agentmetry: open-source MCP proxy flags rug-pulls and hidden characters in tool descriptions
blitzcrieg11 · reddit · 2026-10-12
After a popular post on scanning MCP tool descriptions for hidden characters, the author shipped agentmetry (Apache-2.0, local, wraps any stdio server via agentmetry mcp-proxy -- <server>):
Shipped today
- Rug-pull signal: hashes everything tools/list returns (names, descriptions, schemas, annotations, meta — stripping meta no longer bypasses), SIEM alert when the digest moves while the command line stays fixed
- Hidden-character detection: counts tag-block, zero-width and bidi control chars with context exemptions (ZWJ between emoji, ZWNJ near Persian/Devanagari, bidi in genuine RTL text)
- Counts, never the text: poisoned descriptions aren't stored or forwarded to sinks
- The proxy never launches servers itself — timed npx -y runs whatever the registry serves, which is the attack
Roadmap from community feedback: scanning prompts/resources/templates (#187), instruction-style descriptions as baseline-free signals (#188), homoglyph warnings with trust levels (#189), raw text for detection and escaped code points for display.
The author is soliciting counterexamples to the homoglyph rule.
More from coding & agent
- Runlayer launches secured Muse connectors to govern agent access to company data — gabriel1 · 2026-10-13
- AI agents write 3x more code but PRs merge 4x slower: ZeroSlop CI gates strip 94% of AI bloat — Exciting_Item_2732 · 2026-10-13
- Meta's Alexandr Wang shares one-line curl install for Muse Code — alexandr_wang · 2026-10-13
- When is an AI agent worth it? A 4-condition checklist and ROI formula — emmanuelvivier · 2026-10-13
- Meta explains Muse Wonder's Active Memory and Active Focus for long-running agents — AIatMeta · 2026-10-13
- One wrong 'merge it' prompt shipped ts-rust to T3 Code for 8 hours unnoticed — zeeg · 2026-10-13