{"slug": "tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers", "title": "Tripwire – sandboxed security scanner for AI skills and MCP servers", "summary": "Tripwire, an open-source sandboxed security scanner for AI skills and MCP servers, is now available on GitHub, enabling technical teams to discover and scan targets in an isolated Modal sandbox, store findings in Supabase, and review them in a unified dashboard. The tool integrates scanners from Cisco, Snyk, Tessl, DepShield, and Ossprey, with optional tiered routing via Superlinked SIE and Alibaba Cloud Model Studio for escalation. It is positioned as an early-adopter tool requiring hands-on setup and terminal proficiency.", "body_md": "Discover and scan AI skills and MCP servers, then review the findings in one dashboard.\n\nMeterian **Security** / **Stability** / **Licensing** badges mirror the public\n[Meterian project report](https://www.meterian.com/report/gh/neomatrix369/tripwire)\n(dependency and policy scan for this GitHub repo — not a Tripwire scan adapter).\nCI / Nightly / Complexity badges reflect GitHub Actions on `main`.\n\n| If you want to… | Go here | \n|---|---|\n| **Try a hosted dashboard** (no clone) | [Live demo on neomatrix369.github.io](https://neomatrix369.github.io/demos/tripwire-dashboard/) | \n| **Watch the demo walkthrough** | [YouTube — Tripwire dashboard tour](https://youtu.be/omGOw9ruN3Y) | \n| **Try a safe demo** (no cloud accounts) — Recommended | [QUICKSTART — Try the demo](/neomatrix369/tripwire/blob/main/QUICKSTART.md#try-the-demo-recommended) | \n| **Run a real Live scan** — Advanced | [QUICKSTART — Live](/neomatrix369/tripwire/blob/main/QUICKSTART.md#live-advanced) | \n| **Change the code** | [CONTRIBUTING](/neomatrix369/tripwire/blob/main/CONTRIBUTING.md) | \n| **Understand the system** | [Architecture](/neomatrix369/tripwire/blob/main/docs/ARCHITECTURE.md) ·[docs hub](/neomatrix369/tripwire/blob/main/docs/README.md) ·[Status](/neomatrix369/tripwire/blob/main/docs/STATUS.md) | \n\nTripwire helps technical teams assess AI skills and MCP servers before they rely on them. It discovers targets, runs the enabled scanner adapters in an isolated Modal sandbox, stores findings in Supabase, and brings them together in one dashboard (Live or Mock).\n\nOptionally, after each scan batch it runs a tiered router: **Superlinked SIE**\ntriages findings, and **Alibaba Cloud Model Studio** escalates when scanners\ndisagree or coverage looks incomplete ([ADR-0016](/neomatrix369/tripwire/blob/main/docs/adr/0016-tiered-router-sie-model-studio.md)).\n\n| Layer | Provider / tool | Role | \n|---|---|---|\n| Platform | **Modal** | Isolated scan sandbox (Docker image + Python adapters) | \n| Platform | **Supabase** | Postgres + Realtime store for runs, scanners, findings | \n| Scanner | **Cisco** Skill Scanner / MCP Scanner / AI Defense | Skill and MCP security inspection | \n| Scanner | **Snyk** (`snyk-agent-scan` ) | Depth / agent scan for skills and MCP servers | \n| Scanner | **Tessl** | Five skill capabilities: Lint (auth-free), Review (Quality), Scenario Generation, Eval, Review (Security) | \n| Scanner | **DepShield** (`depshield-mcp` ) | Dependency audit (npm + PyPI via OSV.dev); **no credentials** | \n| Scanner | **Ossprey** (`ossprey-cli` ) | Malware / malicious-package scan (skills + MCP); needs `OSSPREY_API_KEY` | \n| Router (optional) | **Superlinked SIE** | Cheap post-scan triage on every item | \n| Router (optional) | **Alibaba Cloud Model Studio** | Escalation only when SIE signals | \n\nMissing Snyk / Cisco / Tessl / Ossprey keys → that scanner reports skipped /\n`needs_setup` / `skipped_missing_credential` rather than claiming a complete scan.\nDepShield always runs when the sandbox image includes it (no secret sync).