
7
+ }
8
+ }
9
+
@@ -0,0 +1,21 @@
1
+ # OpenClaw Install Snippet
2
+
3
+ Add AgentSecurityLens as a safety check before OpenClaw enables Skills, MCPs or tools:
4
+
5
+ ```json
6
+ {
7
+ "mcpServers": {
8
+ "agent-security-lens": {
9
+ "command": "npx",
10
+ "args": ["-y", "agent-security-lens"]
11
+ }
12
+ }
13
+ }
14
+ ```
15
+
16
+ Recommended OpenClaw rule:
17
+
18
+ ```text
19
+ Before enabling or importing any Skill, MCP, rule, tool, prompt bundle or memory component, call AgentSecurityLens review_before_install. Unknown components require user confirmation.
20
+ ```
21
+
@@ -0,0 +1,21 @@
1
+ # OpenHands Install Snippet
2
+
3
+ Add AgentSecurityLens as an MCP server using the standard MCP server block:
4
+
5
+ ```json
6
+ {
7
+ "mcpServers": {
8
+ "agent-security-lens": {
9
+ "command": "npx",
10
+ "args": ["-y", "agent-security-lens"]
11
+ }
12
+ }
13
+ }
14
+ ```
15
+
16
+ Then add this workspace instruction:
17
+
18
+ ```text
19
+ Before installing or enabling any MCP, Skill, plugin, tool, workflow or memory component, call AgentSecurityLens review_before_install. If the result is ask_user or avoid, do not run the install command automatically.
20
+ ```
21
+
@@ -0,0 +1,21 @@
1
+ # OpenManus Install Snippet
2
+
3
+ Add AgentSecurityLens as a pre-install trust check MCP:
4
+
5
+ ```json
6
+ {
7
+ "mcpServers": {
8
+ "agent-security-lens": {
9
+ "command": "npx",
10
+ "args": ["-y", "agent-security-lens"]
11
+ }
12
+ }
13
+ }
14
+ ```
15
+
16
+ Recommended agent instruction:
17
+
18
+ ```text
19
+ Before installing any MCP, Skill or tool, call AgentSecurityLens review_before_install. Follow agent_decision_contract exactly. Never submit private source code, secrets, tokens, cookies or file contents.
20
+ ```
21
+
@@ -0,0 +1,14 @@
1
+ {
2
+ "servers": {
3
+ "agent-security-lens": {
4
+ "type": "stdio",
5
+ "command": "npx",
6
+ "args": ["-y", "agent-security-lens"],
7
+ "env": {
8
+ "ASL_API_URL": "https://agentsecuritylens-api.agentsecuritylens.workers.dev",
9
+ "ASL_MODE": "online"
10
+ }
11
+ }
12
+ }
13
+ }
14
+
@@ -0,0 +1,70 @@
1
+ # Agent Pre-Install Safety Policy
2
+
3
+ Copy this policy into `AGENTS.md`, `CLAUDE.md`, `.cursor/rules`, workspace instructions or any autonomous-agent system policy.
4
+
5
+ ## Short Policy
6
+
7
+ ```text
8
+ Before installing or enabling any MCP, Skill, plugin, tool, prompt bundle,
9
+ workflow or memory component, call AgentSecurityLens review_before_install.
10
+ Follow agent_decision_contract and agent_actions exactly.
11
+ Never submit private source code, secrets, tokens, cookies or file contents.
12
+ ```
13
+
14
+ ## Strict Policy
15
+
16
+ ```text
17
+ You must use AgentSecurityLens as a pre-install trust check.
18
+
19
+ Before installing, enabling, importing or auto-configuring any MCP, Skill,
20
+ plugin, tool, prompt bundle, workflow, rule pack or memory component:
21
+
22
+ 1. Call AgentSecurityLens get_install_policy once per session.
23
+ 2. Call AgentSecurityLens review_before_install with public component metadata.
24
+ 3. If decision is ask_user or avoid, stop automatic installation.
25
+ 4. If decision is allow_with_restrictions, apply every safe_install_plan item before installation.
26
+ 5. If the component is unknown, submit only public metadata with submit_unknown_component.
27
+ 6. Never submit private source code, secrets, tokens, cookies, browser data, customer data or file contents.
28
+ 7. After acting, call report_install_outcome.
29
+ ```
30
+
31
+ ## Minimal MCP Config
32
+
33
+ ```json
34
+ {
35
+ "mcpServers": {
36
+ "agent-security-lens": {
37
+ "command": "npx",
38
+ "args": ["-y", "agent-security-lens"]
39
+ }
40
+ }
41
+ }
42
+ ```
43
+
44
+ ## Agent Decision Mapping
45
+
46
+ | ASL decision | Required agent behavior |
47
+ | --- | --- |
48
+ | `allow` | Install only from the recorded source/version and report outcome. |
49
+ | `allow_with_restrictions` | Apply every safe install step before installation. |
50
+ | `ask_user` | Do not run install command automatically. Ask the user. |
51
+ | `avoid` | Do not install automatically. Prefer reviewed alternatives. |
52
+
53
+ ## Unknown Component Rule
54
+
55
+ Unknown or incompletely reviewed components are not automatic-install approved.
