DEV Community

Edison Flores
Edison Flores

Posted on

How to add trust verification to Cline (autonomous coding agent) in 5 minutes

#mcp #aiagents #security #cline

How to add trust verification to Cline (the autonomous coding agent) in 5 minutes

Cline is an autonomous coding agent that uses MCP servers to complete tasks. But when Cline loads an MCP server, how do you know the server is trustworthy?

Here's how to add ATC (Agent Trust Card) verification to any MCP server Cline uses — in 5 minutes.

The problem

Cline loads MCP servers from the registry. But the registry doesn't verify:

  • Who published the server
  • Whether the server has been tampered with
  • Whether the server's tools have changed since audit
  • Whether the server tries to read your .env or .aws/credentials

We scanned 9,248 MCP servers and found:

  • 0.3% try to read credential files
  • 11% make undocumented network calls
  • 23% declare tools that don't exist in their code

The solution: @marketnow/trust-gateway 

npm install @marketnow/trust-gateway
Enter fullscreen mode Exit fullscreen mode

Then wrap any MCP server before Cline loads it:

import { createPreExecFilter } from '@marketnow/trust-gateway';

const filter = createPreExecFilter({
  // Only allow these hosts
  allowHosts: ['api.github.com', 'registry.npmjs.org'],

  // Block these actions
  denyActions: ['shell_exec', 'rm_rf', 'DROP_TABLE'],

  // Log every call to a tamper-evident Merkle tree
  logSink: (event) => auditLog.append(event),

  // Require approval for calls that spend money
  requireApprovalAbove: { spend_usd: 1 },
});

// Wrap your MCP server
const safeServer = filter.wrap(originalServer);
Enter fullscreen mode Exit fullscreen mode

The filter:

  1. Intercepts every tools/call before it reaches the MCP server
  2. Checks the call against 5 policy rules (blocks .env reads, rm -rf, shell spawns, etc.)
  3. Logs to a Merkle tree (tamper-evident, can't be silently edited)
  4. Returns ALLOW or BLOCK before the call executes

What Cline sees

Cline doesn't need to change anything. The filter is transparent — it wraps the MCP server and Cline talks to the wrapper as if it were the original server.

When the filter blocks a call, Cline gets:

{
  "error": "pre_exec_veto",
  "reason": "host_not_allowlisted",
  "attempted": "evil.example.com",
  "allowed": ["api.github.com", "registry.npmjs.org"]
}
Enter fullscreen mode Exit fullscreen mode

What we just shipped (v5.1-v6.0)

This week we shipped the full roadmap:

  • v5.1: Cryptographic Tool Fingerprinting (detect when MCP server's tool surface changes post-audit)
  • v5.2: Behavioral Baseline + Drift Detection (3 algorithms: threshold, z-score, KL-divergence)
  • v5.3: Capability Graph + Organization Policies + Approval Workflow
  • v5.4: Multi-Tool Attack Chain Detection (8 patterns) + Data Flow Tracking + Trajectory Risk Scoring
  • v6.0: Cross-Agent Trust + Memory Poisoning Detection (30+ patterns)

All open-source: https://github.com/alicelabs-llc/universal-trust-adapter

Try it 

# Verify any MCP server's trust credentials (no auth, no signup)
curl https://www.marketnow.site/api/trust?action=formats

# Install the gateway
npm install @marketnow/trust-gateway

# See the live status
curl https://status.marketnow.site/status/status.json
Enter fullscreen mode Exit fullscreen mode

If you're using Cline (or any MCP-based agent) and want to add trust verification, the @marketnow/trust-gateway package is 100% compatible. No agent code changes needed.

— Edison Flores, AliceLabs LLC
https://www.marketnow.site · https://status.marketnow.site

Top comments (0)