Use case · Rune Gurd + Rune Box
Every MCP server an agent connects to is code and text you did not write. Guard inventories them, flags risky configuration, and pins approved tool definitions so a silent change is reported.
The problem
MCP servers are configured per harness and per project, often by copying a snippet: inline API keys, a filesystem server rooted at the home directory, a plain-HTTP remote, or an npx package with no version, so each start can run a different release.
After approval, a server can rename a tool, rewrite its description or widen its schema without anything in the configuration changing. A description can also carry instructions aimed at the model rather than at the user.
How Runewrd Labs helps
guard mcp-inventory reads each harness’s MCP configuration in the home directory and in project directories, and reports transport, command or host, and risky configuration. It never reports secret values, arguments or URL paths.
guard mcp-tools approve records the tools a server exposes; guard mcp-tools check reports tools added, removed, or with a changed description, schema or annotations.
Retrieved definitions are matched against catalog patterns for text that may steer the model. A match is suspicion, not proof of poisoning; approval refuses it until someone has reviewed it.
Harness hooks count MCP tool results as untrusted input in session rules, so a later credential read and upload in the same session completes lethal_trifecta.
runeward mcp exposes Rune Box’s governed tools to any MCP-capable IDE or agent, so each call is policy-checked and audited.
guard scan checks Claude Code plugins, Gemini CLI extensions, skills and their source registries statically. The MCP server inventory reaches the Guard Console as metadata only; tool definitions stay on the device.
In the evidence
Names as they appear in Runeward Labs findings, rules and commands, so you can match this page to real output.
| Identifier | Source | What it means | Status |
|---|---|---|---|
unpinned_package | guard mcp-inventory | A launcher such as npx or uvx fetches a package with no exact version. | |
insecure_transport | guard mcp-inventory | An http:// or ws:// URL to a host other than localhost. | |
inline_secret:FIELD:PATTERN | guard mcp-inventory | An env, header, argument or URL value matches a catalog secret pattern. | |
broad_path:home | guard mcp-inventory | An argument is the home directory (or / for broad_path:root), which includes every credential file. | |
tool_description_changed | guard mcp-tools check | An approved tool’s description or title changed. tool_schema_changed and tool_annotations_changed cover the rest. | |
mcp_credential_file_instruction | Tool poisoning rule | Definition text matches an instruction to read credential files. Related rules include mcp_consent_bypass_instruction and mcp_policy_override_instruction. |
# configured servers across recorded projects guard mcp-inventory --discover # pin a server's tools after review guard mcp-tools approve docs --remote # later: report added, removed or changed tools guard mcp-tools check --remote
Honest limitations
A scan finding shows exposure. A sensor or hook finding shows what an agent attempted, or what was blocked. Neither proves a compromise, and a block decision without a report from the enforcing component doesn’t prove the action was stopped.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.