ScopebondBLOCK
Free, open-source guardrails and verifiable evidence for AI coding agents: Claude Code, Cursor, Codex, MCP, and GitHub. Scopebond Cloud is a separate proprietary hosted workspace.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](LICENSE) [](https://github.com/avouro-com/scopebond/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@scopebond/hook)
Free, open-source guardrails and verifiable evidence for AI coding agents.
As organizations adopt more AI, they need clear oversight and accountability: what did an agent do, how are harmful actions controlled, and what evidence can they provide? Scopebond's open-source components check supported actions against your rules and create signed records you can inspect and verify independently. Connect Claude Code, Cursor, Codex, GitHub Copilot, MCP tools, your agent framework, or GitHub pull-request checks.
This repository contains free, Apache-2.0 open-source software. Scopebond Cloud, the hosted shared workspace, is a separate proprietary service and is not open source. Cloud offers Free and paid plans; a Free plan does not make the hosted service open source. You can use the local controls and verify their records without a Cloud account.
Product overview · Getting started · Explore the hosted sample workspace
Visibility, control, and evidence
e608eb099e49OBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add verify --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env DEEPSEEK_TOKEN=${DEEPSEEK_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env KEY_ACL_LOG=${KEY_ACL_LOG} -- npx -y @scopebond/[email protected]{
"mcpServers": {
"verify": {
"command": "npx",
"args": [
"-y",
"@scopebond/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"DEEPSEEK_TOKEN": "${DEEPSEEK_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"KEY_ACL_LOG": "${KEY_ACL_LOG}"
}
}
}
}Exposed tools (9)
6 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_release | write | publish |
delete_branch | destructive | delete |
get_issue | read | read |
new_tool | read | x |
read | read | read a file |
scopebond-agent.exe | read | Scopebond Agent |
scopebond-tray.exe | read | Scopebond tray |
scopebond.evaluate | write | Submit an agent action intent to be policy-checked, countersigned, and (if allowed) executed through the Scopebond gateway. |
search | read | search the web |
Trust audit
BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
type Db = { exec(sql: string): void; prepare(sql: string): Statement; close(): void };type SqliteDb = { exec(sql: string): void; prepare(sql: string): { run(...a: unknown[]): unknown; all(...a: unknown[]): unknown[] }; close(): void };interface SqliteDb { exec(sql: string): void; prepare(sql: string): SqliteStatement; close(): void }".envrc", ".npmrc", ".pypirc", ".netrc", ".git-credentials", "credentials", ".credentials.json", "id_ed25519", "config.json",
".ssh/id_rsa", ".ssh/id_ed25519", ".aws/credentials", ".npmrc", ".pypirc", ".netrc", ".git-credentials",
const SENSITIVE = /(?:^|[/\\])(?:\.scopebond(?:[/\\]|$)|\.env(?:\.[^/\\]*)?$|\.envrc$|\.ssh(?:[/\\]|$)|\.aws(?:[/\\]|$)|\.npmrc$|\.pypirc$|_?\.?netrc$|\.git-credentials$|\.kube(?:[/\\]|$)|\.docker(?:[
const SENSITIVE_IN_CODE = /(?<![\w$])(?:\.scopebond[\\/][\w.-]*|\.env(?:\.[\w-]+)?(?![\w.-])|\.envrc|\.ssh[\\/][\w.-]+|\.aws[\\/]credentials|\.claude[\\/]settings[\w.-]*|\.cursor[\\/]hooks\.json|\.cod
console.log(` credential stored in ${connectionFileFor(keyPath)} — a secret, do not commit`);console.log(`Private key: ${privateFile}. Store it as the signing environment's secret, then keep it offline and delete this copy:`);const res = await fetch(`http://127.0.0.1:${endpoint.port}${path}`, {$uri = 'http://127.0.0.1:' + $e.port + $route
.replace(/@(?=[A-Za-z0-9_-])/g, "@")
const TOKEN = "resume-target-control-token-000001";
const TOKEN = "sandbox-refund-secret-00000001";
delete_branch
.gitleaks.toml
.node-version
for (const path of ["../other/x", "/etc/hosts", "C:/Windows/x", "~/.ssh/config", ".github/workflows/ci.yml", ".claude/settings.json", ".scopebond/rules.json", ""]) {join(here, "../../policy-schema/vectors/evidence-contract.json"),
const vectors = JSON.parse(readFileSync(join(here, "../../policy-schema/vectors/evidence-contract.json"), "utf8")).receipt_context;
const schema = JSON.parse(readFileSync(join(here, "../../policy-schema/schema/receipt.schema.json"), "utf8"));
const vectors = JSON.parse(readFileSync(join(here, "../../policy-schema/vectors/observation-contract.json"), "utf8"));
const root = fileURLToPath(new URL("../../..", import.meta.url));add(S, "cat .scopebond/agent.key > exfil.txt");
const res = await proxy.handle(call("exfiltrate", { target: "x" }));Gates applied: no_behavioural_pass.
e608eb099e49full audit observations/trust-audit/mcp-server/avouro-com__scopebond.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | e608eb099e49 | BLOCK | F | 42 | first audit |
Questions
What is the @scopebond/gateway MCP server?
Free, open-source guardrails and verifiable evidence for AI coding agents: Claude Code, Cursor, Codex, MCP, and GitHub. Scopebond Cloud is a separate proprietary hosted workspace.
What tools does @scopebond/gateway expose?
9 in total: 6 read-only, 2 that write, and 1 that can delete or overwrite (delete_branch). Every one is listed on this page with its risk.
Is @scopebond/gateway safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (42/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @scopebond/gateway need?
It reads ANTHROPIC_API_KEY, DEEPSEEK_TOKEN, GITHUB_TOKEN, KEY_ACL_LOG, SCOPEBOND_ATTESTER_KEY, SCOPEBOND_CLOUD_CREDENTIAL, SCOPEBOND_CONTROL_TOKEN, SCOPEBOND_KEY_FILE, SCOPEBOND_MCP_KEY, SCOPEBOND_POLICY_KEYS_JSON, SCOPEBOND_PRINCIPAL_KEYS_FILE and UPDATER_SIGNING_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (e608eb099e49), read on 2026-10-13. The repository is watched and re-audited when it changes.