razuba

We've been using OpenShell for a while - now enabling ourselves and other teams do this in a batteries-included kinda way. I've been working on a layer above it that also manages team policies, safe git usage (in case you don't want your agent to always have the same access as your user account), and SCA/SAST built in. Curious to see how others are dealing with these issues. The agent traces I've seen are wild and goal seeking without a boundary is real.

We have just under 17k analyzed. Agreed on the need for an Armor1 MCP server to support this - stay tuned.

We focus on a holistic risk analysis of the risks that would matter to a security engineer. For example, all the signals analyzed to ensure the MCP server is official and provided by the vendor directly is something that is not found elsewhere. In addition, we have focused on ensuring false positives are minimal or non-existent so you can focus on the true risks.

So with the mix of static and dynamic analysis, MCP protocol conformance, supply chain vulnerability analysis, and MCP specific risk factors we curate a relevant risk score allowing you decide if the usage of a given MCP server is introducing unnecessary risk or not.