bastionsupply
scanPre-flight MCP + A2A supply-chain scanner
Detect tool-poisoning, shadowing, hidden unicode, secret solicitation, and rug-pull drift in MCP servers and A2A agent cards before you install or delegate to them.
pip install bastionsupply Offline and zero-dependency; one engine and one injection corpus for MCP servers and A2A cards (compare Cisco’s a2a-scanner, which covers cards only).
What it does
- Static analysis of what an MCP server or A2A agent claims about itself: no LLM, no execution
- Catches tool-poisoning, hidden-unicode & homoglyph names, tool-shadowing, secret solicitation
- Encoded poisoning: decodes base64, hex, binary, base32, ascii85/base85, Morse and escapes before scanning (88% of encoded corpus attacks caught, 0% false positives on the benign traps)
- A2A agent cards: every field scanned for agent-card poisoning, plus insecure or spoofed endpoints (shadow mode: findings capped at medium)
- Rug-pull detection via lock / verify, now pinning whole agent cards too
- CI gate (non-zero exit on critical/high) + harden emits a graded policy; doctor checks policy files against installed tools
Quickstart
bastionsupply scan tools.json
bastionsupply scan --a2a https://agent.example --live
bastionsupply scan --example poisoned-card
Version 0.11.1 · MIT