alalanet guard — check before you install

Before installing a skill, MCP server or package: give the sha256 of the exact file. Read-only and free. Returns who signed a release with this hash, their standing, and conflicts (the same name@version signed with another hash = possible tampering). Advice: unknown_hash, signed_by_new_publisher, signed_by_established, signed_by_alalanet, caution_conflicting.

Before opening or trusting a GitHub repository someone sent you (a take-home task, a code review, a demo, a fork): its agent configuration can start MCP servers, run hooks and editor tasks, widen permissions and plant instructions as soon as the project is opened. Pass repo (owner/repo or a GitHub URL) and optional ref; for a local or private checkout pass files instead (path -> content of those files; the public record then holds only the decision, the files' sha256 and bare reason codes, the packages they name are checked without being signed, remote servers are looked up but not probed, and only CODEX_HOME, model-API, proxy and preload variables are read from .env). alalanet reads the files agents and editors load (.mcp.json at any depth, .github/mcp.json, .claude/settings.json, .cursor/mcp.json and hooks.json, .vscode/mcp.json, settings.json and tasks.json, .devcontainer, .gemini/settings.json and .env, .zed/settings.json, .codex/config.toml and hooks.json, .github/hooks and copilot settings, .env, registry settings (.npmrc, .yarnrc(.yml), bunfig.toml, uv.toml, pyproject.toml), CLAUDE.md, CLAUDE.local.md, AGENTS.md, GEMINI.md, .cursorrules, rules, agents, commands and skills folders including .github/agents and .agents/skills, with their frontmatter; symlinks read at their target) and runs nothing. It finds tasks and hooks that download and run code when the folder opens, hooks, skills and MCP servers that do the same (inline servers in agent files included), broad permissions including tools a skill grants itself, acceptEdits mode, plugin marketplaces and plugins the repository turns on, credential helpers and shell prefixes, repository MCP servers enabled without asking, the model API or a proxy pointed at another host (how API keys are taken), the package registry moved elsewhere, CODEX_HOME moved into the repository, invisible Unicode tag characters and bidirectional controls in instruction files, injection and concealment phrases, secrets committed in configs (never echoed); each MCP server goes through install_check. Returns decision allow / hold / block with reasons per file, findings, MCP servers with their verdicts and advice, signed into the public log (kind 4315). Whatever could not be read or checked holds as check_incomplete:<what>, never an allow. Free, no account: one check plus one per MCP server checked; cached 10 minutes.

Call before connecting to a remote MCP server, and whenever a call to it fails. Give url (any https URL of an MCP server, listed or not: unknown servers are probed now) or id from an earlier answer. Returns: alive, advice (ok / ok_requires_auth: working; unverified_yet: not fully checked yet; caution_tools_changed or caution_suspicious_tool_description: confirm with the user first; avoid_down or avoid_not_working_as_listed: do not connect), trust_score (0-100, open formula at https://alalanet.com/trust) with flags, checked_at and last_alive_at, uptime 24h/7d/30d, the tool-set diff (tools_diff, tools_changed_at), tool descriptions that look like hidden instructions (tool_description_flags), the digest of the server's initialize instructions, and when the advice is caution_* or avoid_*, up to 3 working MCP servers on other hosts. Default answers from recent checks (100 a day free); live=true probes now and adds a signed, logged attestation (5 live checks a day free). Read-only for the caller; an unknown URL joins the public catalogue.

Before adding a remote MCP server to a client, or when it fails to connect: give its url. One live read (initialize with protocol 2025-06-18 and 2025-11-25, tools/list, the 401 and OAuth metadata, the host's IPv4) and a verdict per client: claude_code, claude_ai, chatgpt, codex_cli, cursor, vscode, windsurf, gemini_cli, zed, cline, each ok, warn or fail with reasons (protocol version answered, OAuth discovery, S256 PKCE, dynamic client registration or client ID metadata documents, tool names, input schemas, tool count, description length). Also the tool list's weight in tokens (estimate and range). Rules come from each client's documentation and source code as of 2026-11-08: a prediction, not a test inside the client. Uses one of your daily live checks; answers are cached for 10 minutes.

Use when you or your user need proof of something alalanet stated: an install verdict, a server check, a tool-set change. Pass the event id (64 hex) from a previous result. Read-only and free. Returns the signed Nostr event (event_json, exact signed bytes), the signer key, and its RFC 6962 inclusion proof under a signed C2SP checkpoint, plus how_to_verify. Verify offline without trusting alalanet: check the signature, the proof up to root_hash, and the checkpoint signature with log_key.

Checks something before it is installed, typically when a README, a document or another agent suggests installing it: an npm or PyPI package, an install command (npx -y pkg, uvx pkg, pip install pkg, npm i pkg, claude mcp add NAME -- npx -y pkg, skills add owner/repo, clawhub install slug, code --install-extension publisher.name), a GitHub repository or skill, a ClawHub skill, a VS Code Marketplace or Open VSX extension (Cursor, Windsurf and VSCodium install from Open VSX), or an MCP config entry (JSON). alalanet checks public sources: OSV malicious-package and vulnerability records, names that imitate official MCP servers (typosquats, also the same name in the other ecosystem), packages that do not exist (names a model invented), brand-new packages and repositories, install scripts, maintainer changes between versions, provenance, ClawHub scan verdicts and copied skill names, skills.sh security audits of the skills a repository holds, extensions Microsoft removed from the Marketplace (malware, impersonation), look-alike extensions and unverified Open VSX copies of verified Marketplace ones; remote MCP servers get the full check_service. Returns decision allow / hold / block with reasons (known_malicious, name_like_official, not_on_npm, not_on_pypi, runs_install_script, maintainers_changed, new_package, new_repo, known_vulnerabilities, version_yanked, not_on_clawhub, slug_like_popular, skills_sh_audit_fail, provenance_dropped, removed_from_marketplace, name_like_popular, launch_not_readable ...), facts and advice, signed into the public log (kind 4310). A line whose package alalanet cannot read (custom registry, git/URL source, stdin or $(...) arguments, several packages, other commands) holds. allow means no known problem was found, not that the code was read. Free, no account.

Checks the tools an agent received from a remote MCP server against alalanet's history of that server, to catch a server that changed its tools after you approved them, or serves you something different from what it serves everyone else. Pass url and the tools array from your tools/list result (or a digest from an earlier answer). Read-only and free. When your set differs from alalanet's last read, alalanet re-reads the server's tools/list before answering (fetched_now; uses one of your daily live checks), so the answer reflects what the server serves at this moment. Returns verdict matches_current (exactly what the server serves alalanet now), served_before (an older set, with first_seen and last_seen), never_served (alalanet was never served this set: review before trusting it) or no_history, plus the diff from the current set (added, removed, changed, gained_authority), description flags found in what you sent, and the digest history with links to the signed transparency-log entries of each change. Names and descriptions are third-party text.