It searches memory, context or a registry for something that appears suitable.
Supply Chain and Agent Trust
Know what your agent is bringing aboard.
AI agents add dependencies, install tools and inherit instructions while they work. CodeMarine treats every new component as an expansion of the software trust boundary.
package.jsonMODIFIED BY AGENT
13"fastify": "^5.2.0"KNOWN
14"auth-flow-utils": "^1.0.4"VERIFY
PACKAGE IDENTITYProvenance not established
The name is plausible. Expected ownership, registry history and install behavior still need review.
- Registry
- Unconfirmed
- Lockfile
- Changed
- Install script
- Inspect
AI expands the boundary
Source review alone is no longer enough.
A generated function can be secure while the package it imports is invented, poisoned or executing an unexpected install script. The same problem now reaches agent tools and persistent instructions.
The name can exist, resemble a trusted package or be controlled by an attacker.
The dependency or tool gains code execution, data access or lasting influence.
The full trust boundary
Dependencies are only the first layer.
CodeMarine’s existing scanners cover source artifacts across the package and agent configuration surface. Exact policy and ecosystem depth varies by artifact.
Packages
Hallucinated names, lookalikes, malicious intelligence, suspicious sources and package age signals.
Manifests and lockfiles
Dependency declarations, source changes, resolution drift and unexpected transitive additions.
Install behavior
Lifecycle scripts and install-time execution that can run before an application starts.
MCP servers
Tool descriptions, requested authority, configuration and potential instruction poisoning.
Plugins and skills
New agent capabilities, bundled instructions and files that extend what an agent can do.
Rules and memory
Persistent instructions, identity files and changes that can influence future sessions.
Dependency decision
Turn an agent suggestion into an evidence trail.
A useful package workflow answers whether the dependency is expected, where it came from and what it will execute before approval.
- 01
Detect the change
Identify manifest, lockfile or source additions and attribute the workspace event.
- 02
Resolve identity
Compare ecosystem, package name, publisher and expected source.
- 03
Inspect behavior
Review install scripts, suspicious sources and known malicious intelligence.
- 04
Apply policy
Allow, warn or require review according to the available evidence.
- 05
Retain provenance
Bind the decision to the manifest and intelligence revisions.
Current PROJECT AGENT CONFIG
.claude/skills/deploy/SKILL.mdNEW FILE
Credential access requestedInstruction references cloud token sources.
Remote destination introducedTool output is directed outside the approved boundary.
Persistent instruction changeFuture sessions may inherit this behavior.
Protect the tools too
An AI security boundary includes the agent’s own configuration.
A poisoned rule, skill or MCP description can steer future tool use without changing application source. CodeMarine inspects those artifacts as security-relevant code.
Prompt injectionInstructions hidden in source, configuration or tool descriptions
Tool poisoningDescriptions that misrepresent capability or request unsafe authority
Persistent tamperingRules, memory and identity changes that survive the current task
Self-protectionAttempts to weaken or remove CodeMarine controls
Current and next
Strong scanning foundation. A tighter approval loop is next.
The site separates current artifact analysis from planned policy workflows so teams can evaluate what exists today.
| Capability | Scope | Status |
|---|---|---|
| Dependency artifact scanning | Multiple manifests, lockfiles and source ecosystems | Current |
| Package risk signals | Slopsquatting, typosquatting, malicious intelligence and source concerns | Current |
| Agent artifact scanning | MCP, skills, rules, prompts and selected configuration | Current |
| Unified dependency approval workflow | Organization policy, reviewer decision and durable provenance receipt | Planned |
| Universal package safety guarantee | No scanner can prove every package is safe | Not covered |
Early access
Inspect the cargo before it becomes trusted code.
Bring dependency, agent-tool and persistent-instruction risk into the same security view as the source.