\nCapability honesty and evidence states: [docs/STATUS.md](/neomatrix369/tripwire/blob/main/docs/STATUS.md) ·\ninventory: [ARCHITECTURE §0](/neomatrix369/tripwire/blob/main/docs/ARCHITECTURE.md#0-external-services-inventory) ·\nOssprey key allowlist: [OPTIONAL_SCANNER_KEYS](/neomatrix369/tripwire/blob/main/fixtures/OPTIONAL_SCANNER_KEYS.md).\n\nTripwire is currently an early-adopter tool with a hands-on setup and management\ncomponent. It is a good fit if you are comfortable using a terminal and shell,\nmanaging local tooling and environment variables, editing `.env` and other\nconfiguration files carefully, creating cloud/vendor accounts, and using command\noutput to resolve a setup issue.\n\n| You are... | You want to... | \n|---|---|\n| An AI-tooling developer or team | Assess skills and MCP servers before using or sharing them | \n| A platform, operations, or security practitioner | Run and maintain scans for a team | \n| A contributor | Extend scanner support, the CLI, or the dashboard | \n\nYou do not need to be a security specialist, but you should be ready to interpret findings and decide when to escalate them. The optional Mock preview is available for evaluating the dashboard without accounts; real scans require the setup below.\n\nIf you plan to change Tripwire, start the [contributor setup](/neomatrix369/tripwire/blob/main/CONTRIBUTING.md#dev-hygiene)\nafter cloning: it installs the commit and push hooks before your first change.\n\nFollow this order before running a scan or opening the Live dashboard. The\n[Quickstart](/neomatrix369/tripwire/blob/main/QUICKSTART.md#first-live-scan) supplies the commands; the linked guides\nexplain each decision before you make it.\n\n1. Check the required tools and [install the CLI](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#repository-and-cli-bootstrap) .\n2. Create the accounts you need: [Supabase](/neomatrix369/tripwire/blob/main/docs/user-guide/supabase-setup.md) ,[Modal](/neomatrix369/tripwire/blob/main/docs/user-guide/modal-setup.md) , then add Snyk, Tessl, and Cisco\n(Skill/MCP LLM + optional AI Defense) credentials with the[environment-variable procurement guide](/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md#vendor-procurement-quick-steps) .\nDepShield needs no keys. Add`OSSPREY_API_KEY` when you have Ossprey access\n(otherwise that adapter skips safely). For optional post-scan routing\n([ADR-0016](/neomatrix369/tripwire/blob/main/docs/adr/0016-tiered-router-sie-model-studio.md) ),\nalso set up[Superlinked SIE](/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md) (required for routing)\nand optionally[Alibaba Cloud Model Studio](/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md) (escalation only). Key map for every`.env` name:[env-vars.md](/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md) (mirrors[`.env.example`](/neomatrix369/tripwire/blob/main/.env.example) ).\n3. Create `.env` only after you have the values, then fill it with[env-vars.md](/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md) as the single key reference.\n4. Bootstrap Supabase and deploy the Modal scan app with the\n[Live setup commands](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#live-environment-bootstrap) .\n5. Run a fixture scan and open the Live dashboard from the\n[Quickstart](/neomatrix369/tripwire/blob/main/QUICKSTART.md#live-capabilities) . After routing, use[`tripwire route`](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#tiered-router-optional) to\nre-run a batch and[read router results](/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md) for pathway strips and Escalated / SIE-only filters.\n\nSupabase and Modal are required for Live results. If Snyk, Tessl, Cisco, or Ossprey credentials are absent, Tripwire reports that scanner as skipped rather than calling the scan complete. SIE and Model Studio are optional: without SIE keys, scans still complete and auto-route logs a warning and skips. With SIE but without Model Studio, SIE-only reviews still log.