ratchetBLOCK
Compile a least-privilege policy from what your AI agents can actually reach - then hand over evidence the recipient verifies without trusting you.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
从 agent 的真实行为编译最小权限策略,并给出收货方能自己验证的证据。
curl -fsSL https://github.com/suhui-organization/ratchet/releases/latest/download/install.sh | sh
macOS / Linux 上也可以用 Homebrew(formula 钉住每个平台的 sha256):
brew install suhui-organization/tap/ratchet
Claude Desktop 用户可以直接装本地 server(一键安装包,不需要命令行):
下载 ratchet-0.12.0.mcpb 并打开它,Claude Desktop 会完成安装。包内是四个平台的原生二进制 + 一份 manifest.json (MCPB 规范),不需要 Node 或 Python 运行时。
Linux / macOS(amd64 · arm64)。装完先跑这一条——只读配置,不执行任何东西:
ratchet scan --home ~
它会在十秒内告诉你:这台机器上有几个 MCP server,其中几个没锁版本。 (我自己的机器:16 个里 12 个没锁。)
棘轮只能往一个方向转:权限可以收紧,放宽必须显式。
这是什么
一个跑在你自己机器上的工具:它读 agent 用到的工具清单, 编译出一份最小权限策略,再把这次审计的产物打成一份 收货方不需要信任你、也不需要装任何东西就能验证的交付目录。
这不是什么
- 不是沙箱、不是容器运行时;
- 不是 prompt 内容过滤器;
- 不是企业控制台(不做 dashboard、不做多租户、不做 SaaS 依赖);
- 不要求你把日志传到哪里去。
为什么值得存在
市场上的产品要么让你自己手写策略(Cedar / CEL / 自然语言), 要么要你相信它的日志。Ratchet 做的是这两件之间缺失的一步: 策略由观测编译,证据由收货方自己算哈希。
一个例子
# 1) 编译:从工具清单得到一份保守的最小权限策略 ratchet policy draft --from examples/inventory.json --out policy.json # 2) 出交付物:报告 + 逐文件 sha256 清单 ratchet-report build --dir ./delivery --policy policy.json # 3) 收货方验证(不需要装 ratchet) python3 verify.py ./delivery
仓库结构
状态
0.12.0 — developer preview,链路已经整条打通(本机实测:16 个 MCP server、 12 个未锁版本、164 个工具、策略 allow 43 / approve 106 / deny 15):
98a57065e428OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ratchet:v0.12.2 -- docker run -i --rm ghcr.io/suhui-organization/ratchet:v0.12.2:None
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
echo " ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]" >&2
web/dist
curl -s -o /dev/null -w '%{http_code}\n' http://192.168.66.8:${node_port}/healthz # 期望 200Samples: []string{"filesystem/read_file denied by **/.ssh/**"},"tool_input": {"command": "cat ~/.ssh/id_rsa"},"constraints":{"read_file":{"paths":{"deny":["**/.ssh/**"]}}}}},if got := call(`{"path":"/home/me/.ssh/id_rsa"}`); !strings.Contains(got, "decision=deny") {kubectl -n {{ .Release.Namespace }} exec deploy/{{ include "ratchet.web.fullname" . }} -- wget -qO- http://127.0.0.1/healthz节点直连:`http://192.168.66.8:30090`(NodePort,见 values-remote.yaml)
kubectl -n ratchet exec deploy/ratchet-web -- wget -qO- http://127.0.0.1/healthz # → ok
curl -s -o /dev/null -w '%{http_code}\n' http://192.168.66.8:30090/verify # → 200nuxt, vue, @tailwindcss/vite, tailwindcss, vitest
curl -fsSL https://github.com/suhui-organization/ratchet/releases/latest/download/install.sh | sh
拿到它的方式:`curl -fsSL https://github.com/suhui-organization/ratchet/releases/latest/download/install.sh | sh`、
→ curl | sh 装上(已验证可用)
Gates applied: no_behavioural_pass.
98a57065e428full audit observations/trust-audit/mcp-server/suhui-organization__ratchet.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 98a57065e428 | BLOCK | D | 69 | first audit |
Questions
What is the ratchet MCP server?
Compile a least-privilege policy from what your AI agents can actually reach - then hand over evidence the recipient verifies without trusting you.
Is ratchet safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does ratchet need?
It reads EDGE_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ratchet run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as ratchet-web.
How current is this page?
The grade is for one exact copy of the source (98a57065e428), read on 2026-10-12. The repository is watched and re-audited when it changes.