Metadata-Version: 2.4
Name: vnx
Version: 0.0.1
Summary: Security for the AI agent supply chain — scan agent skills and MCP servers for tool poisoning, exfiltration, and rug pulls.
Project-URL: Homepage, https://vnx.run
Project-URL: Repository, https://github.com/vnxrun/vnx
Project-URL: Documentation, https://github.com/vnxrun/vnx#readme
Project-URL: Issues, https://github.com/vnxrun/vnx/issues
Author-email: vnx <dev@vnx.run>
License: Apache-2.0
License-File: LICENSE
Keywords: ai-agents,llm,mcp,prompt-injection,security,supply-chain
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# vnx

**Security for the AI agent supply chain.**

`vnx` scans AI agent skills (SKILL.md + scripts) and MCP servers for what static
scanners miss: tool poisoning, credential exfiltration chains, rug pulls,
hidden-unicode smuggling, typosquats, and prompt-injection payloads — with an
evidence-based confidence engine built to keep false positives near zero.

```
                 ╔═══════════════════════════════════╗
                 ║   scan  ·  gate  ·  proxy         ║
                 ║   one engine, three checkpoints   ║
                 ╚═══════════════════════════════════╝
```

> **This is the `0.0.1` name-reservation build.** The full scanner
> (`v0.2.0`) is in final release preparation — 839 tests, CI-enforced
> benchmark of **100% recall on 12 rebuilt real-world incident PoCs
> (postmark-mcp, ClawHavoc, SANDWORM_MODE, Invariant tool-poisoning)**
> and **0% false positives on benign skills**. Star the repo to catch the drop.

## What ships in v0.2.0

- **`vnx scan`** — enumerate-everything static analysis: hidden files, `.docx`/zip
  unpacking, `.pyc` vs source divergence, anti-truncation. 9 analyzers + an
  Opengrep taint engine tracing source→sink chains (env→network, file→egress,
  arg→exec). Correlation grouping collapses noise into named threats.
- **`vnx gate`** — blocking security hooks for Claude Code, Cursor, Codex CLI,
  and VS Code: malicious skills and MCP calls get denied *before* execution.
- **`vnx proxy`** — a runtime MCP firewall: tool-manifest pinning (rug-pull
  detection), argument DLP, response injection scanning, hash-chained audit log.
- **Offline-first.** Zero accounts, zero telemetry, zero required API keys.
  Optional local-LLM (Ollama) and reputation layers are opt-in, never required.
- **SARIF, GitHub Action, pre-commit, Docker, MCP-server mode** — drops into
  whatever pipeline you already run.

## Try the placeholder

```bash
uvx vnx          # or: pipx run vnx
```

## Links

- Repo: [github.com/vnxrun/vnx](https://github.com/vnxrun/vnx)
- Site: [vnx.run](https://vnx.run)

Apache-2.0 · built in public · no telemetry, ever