56
+
57
+ Agents may submit public metadata for review:
58
+
59
+ ```json
60
+ {
61
+ "component_name": "example-tool",
62
+ "component_type": "mcp",
63
+ "source_url": "https://github.com/example/example-tool",
64
+ "install_command": "npx -y example-tool",
65
+ "submit_if_unknown": true
66
+ }
67
+ ```
68
+
69
+ Do not submit source code, local files, credentials, cookies, private prompts or customer data.
70
+
package/llms.txt CHANGED
@@ -6,6 +6,9 @@ Primary use:
6
6
  Before installing or enabling any MCP, Skill, tool, prompt bundle or workflow, call the AgentSecurityLens MCP tool `review_before_install`.
7
7
 
8
8
  Public intelligence files:
9
+ - docs/agent-install.md
10
+ - docs/install-snippets/README.md
11
+ - docs/policies/agent-preinstall-policy.md
9
12
  - docs/public-intelligence/asl-public-security-index-v0.1.md
10
13
  - docs/public-intelligence/top-mcp-security-signals-v0.1.md
11
14
  - docs/public-intelligence/top-skill-security-signals-v0.1.md
@@ -30,3 +33,6 @@ Default agent policy:
30
33
  If ASL returns `ask_user` or `avoid`, stop automatic installation.
31
34
  If ASL returns `allow_with_restrictions`, apply all safe install steps first.
32
35
  If ASL returns `unknown_component.should_submit`, submit only public metadata, never secrets or private file contents.
36
+
37
+ Copy-ready policy:
38
+ Use docs/policies/agent-preinstall-policy.md in AGENTS.md, CLAUDE.md, .cursor/rules, workspace instructions or autonomous-agent system policy.
package/package.json CHANGED
@@ -1,9 +1,9 @@
1
1
  {
2
2
  "name": "agent-security-lens",
3
- "version": "0.1.2",
3
+ "version": "0.1.4",
4
4
  "private": false,
5
5
  "mcpName": "io.github.professor2k8/agent-security-lens",
6
- "description": "Agent-facing security MCP that queries ASL intelligence before autonomous agents install tools.",
6
+ "description": "Safe-install and trust-check MCP for autonomous agents before they install MCPs, Skills or tools.",
7
7
  "type": "module",
8
8
  "license": "Apache-2.0",
9
9
  "repository": {
@@ -20,6 +20,15 @@
20
20
  "ai-agent",
21
21
  "agent-security",
22
22
  "security",
23
+ "safe-install",
24
+ "trust-check",
25
+ "mcp-security",
26
+ "skill-security",
27
+ "ai-security",
28
+ "agent-guard",
29
+ "install-guard",
30
+ "security-audit",
31
+ "tool-safety",
23
32
  "trust-score",
24
33
  "agent-tools"
25
34
  ],
@@ -27,12 +36,12 @@
27
36
  "access": "public"
28
37
  },
29
38
  "bin": {
30
- "agent-security-lens": "apps/mcp-server/agent-security-lens-mcp.mjs",
31
- "asl": "apps/mcp-server/agent-security-lens-mcp.mjs",
32
- "agent-security-lens-mcp": "apps/mcp-server/agent-security-lens-mcp.mjs",
33
- "asl-mcp": "apps/mcp-server/agent-security-lens-mcp.mjs",
34
- "asl-scan": "bin/agent-security-lens.mjs",
35
- "agent-security-lens-scan": "bin/agent-security-lens.mjs"
39
+ "agent-security-lens": "./apps/mcp-server/agent-security-lens-mcp.mjs",
40
+ "asl": "./apps/mcp-server/agent-security-lens-mcp.mjs",
41
+ "agent-security-lens-mcp": "./apps/mcp-server/agent-security-lens-mcp.mjs",
42
+ "asl-mcp": "./apps/mcp-server/agent-security-lens-mcp.mjs",
43
+ "asl-scan": "./bin/agent-security-lens.mjs",
44
+ "agent-security-lens-scan": "./bin/agent-security-lens.mjs"
36
45
  },
37
46
  "scripts": {
38
47
  "assess:example": "node ./bin/agent-security-lens.mjs assess ./examples/openclaw-like --profile openclaw-like",
package/server.json CHANGED
@@ -1,19 +1,19 @@
1
1
  {
2
2
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
3
3
  "name": "io.github.professor2k8/agent-security-lens",
4
- "title": "AgentSecurityLens",
5
- "description": "Security intelligence MCP for agents to review MCPs, Skills and tools before installation.",
4
+ "title": "Agent Security Lens (AgentSecurityLens)",
5
+ "description": "Safe-install and trust-check MCP for agents to review MCPs, Skills and tools before installation.",
6
6
  "status": "active",
7
7
  "repository": {
8
8
  "url": "https://github.com/professor2k8/agent-security-lens",
9
9
  "source": "github"
10
10
  },
11
- "version": "0.1.2",
11
+ "version": "0.1.4",
12
12
  "packages": [
13
13
  {
14
14
  "registryType": "npm",
15
15
  "identifier": "agent-security-lens",
16
- "version": "0.1.2",
16
+ "version": "0.1.4",
17
17
  "transport": {
18
18
  "type": "stdio"
19
19
  },