中文 · English

Try AgentGate in ten minutes

No registration and no credentials. Choose the level of effort that fits you.

Start with your own tool inventory

Paste a list of names or choose a text/JSON file containing names, package identities, and versions. Confirm the matching tool and your actual version in the browser, then download a standalone evidence report. The inventory is not uploaded and the tools are not executed.

Build my inventory report

This compares your input with the snapshot embedded in the page. Missing records, version mismatches, samples, and incomplete evidence remain visible. The report is not a security certification.

1. Install nothing: browse the index

Open the evidence index

Filter by verdict or name, then open a record to inspect its evidence blocks. Use the capture time, sources, and stated coverage. A scheduled refresh does not guarantee every refresh succeeded or that the index covers the full ecosystem.

Query one record

curl -s https://xn--5kvo87g.com/v1/servers/<server-name> | head -40

The response is a record: package identity, evidence blocks, and a verdict of clean, findings, or incomplete. Do not skip unmeasured; it means the material was not checked.

https://xn--5kvo87g.com/badge/<server-name>.svg

2. Scan your own repository

Use Node.js 20 or later. No account is required:

git clone https://github.com/ciceroyang/agentgate
cd agentgate
node packages/guard/bin/agent-guard.mjs /path/to/your/repo --fail-on high

Read the final status first. incomplete means a required check did not finish; it is not a pass.

3. Enforce a policy in CI

{
  "version": "agentgate.policy/v1",
  "threshold": "high",
  "required": { "pinnedPackages": true, "measuredEvidence": ["packageManifest"] },
  "forbidden": { "rules": ["AG-INSTALL-001"], "tools": ["delete_*", "send_money"] }
}

- uses: ciceroyang/agentgate@main
  with:
    policy: agentgate.policy.json
    index: data/index.json

This policy requires package evidence tied to the local npm package identity and exact version. Missing evidence returns incomplete; a historical sample is not a substitute.

Want us to run the review?

We are looking for three companies for a four-week free review. Send a list of MCP server names—not code or credentials—and we will prepare the report. There is no fee; we ask for one one-hour feedback call.

Request a free review