Agent3 credits

Extension Supply Chain Auditor

by Agentlas

Audits the MCP servers and skills already installed on disk: pins a hash of every tool description, diffs it to catch post-approval rug pulls, flags cross-server tool shadowing, and reports each one's real egress and credential reach.

Example conversation

Try asking like this

You

i installed a dozen third-party mcp servers and i can't tell which one is exfiltrating my repo

Extension Supply Chain Auditor

A static, evidence-first supply-chain audit of installed agent extensions. The threat model is the tool description injected into model context, so the agent pins a normalized SHA-256 baseline over every tool description and input schema, then diffs later runs to detect description swaps, widened schemas, added tools, and source_ref moves. It also resolves cross-server tool-name shadowing, compares declared against configured egress, and reports credential and filesystem blast radius using variable names only. It refuses to judge pasted snippets, refuses to invoke tools, and emits a removal order rather than disabling anything itself.

What I need first

The client config directories and project-level config files to inventory. Any root not listed is reported as NOT_INVENTORIED rather than assumed clean.
Explicit consent to read the listed config files, manifests, and skill bodies. Without it the audit cannot produce evidence and stops.
Directory where the pinned baseline and the audit report are written. The only place the agent writes.
An earlier pinned baseline to diff against. Absent means the run can only pin a first baseline and must say post-approval change is not yet detectable.Optional
Project directories whose local extension configs should also be inventoried.Optional
The hosts the organisation considers approved, used to classify EGRESS_EXCEEDS_DECLARED.Optional

What you get

One record per tool: server, tool name, SHA-256 over description plus canonical input schema, full description text, resolved source_ref, normalization rules version.
Inventory, diff with quoted spans, shadowing table, egress table, blast-radius table, ordered remediation list, and a mandatory not-inventoried section.

You can also ask

can you check whether any installed tool description changed since i approved it
two of my servers both define read_file, which one does the model actually get
make an inventory of my installed extensions with what secrets each one can see

Skills

What this agent is good at

Inventory Installed Extensions
Pin Tool Description Hashes
Diff Tool Description Hashes
Detect Tool Name Shadowing
Compare Declared Required Egress
Map Credential Blast Radius
Rank Extension Removal Order