MCP servers

Check every MCP server your agents load, notice when a server's tools change, and let each agent call only the MCP tools you grant it.

Scan the servers in your repository
Run this where your MCP config lives (.mcp.json, .cursor/mcp.json, .claude/settings.json, claude_desktop_config.json and similar). It starts no server.
bash
```
agentfox scan mcp
```
For each server you see what it can reach, a version that is not pinned, a token written into env, and a remote server with no auth. Use --config to read a file somewhere else.
Scan the servers on your machine
Most servers are added once to an AI tool, not committed. This reads the user-level configs of Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Cline, Gemini CLI and Codex, plus installed skills. It writes nothing and never prints an env value.
bash
```
agentfox scan machine
```
Pin each server's version
A server started with npx, uvx or docker and no version runs whatever is newest, so its tools can change after you reviewed them. Pin it in the config: @modelcontextprotocol/server-github@2025.4.8, mcp-server-fetch==2025.4.7, or an image tag other than latest. Write secrets as ${GITHUB_TOKEN}, not the value.
Record each server's tools
Save the server's tools/list response to a file and scan it. Each scan keeps a snapshot, so the next one reports tools changed since the last scan and any instructions hidden in a tool description.
bash
```
agentfox scan mcp github --file github-tools.json
```
Grant the tools each agent may call
MCP tools are named mcp:<server>/<tool>, so two servers' search tools stay apart. A tool nobody granted is refused.
bash
```
agentfox permit grant research-bot mcp:github/search_issues
```
Grant a whole server with mcp:github/* only if every tool on it should be callable. You can also grant from the agent's Access tab; see Tool access.

How calls get checked

Python: wrap your MCP client's call_tool in McpGovernor (Python SDK). Each call is checked before it runs and its result after.
Any language: call POST /v1/guard/tool_call with the tool mcp:<server>/<tool> before you call the server, then send the result to POST /v1/mcp/call to have it checked. See Any language (HTTP).
Claude Code and Codex: the hooks check MCP tools like any other tool. See Claude Code and Codex.

Give an AI client read-only access to AgentFox

agentfox serve mcp serves AgentFox over MCP stdio: issues, agents, policies, simulations and checks. None of its tools changes what is blocked. Add it to your client's config as {"command": "agentfox", "args": ["serve", "mcp"]}. The Claude Code plugin starts it for you.

If something goes wrong

You see	Do this
No MCP servers declared in this directory	Run from the folder with the config, or pass `--config`.
name the server the tool list belongs to	`--file` needs the server name too: `scan mcp github --file …`.
Every call to one server refused with `mcp.schema_drift`	The server changed. Review it, then have two people accept the change.
unknown agent on `permit grant`	Run the agent once so it registers, then grant.

MCP servers

Check every MCP server your agents load, notice when a server's tools change, and let each agent call only the MCP tools you grant it.

Scan the servers in your repository

Run this where your MCP config lives (.mcp.json, .cursor/mcp.json, .claude/settings.json, claude_desktop_config.json and similar). It starts no server.

bash

agentfox scan mcp

For each server you see what it can reach, a version that is not pinned, a token written into env, and a remote server with no auth. Use --config to read a file somewhere else.

Scan the servers on your machine

Most servers are added once to an AI tool, not committed. This reads the user-level configs of Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Cline, Gemini CLI and Codex, plus installed skills. It writes nothing and never prints an env value.

bash

agentfox scan machine

Pin each server's version

A server started with npx, uvx or docker and no version runs whatever is newest, so its tools can change after you reviewed them. Pin it in the config: @modelcontextprotocol/server-github@2025.4.8, mcp-server-fetch==2025.4.7, or an image tag other than latest. Write secrets as ${GITHUB_TOKEN}, not the value.

Record each server's tools

Save the server's tools/list response to a file and scan it. Each scan keeps a snapshot, so the next one reports tools changed since the last scan and any instructions hidden in a tool description.

bash

agentfox scan mcp github --file github-tools.json

Grant the tools each agent may call

MCP tools are named mcp:<server>/<tool>, so two servers' search tools stay apart. A tool nobody granted is refused.

bash

agentfox permit grant research-bot mcp:github/search_issues

Grant a whole server with mcp:github/* only if every tool on it should be callable. You can also grant from the agent's Access tab; see Tool access.

How calls get checked

Python: wrap your MCP client's call_tool in McpGovernor (Python SDK). Each call is checked before it runs and its result after.

Any language: call POST /v1/guard/tool_call with the tool mcp:<server>/<tool> before you call the server, then send the result to POST /v1/mcp/call to have it checked. See Any language (HTTP).

Claude Code and Codex: the hooks check MCP tools like any other tool. See Claude Code and Codex.

If something goes wrong

You see

Do this

No MCP servers declared in this directory

Run from the folder with the config, or pass --config.

name the server the tool list belongs to

--file needs the server name too: scan mcp github --file ….

Every call to one server refused with mcp.schema_drift

The server changed. Review it, then have two people accept the change.

unknown agent on permit grant

Run the agent once so it registers, then grant.