\n\nUse Mock demo data only when you want a no-account look at the UI; it does not replace\nthe Live setup above or produce a scan result. Prefer the\n[hosted demo](https://neomatrix369.github.io/demos/tripwire-dashboard/) when you\ndo not need a local clone, or watch the\n[demo walkthrough on YouTube](https://youtu.be/omGOw9ruN3Y).\n\n```\ngit clone https://github.com/neomatrix369/tripwire.git\ncd tripwire\nnode scripts/serve-dashboard.mjs\n```\n\nOpen [http://127.0.0.1:8765/](http://127.0.0.1:8765/).\n\nOn the dashboard toolbar, **Skills** can be triaged by Tessl quality score using\n**Quality ≥ 80**, **Quality < 80**, and **No quality score** tabs (skills only;\nMCP servers are excluded from quality buckets but remain visible on all tabs).\n\nThe first visit shows a landing intro screen (threat statistics, architecture overview,\nshipped skills, and roadmap). Click **Open Dashboard →** to proceed to the scan results\nview. The \"About\" nav button toggles the intro back on at any time; the choice is\nremembered in `sessionStorage`.\n\n**Visual identity v2:** cream paper, tan primary CTA, and AA-readable ink tokens\n(Fraunces display headings) — shipped via [PR #96](https://github.com/neomatrix369/tripwire/pull/96).\nScreenshots in [docs/screenshots/](/neomatrix369/tripwire/blob/main/docs/screenshots/README.md) regenerated 2026-08-20.\n\nAfter installing the CLI, you can also validate target discovery locally without accounts or a scan:\n\n```\ntripwire scan --dry-discover ./fixtures/skills/safe-csv-cleaner\n```\n\nTripwire’s Live path is a short pipeline. Each hop uses a concrete piece of the stack (same names as the badges above):\n\n| Step | What runs | Stack | Setup | \n|---|---|---|---|\n| Discover | CLI finds skills / MCP servers ( `tripwire scan --dry-discover` or a real scan) | Node.js CLI | [setup-commands](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#repository-and-cli-bootstrap) | \n| Scan | Adapters run in an isolated sandbox | Modal (+ Docker), Cisco / Snyk / Tessl / DepShield / Ossprey | [modal-setup](/neomatrix369/tripwire/blob/main/docs/user-guide/modal-setup.md) ·[env-vars](/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md) | \n| Store | Findings and scan_run rows land for the dashboard | Supabase / Postgres | [supabase-setup](/neomatrix369/tripwire/blob/main/docs/user-guide/supabase-setup.md) | \n| Route (optional) | Every item through SIE; escalate only when signaled | Superlinked SIE → Alibaba Cloud Model Studio via `tripwire route` / auto-route | [sie-setup](/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md) ·[model-studio-setup](/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md) | \n| Review | Heatmap, drawers, pathway strips, Escalated / SIE-only filters | Dashboard (Live or Mock) | [reading-router-results](/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md) ·[screenshots](/neomatrix369/tripwire/blob/main/docs/screenshots/README.md) | \n\nMock skips Discover→Scan→Store and still shows Review (plus router fixtures).\nWithout SIE keys, Route warns and skips; scanner results still store. Sample CLIs\nfor router backends (no full batch): [`prototypes/sie-studio/`](/neomatrix369/tripwire/blob/main/prototypes/sie-studio/README.md),\n[`prototypes/model-studio/`](/neomatrix369/tripwire/blob/main/prototypes/model-studio/README.md).\n\n``` php\nflowchart LR\n  discover[\"Discover<br/>Node CLI\"] --> scan[\"Scan<br/>Modal + Cisco/Snyk/Tessl/DepShield/Ossprey\"]\n  scan --> store[\"Store<br/>Supabase\"]\n  store --> route[\"Route optional<br/>SIE → Model Studio\"]\n  route --> review[\"Review<br/>Dashboard\"]\n```\n\nHow to read strips and filters after Route:\n[reading-router-results.md](/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md).