Agent access

Where the gate belongs

Authorized tools/list discovery → complete list → local vet → host decides

Run before definitions enter model context or become callable. An agent checking its own tools is weaker than host enforcement: use the host, gateway, or CI when available. A skill or MCP listing does not install enforcement.

Live discovery requires an initial connection. Authorize and isolate server startup separately. A staged manifest can be checked before connection; compare it with the live list before use. Metadata cannot prove runtime behavior.

Install paths for hosts

Node.js 18+. The host stages software before entering a sandbox. Commands below use a POSIX shell. Preserve existing configuration entries.

1. Host Registry installation

Install exactly io.github.BackBond/agent-scan version 0.6.2, entrypoint agent-scan mcp, through the host's approved installer. Verify the release package before installation:

curl -fLO https://github.com/BackBond/agent-scan/releases/download/v0.6.2/backbond-agent-scan-0.6.2.tgz
curl -fLO https://github.com/BackBond/agent-scan/releases/download/v0.6.2/backbond-agent-scan-0.6.2.tgz.sha256
sha256sum -c backbond-agent-scan-0.6.2.tgz.sha256

Expected package SHA-256: a4f7d720b565b7f7e9f42d24e3ad509e5e9aba4ed4538f724ab74a27e763ac46. The README's egress-enabled configuration is:

{
  "mcpServers": {
    "backbond-agent-scan": {
      "command": "npx",
      "args": ["-y", "@backbond/agent-scan@0.6.2", "mcp"]
    }
  }
}

For no-egress operation, point the host to its preinstalled executable with argument mcp; the npx block alone is not an offline installation. Call vet_tools_before_attach with {"tools": [...]}. It never falls back to discovery.

2. Vendored single file

curl -fLO https://github.com/BackBond/agent-scan/releases/download/v0.6.2/agent-scan.cjs
curl -fLO https://github.com/BackBond/agent-scan/releases/download/v0.6.2/agent-scan.cjs.sha256
sha256sum -c agent-scan.cjs.sha256
node agent-scan.cjs vet-tools --stdin < tools-list.json

Expected standalone SHA-256: 1f1c6cf4c36f2bfd211b31a695d7023186587dd3b0f696eb583af1ea928d1d12. Download on the host, then stage the verified file read-only. No npm is required at runtime. Compare sidecars with these trusted pins, not a hash supplied in an untrusted manifest.

3. CI

Use the pinned workflow and checksum instructions: BackBond/agent-scan@v0.6.2, mode: vet-tools, tool-schema: tools-list.json. CI assesses the committed manifest, not an automatically discovered deployed toolset.

4. npx with egress

npx -y @backbond/agent-scan@0.6.2 vet-tools --stdin < tools-list.json

Verify the v0.6.2 package sidecar above through the host's installation process. npx resolves through npm; it does not itself check the GitHub sidecar. This is the least suitable path for hardened agents. Installation failure means no scan ran; use the staged file without weakening egress controls.

For the synthetic blocking demo, both vet commands exit 1; the clean demo exits 0. These are fixtures, not deployment evidence.

Supply the complete list

{"tools":[{"name":"add","description":"Adds two numbers.","inputSchema":{"type":"object","properties":{"a":{"type":"number"},"b":{"type":"number"}},"required":["a","b"],"additionalProperties":false}}]}

The CLI also accepts the {"jsonrpc":"2.0","result":{"tools":[...]}} wrapper or bare tools array. MCP arguments must be an object with the tools array. Follow every nextCursor and combine pages first; the scanner does not fetch missing pages. CLI intake: 4 MiB per artifact; schema analysis: 64 levels and 10,000 nodes. Oversized input or unfinished pagination must not become approval.

Never send credentials, server URLs, prompts, or traces. Keep the real manifest local.

Handle the actual v0.6.2 output

vet_tools_before_attach returns the vet result directly in structuredContent: decision, scanner, ruleset, profile, summary, coverage, and findings. It does not return a nested record or next_action. Keep full results private. CLI --summary-only emits aggregate review data without tool identities.

The separate scan_my_runtime tool supports emit_record: true for a redacted self-run record. Quote its version, counts, coverage and assurance fields, not raw metadata. When discovery returns next_action, obtain the missing live list through the authorized host; do not invent one. A broader scan record is not proof of attachment enforcement.

• block / 1: do not attach; retain only redacted evidence and a compact operator reason.
• review / 3: do not attach automatically; human review must record who decided and the exact manifest SHA-256.
• no_blocking_finding / 0: continue existing host permission checks; the scanner grants no permission.
• error / 2, timeout, killed process, MCP error, or missing result: not attached. Fail closed.

Bind decisions to the SHA-256 of the exact checked manifest. Re-vet changed names, descriptions, schemas, or lists before use. Pin the scanner digest and ruleset digest bcfa6d47ad68b1fda89b61834fa70dfb7b0e17dcb7d2a8e38d63f045687c492e; refuse mismatches. Bound execution time and input. Keep manifests in host memory; retain only redacted records and local approval metadata.

What not to do

Do not use @latest, send an agent to /try/ to operate the browser demo, or POST a manifest anywhere. The exact npm name is @backbond/agent-scan; the exact Registry name is io.github.BackBond/agent-scan. Search also returns Snyk's product; do not substitute it.

Copyable local skill instructions · Registry entry · npm · GitHub tag · Rules · Discovery card · llms.txt

BackBond is the rating-and-insurance layer for AI agents. Running this package does not create insurance coverage, determine eligibility, or imply that BackBond has verified the environment.