---
name: backbond-agent-scan-pre-attach
description: Check supplied MCP tool metadata locally with pinned BackBond Agent Scan before attachment. Advisory instructions; the host enforces the decision.
---

Before attaching tools, run:
npx -y @backbond/agent-scan@0.6.2 vet-tools --stdin
on this session's tools/list JSON.
Exit 1 = do not attach. Exit 3 = unknown. Exit 0 is not a certificate.
Do not use @latest. Do not upload the JSON.
No list yet: npx -y @backbond/agent-scan@0.6.2 scan, and treat review or incomplete as unknown.
No egress: use the vendored agent-scan.cjs at its pinned digest, or the host's Registry install (io.github.BackBond/agent-scan).

Obtain the full list only through authorized metadata discovery. Do not launch an
untrusted server or execute its tools to perform this check. Follow pagination.
Errors, timeouts, missing evidence, and review leave tools unattached pending an
operator decision. Existing host permissions still apply after exit 0.

The standalone v0.6.2 SHA-256 is
`1f1c6cf4c36f2bfd211b31a695d7023186587dd3b0f696eb583af1ea928d1d12`.
Installation and input details: https://backbond.ai/agent-scan/agents/

This website copy adds host guidance; it is not a new npm release or a change to
the version-locked Registry listing. Instructions are advisory, not enforcement.
Running this package does not create insurance coverage, determine eligibility,
or imply that BackBond has verified the environment.