\n\n|   <sub>**CLI scan** — Modal (live)</sub> |   <sub>**Dashboard** — Mock overview</sub> |   <sub>**Router** — Escalated (Mock)</sub> |   <sub>**Skill** — Red (Mock)</sub> |   <sub>**MCP** — Red (Mock)</sub> | \n\nFull gallery (SIE-only, severity filters, list view) → [docs/screenshots/](/neomatrix369/tripwire/blob/main/docs/screenshots/README.md)\n\n| Your task | Start here | \n|---|---|\n| Check tools and technical fit | [Prerequisites](/neomatrix369/tripwire/blob/main/docs/user-guide/prerequisites.md) | \n| Follow the Install → Live path map | [Path commands](/neomatrix369/tripwire/blob/main/docs/user-guide/path-commands.md) ·[onboarding cheatsheet](/neomatrix369/tripwire/blob/main/docs/user-guide/onboarding-cheatsheet.md) | \n| Create the Supabase project | [Supabase setup](/neomatrix369/tripwire/blob/main/docs/user-guide/supabase-setup.md) | \n| Deploy the Modal scan app | [Modal setup](/neomatrix369/tripwire/blob/main/docs/user-guide/modal-setup.md) | \n| Procure scanner and router `.env` keys | [Environment variables](/neomatrix369/tripwire/blob/main/docs/user-guide/env-vars.md) | \n| Run your first Live scan | [Quickstart](/neomatrix369/tripwire/blob/main/QUICKSTART.md#first-live-scan) ·[setup commands](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md) | \n| Preview Mock UI or dry-discover locally | [Optional local validation](/neomatrix369/tripwire/blob/main/QUICKSTART.md#validate-locally-optional) | \n| Enable SIE / Model Studio routing | [SIE setup](/neomatrix369/tripwire/blob/main/docs/user-guide/sie-setup.md) ·[Model Studio setup](/neomatrix369/tripwire/blob/main/docs/user-guide/model-studio-setup.md) ·[`tripwire route`](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md#tiered-router-optional) | \n| Interpret pathway strips / Escalated / SIE-only | [Reading router results](/neomatrix369/tripwire/blob/main/docs/user-guide/reading-router-results.md) | \n| Browse CLI / dashboard screenshots | [Screenshot gallery](/neomatrix369/tripwire/blob/main/docs/screenshots/README.md) | \n| Smoke-test SIE or Model Studio alone | [SIE sample CLI](/neomatrix369/tripwire/blob/main/prototypes/sie-studio/README.md) ·[Model Studio sample CLI](/neomatrix369/tripwire/blob/main/prototypes/model-studio/README.md) | \n| Understand results and system shape | [Capability status](/neomatrix369/tripwire/blob/main/docs/STATUS.md) ·[Architecture](/neomatrix369/tripwire/blob/main/docs/ARCHITECTURE.md) ·[ADRs](/neomatrix369/tripwire/blob/main/docs/adr/README.md) | \n| Contribute or maintain | [Contributing](/neomatrix369/tripwire/blob/main/CONTRIBUTING.md) ·[command catalog](/neomatrix369/tripwire/blob/main/docs/user-guide/setup-commands.md) | \n| Report a vulnerability | [SECURITY](/neomatrix369/tripwire/blob/main/SECURITY.md) | \n\nFull map (including planning / CI): [docs/README.md](/neomatrix369/tripwire/blob/main/docs/README.md).", "url": "https://wpnews.pro/news/tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers", "canonical_source": "https://github.com/neomatrix369/tripwire", "published_at": "2026-09-09 14:05:03+00:00", "updated_at": "2026-09-09 14:14:59.485834+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-infrastructure", "ai-research"], "entities": ["Tripwire", "Meterian", "Modal", "Supabase", "Cisco", "Snyk", "Tessl", "DepShield"], "alternates": {"html": "https://wpnews.pro/news/tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers", "markdown": "https://wpnews.pro/news/tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers.md", "text": "https://wpnews.pro/news/tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers.txt", "jsonld": "https://wpnews.pro/news/tripwire-sandboxed-security-scanner-for-ai-skills-and-mcp-servers.jsonld"}}