Powered by Aguara, Signal inspects the tools, skills and dependencies your agents rely on for supply-chain threats. We’re extending that foundation with continuous monitoring of the ecosystem around them.
Aguara powers Signal’s inspection. Node discovers what your agents use. Continuous monitoring will connect those findings with changes across GitHub, security advisories and the wider web.
The report identifies a release that could expose customer data.
The installed version is affected.
Connect the advisory to the installed version and the team responsible.
A new script downloads and runs code from an external source.
This skill is in your inventory.
Compare the upstream change with the version your team actually uses.
A published technique targets credentials available to the server.
A component name matches. Impact is unconfirmed.
Validate the component, version and configuration before escalating.
Illustrative workflow, not a live alert. External findings need validation and do not automatically change Control policy.
Inspect the dependencies your AI agents rely on.
Check the source behind an MCP server, skill or package.
Trace each finding to its rule, file and matched source.
Use the evidence to approve, restrict or investigate.
{ "mcpServers": { "file-tools": { "description": "Local file tools", "transport": "stdio", "command": "sudo", "args": [ "node", "server.js" ], "env": { "WORKSPACE_ROOT": "/workspace", "LOG_LEVEL": "info" } } }}Bring Security and Engineering to the same file, rule and source context. Use the findings and intended permissions to decide what to approve, restrict or investigate.
Third-party code can introduce instructions, execute commands or reach credentials. Signal flags suspicious patterns in the input you inspect and gives your team the source context to review them.
| Entry point | Patterns to investigate | Why it matters |
|---|---|---|
MCP servers and tools | Injected tool descriptions, unsafe launch commands and suspicious configuration. | A connected tool can influence the agent and execute with the permissions it receives. |
Agent skills and instructions | Malicious directives, hidden prompt injection and instructions that fetch or run external code. | A useful-looking skill can redirect the agent toward actions your team did not intend. |
Packages and install logic | Download-and-execute paths, credential-file access and code that collects data for outbound transfer. | Installing a dependency can execute code before anyone starts using its advertised feature. |
Repositories and CI/CD | Suspicious command execution, exposed credentials and supply chain patterns in source and workflows. | Build automation can give third-party code access to repository secrets and deployment credentials. |
Bring a dependency owner and a security reviewer. Choose one MCP server, skill or repository at a specific version, and agree on the access it would receive.
Agree on the repository, version and relevant dependency surfaces.
A defined target and the context in which your agents use it.
Examine code, dependencies and execution paths with a pinned engine and rules.
Findings with their location, rule and supporting evidence.
Review what needs fixing, restricting or further investigation.
Priorities for remediation and inputs for dependency approval.
Plan recurring reviews around the tools your agents rely on. A previously reviewed version is the starting point for the next comparison.
Revisit code, lockfiles, install scripts and tool definitions when dependencies are updated.
Define which releases or scheduled reviews trigger a new evaluation and who owns the decision.
Recheck corrections, record unresolved findings and carry the result into the next trust decision.
Aguara is the open-source security engine at the core of Signal. It inspects code, instructions and dependencies for supply-chain threats, with findings traced to a rule and source location. Your engineers can inspect the engine and its published rules.
Review the input, engine version and rules alongside the findings. Use the same baseline when checking a correction.
Explore the Aguara engine ↗A malicious dependency can steal credentials during installation. Aguara checks known malicious-package records against supported lockfiles and installed packages.
npm, pnpm, Yarn and Bun lockfiles; installed packages.
Installed packages, .pth files and supported caches.
Gemfile.lock
Package lockfiles and C#, F# or Visual Basic project files.
go.sum and go.mod
Cargo.lock, for public-registry packages.
composer.lock
pom.xml and Gradle lockfiles.
Matching depends on the ecosystem: npm supports version ranges; others use exact versions and applicable all-version records. This is malicious-package detection, not general CVE scanning.
See detailed coverageCoverage shown is for the standalone Aguara engine. Confirm the integrated version and supported inputs when scoping a Signal evaluation.
Of 500 MCP servers published on npm, 62% combine local file read access with outbound network connectivity.
Half of the 500 tools analyzed can execute shell commands. More than 80% read and write local files, about 75% make outbound network calls.
525 vulnerabilities in agent and LLM tooling were disclosed in the last 18 months, at least 111 of them critical. About 29 a month since January 2025, fewer than five a month before.
Source: Reco, The State of Agent Security 2026, August 26, 2026. Telemetry from 62 enterprises, January 1 to August 1, 2026, plus 500 MCP servers from npm and NVD records. Vendor research, cited as published.
Signal checks the files and configurations behind MCP servers, skills and software dependencies for suspicious patterns: injected instructions, unsafe download-and-execute paths, credential access and potential exfiltration. Findings identify the rule and source location so your team can review them before installation, approval or an update. Control applies the runtime policy to connected tools; Signal informs what you choose to trust.
MCP servers, agent skills and instructions, packages, repositories, install scripts and CI workflows. The review considers the surrounding code and dependencies that can affect what an agent or its tools execute.
The Signal console runs the Aguara scanner in your browser. Choose supported local files or a folder, paste content, or inspect a public GitHub repository. Inspected content is not uploaded to Oktsec, and scan results are not retained by the console after you leave the page. Public repository scans fetch files from GitHub.
Signal inspects dependencies and changes to support trust decisions. An Assessment exercises a live workflow to reproduce reachable attack paths. A dependency finding can help define what to test in an Assessment.
The monitoring direction starts with what Node discovers in your environments, then matches component identities and available versions to GitHub changes, security advisories and research found through web search. This integration is in development; automated inventory matching and monitoring are not presented as available today.
No. A report needs validation against the component, version and configuration in use. Signal informs the review; Control applies the policy your team approves on supported, routed actions.
A recurring review can compare new code, lockfiles, workflows and tool definitions with the reviewed version. The proposal defines the dependencies covered, review triggers or cadence, and who receives the findings.
No. Describe the dependency and where it is used, or share a public repository URL. Access to private repositories and evidence handling are agreed separately. The Aguara scanning engine can run locally.
A result describes the findings detected for the reviewed input, engine version and rules. Your team considers those findings alongside permissions and intended use when approving a dependency. Changes can require a new review.
Start with an MCP server, skill, package or repository. Tell us where it is used and whether you need a first review or a recurring review of changes.
