# Assay

> Security scanner for the AI dev stack - audits Claude Code plugins, MCP servers, skills & connectors before you trust them.

- **Type:** MCP server
- **Install:** `agentstack add mcp-chawdamrunal-assay`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [chawdamrunal](https://agentstack.voostack.com/s/chawdamrunal)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [chawdamrunal](https://github.com/chawdamrunal)
- **Source:** https://github.com/chawdamrunal/assay
- **Website:** https://chawdamrunal.github.io/assay/

## Install

```sh
agentstack add mcp-chawdamrunal-assay
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Assay is an MCP & Claude Code security scanner. It threat-models plugins, MCP servers, hooks, skills & connectors with an LLM — not regex — to catch prompt injection, credential exfiltration, and MCP tool poisoning before you trust them.
  Runs on your Claude Code subscription — no separate API key required.

  📚 Documentation
   ·  Install
   ·  Quickstart
   ·  How it works
   ·  FAQ

▶ Demo — inventory your Claude Code stack, then threat-model and scan an MCP server end to end.

https://github.com/user-attachments/assets/8e6e1c3f-358a-4cf1-a50c-6e15fbf43c75

---

## What it does

Before you install a plugin or wire up an MCP server, Assay threat-models what it *could* do, then reads the code for evidence — every finding backed by a verbatim `file:line` quote. It's built for **MCP security** and the wider Claude Code attack surface, where the dangerous behavior is usually legal code with bad intent that SAST and dependency scanners miss.

- **Reasons, doesn't pattern-match** — an LLM builds a threat model *before* it reads source, so the review is hypothesis-driven, not regex.
- **Catches AI-native threats** — prompt injection, MCP tool poisoning, credential exfiltration, hook abuse, capability-vs-claim mismatch.
- **No confabulation** — a post-validator re-reads every citation and drops anything the model can't back with real code.
- **Runs on your subscription** — default mode drives Claude Code via `claude -p`; no separate API key, no rate-limit walls.
- **One binary, three roles** — the CLI, the `assay serve` web UI, and the `assay mcp` server Claude Code drives.

Verdict: **safe / caution / unsafe**, written as `audit.json` + `audit.md`.

## Quickstart

```bash
git clone https://github.com/chawdamrunal/assay.git && cd assay
make build && make install          # single binary, React UI embedded

assay inventory                     # what's installed in ~/.claude
assay serve                         # http://localhost:7373 → "New Scan"
```

Full guide → **[Installation](https://chawdamrunal.github.io/assay/installation.html)** · **[Quickstart](https://chawdamrunal.github.io/assay/quickstart.html)**.

## Documentation

The full docs live at **[chawdamrunal.github.io/assay](https://chawdamrunal.github.io/assay/)**:

* **[Installation](https://chawdamrunal.github.io/assay/installation.html)** — build from source, curl / Homebrew / WinGet / Docker, auth
* **[Quickstart](https://chawdamrunal.github.io/assay/quickstart.html)** — scan from the web UI or CLI, the pre-install gate, private GitHub repos
* **[How it works](https://chawdamrunal.github.io/assay/how-it-works.html)** — the 5-stage methodology, both scan modes, threat coverage
* **[How to threat-model an MCP server](https://chawdamrunal.github.io/assay/mcp-server-security.html)** — the practical MCP security checklist
* **[MCP tool poisoning](https://chawdamrunal.github.io/assay/mcp-tool-poisoning.html)** — what it is and how to detect it
* **[Threat model](https://chawdamrunal.github.io/assay/threat-model.html)** — the 12 AI dev-stack threat classes
* **[FAQ](https://chawdamrunal.github.io/assay/faq.html)** — vs. Snyk / Cisco, API-key needs, tool poisoning, source privacy

Deeper references in-repo: [ARCHITECTURE.md](ARCHITECTURE.md) · [threat model](docs/threat-model-2026.md) · [CHANGELOG.md](CHANGELOG.md).

## Status

Pre-1.0, under active development. The MCP-server architecture is the default scan path; the legacy in-process orchestrator remains as an API-key / CI fallback. Report a security issue in Assay itself via [SECURITY.md](SECURITY.md).

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md). TDD-disciplined; every finding must cite a verbatim quote — enforced at runtime and in review.

## License

Apache-2.0. See [LICENSE](LICENSE).

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [chawdamrunal](https://github.com/chawdamrunal)
- **Source:** [chawdamrunal/assay](https://github.com/chawdamrunal/assay)
- **License:** Apache-2.0
- **Homepage:** https://chawdamrunal.github.io/assay/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-chawdamrunal-assay
- Seller: https://agentstack.voostack.com/s/chawdamrunal
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.