BackBond Agent Scan · pinned v0.5.10

Vet an MCP tool before you attach it.

npx -y @backbond/agent-scan@0.5.10 vet-tools --stdin < tools-list.json

1 = block·3 = review·0 = scoped result

Requires: a real MCP tools/list response saved as tools-list.json in the current folder. No file yet? Run npx -y @backbond/agent-scan@0.5.10 scan instead. Static metadata pre-screen only; not a certificate, runtime attestation, insurance decision, or coverage.

BackBond Agent Scan checks tool metadata and dangerous tool combinations locally, then returns one honest decision: block, review, or no blocking finding.

Version 0.5.10 adds a strict committed-manifest Action mode and review-only remediation templates. The public ruleset remains backbond-local-rules/1.3.0.

Run the pinned scanner Read the 13 public rules
No tool executionNo scanner network pathNo runtime dependenciesReproducible releaseExact version pinned

Verify before execution

Public source reproduces the published bytes.

Package tarball

git clone --depth 1 --branch v0.5.10 https://github.com/BackBond/agent-scan.git
cd agent-scan && npm pack && sha256sum backbond-agent-scan-0.5.10.tgz

Expected SHA-256: 4fe88368738dbb25660b88f8a86394e893d02d783d2e3c6ecec42dc778a1e28e

Standalone file

node scripts/build-standalone.js agent-scan.cjs
sha256sum agent-scan.cjs

Expected SHA-256: e0be86c4aa45f97d474eddf87cde95d636a4d86fde3e6a6fd112b4de4e1732b2

Release and checksum files Build provenance

Reproducibility connects the public tag to the released files. It does not turn scan output into runtime verification, certification, or insurance coverage.

pre-attachment check · local process
$ npx -y @backbond/agent-scan@0.5.10 \
    vet-tools --stdin < tools-list.json

BLOCK — 3 blocking findings
BB013 always_use_mail_sync [derived]
  Stop: Do not attach a tool that tries to force
  its own selection or invocation.

BB007 run_command [derived]
  Stop: Disable the executor or constrain accepted
  commands before attachment.

Potential path: EP003
untrusted input → tool selection → shell execution

Output that tells the agent what to stop doing.

Finding IDs stay stable across local scans and CI. Derived findings are labeled as triage. Missing evidence returns review instead of a false pass.

What it sees

The exposure created by tools, descriptions, and composition.

01

Dangerous capability

Flags unconstrained shell, code, SQL, URL, filesystem, credential, and persistence surfaces in supplied tool schemas and known agent configuration.

02

Tool-description manipulation

Looks for instruction override, concealment, sensitive-data solicitation, and forced-invocation language before a proposed tool enters the agent context. BB013 is derived: distinguish scoped guidance such as “always use this tool for weather” from metadata demanding invocation before any reply.

03

Toxic composition

Surfaces combinations such as untrusted retrieval alongside privileged execution, so an orchestrator can split the work before delegation.

04

Unknown coverage

Opaque schemas, mixed manifest dialects, confusable names, and missing runtime inventory produce review or inconclusive results, not a confident zero.

Three outcomes

A gate an agent can use without pretending it proved safety.

Blockexit 1

A blocking rule fired. Do not attach automatically; remove, constrain, or isolate the named tool.

Reviewexit 3

The evidence is incomplete or ambiguous. Stop unknown and obtain a better tool manifest or a human decision.

No blocking findingexit 0

No configured blocking rule fired on the supplied metadata. This is scoped static output, not a safety or insurance determination.

Data boundary

Your raw tool list stays on the machine running the scanner.

Safe to share

  • Compact vet-tools text after redacting sensitive tool names
  • The compact card written by --record-public
  • Exact package version, exit code, operating system, and shell

Keep private

  • Raw tools-list.json, prompts, traces, and agent configuration
  • --json output or receipts containing paths and input fingerprints
  • Secret values, raw tool arguments, file bodies, and internal topology

For gateways and platform teams

Gate a committed manifest before listing or merging it.

backbond-schema.yml · pinned Action
permissions:
  contents: read

steps:
  - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
  - uses: BackBond/agent-scan@v0.5.10
    with:
      mode: vet-tools
      tool-schema: tools-list.json

One strict decision at the chokepoint.

Configure workflow path filters for tools-list.json, mcp.json, or the repository’s actual manifest path. The Action checks the committed file, preserves exit 0, 1, or 3, and creates no public record in this mode.

A passing workflow covers the committed file at this SHA, not production state, independent verification, or coverage.

Run 0.5.10

Use the path your environment already trusts.

No tools-list.json yet

npx -y @backbond/agent-scan@0.5.10 scan

Use the discovery scan first. vet-tools needs an actual captured MCP tools/list response; it cannot create that file for you.

POSIX shell

npx -y @backbond/agent-scan@0.5.10 vet-tools --stdin < tools-list.json

PowerShell (file already saved)

if (Test-Path .\tools-list.json) { Get-Content -Raw .\tools-list.json | npx -y @backbond/agent-scan@0.5.10 vet-tools --stdin } else { Write-Error "Save a real MCP tools/list response as tools-list.json first." }

This guard stops before npx when the file is missing. You can also provide the file's full path.

Network-isolated host

Verify the official agent-scan.cjs checksum on a trusted host, transfer it through the approved software path, then run: node agent-scan.cjs vet-tools --stdinRelease assets

Agent Skill

Install the version-pinned SKILL.md at .agents/skills/agent-scan/SKILL.mdPinned skill

If the package never starts, report scan_not_run—never a scanner decision. Check Node.js 18+, the exact 0.5.10 pin, the input file, and the shell-specific piping form. Use the ten-line install-failure playbook.

Found and attempted this command without direct outreach? Agent Scan has no telemetry. You may voluntarily report five privacy-safe fields: pin started, decision, whether attachment changed, OS/Node, and a sanitized false positive. Do not submit raw or identifying scan material.

Static exposure is the first layer, not the whole answer.

The open scanner helps an agent or developer identify dangerous metadata and tool combinations before attachment. It does not observe what happens after deployment.

Running this package does not create insurance coverage, determine eligibility, or imply that BackBond has verified the environment.

BackBond’s full solution is built around deeper assessment, continuous runtime evidence from the listener, and, where approved, financial protection.

Found an exposure path you cannot see at runtime?

Tell us what kind of agent you are deploying and what evidence a human, risk owner, or insurer would need before trusting it.

Do not email a tool manifest, trace, prompt, configuration, secret, or scan report.

Email BackBond