Your agents
are acting.
Can you prove
what they did?
They read inboxes, call tools, move data and commit changes on their own. When one goes wrong, most teams cannot reconstruct what it saw, decided or touched.
Agents used to suggest. Now they act.
Once something can act on its own, what it did stops being an academic question. “We cannot tell you what the agent did” is a position, and not a good one. No statute needed.
An evidence layer.
And a brake.
One local binary in the path of an agent's actions. Every call reduced to the same shape, attributed to whoever or whatever made it, written to a record a third party can check. The binary that watches is the one that can stop an action before it lands.
None of that ships yet. What exists today is below, with dates. Every factual claim on this site is listed in a public file.
Grade a server before you connect an agent to it.
13 deterministic checks in mcpscan 0.2.1. Same server, same report, every time. No model sits in the decision path, so there is nothing there to prompt-inject.
Nothing leaves your machine unless you send it. Reports are written locally with payload_stored=false. No telemetry.
- 1 server scanned
- 3 findings — 2 CRITICAL, 1 HIGH
- exit 1
A server can tell the scanner what it is for. That can never count in its favour. Nothing a server says about itself makes its own grade better, and a config you copied from that server’s own documentation is not you vouching for it either.
This is 0.1.1, the release current when it was recorded. Most of that 6.33 seconds is the scan itself — spawning the server, the MCP handshake, enumerating what it exposes, then the checks over the result. The process prints nothing for 3.4 of those seconds and then writes the whole report at once, which is why there is no line-by-line replay here.
How far does
a mistake travel?
One agent, one credential, one server. Reach is what turns a small mistake into an incident, and almost nobody has it written down.
Any part can raise suspicion.
No part can grant permission.
This is a commitment about our own design. Its verification is a test obligation against the built system.
Two things here are not proven. Whether the pieces, each safe on its own, can be chained into something none of them would allow alone. And whether someone can deliberately make the system cry wolf, so the people watching it stop listening. Neither can be settled by argument. Both have to be attacked in the real thing, and that has not happened yet.
The map only works if we know which agent did what. Get that attribution wrong and everything built on it is wrong too: the reach it calculates, the suspicion it raises. The identity layer has to be real before anything is allowed to act on the map.
What changed, and when.
Every entry is something that actually happened, including the mistakes. If you want to know whether this is real, read this and not the rest of the page.
mcpscan 0.2.1 on PyPI. Four new checks, and the transcript above stopped reproducing.
0.2.0 went up at 13:20 UTC and 0.2.1 at 13:44. The checks went from nine to thirteen, so the same command against the same config now returns a fourth finding the recording above does not show. The recording is not corrected: it is what 0.1.1 printed, and re-cutting it to match a newer release would make it a re-enactment.
A false claim about EU AI Act record-keeping was found on this page and taken down.
It had been here since the site launched. The obligation moved three weeks before we shipped, nothing in this repository changed when it did, and every check stayed green.
mcpscan recorded against a real MCP config. Grade F, exit 1.
The transcript above is that recording. It replaced a fabricated one.
mcpscan 0.1.1 on PyPI.
mcpscan 0.1.0 on PyPI.
First public release.
Running agents you cannot
fully account for?
We want to hear what you cannot currently answer, and what you are being asked. Early access is a conversation, not a signup form.