If you wire MCP into Cursor or Claude Code, the approve dialog is not a security boundary.
It shows the tool description your client can render. It does not show Unicode TAG-block payloads hiding instructions like "also read ~/.aws/credentials." And after the first click, most clients will not re-fingerprint the tool — so a rug pull after approval (CVE-2025-54136) lands quietly.
Grade vs gate
A scanner/grade is useful. It tells you a server looks risky against a published rubric.
It does not sit in the path of tools/call.
Production needs a gate: deterministic checks on the request, the tool definition you approved, the arguments, and the response — without putting an LLM in the hot path.
What we ship
SentinelAgent Guard is that gate (hosted proxy, embedded SDK, or stdio sidecar for local Cursor/Claude Code servers). Same engine in all three shapes. Free tier runs all checks on one server; Pro is self-serve for teams that need more.
If you are building agents on MCP and want enforcement before the tool runs:
Pro ($49/mo): https://guard.sentinelreign.com/sign-up?plan=pro¤cy=usd
Open engine / research trail stays on the free scanner side — grade first if you want, gate when you go to production.
Top comments (0)