Chaintrap Agent Shield

Marketplace  ·  GitHub  ·  Privacy

AI-coding supply-chain security for Cursor / VS Code. Chaintrap inventories registry pins (npm, PyPI, Maven, Go, crates, and other OSV ecosystems) in the open workspace and in MCP configs, classifies each as malicious packages or vulnerable packages (CVE/GHSA), and surfaces a posture rollup so you can review what the agent pulled in.

Fix issues

The Fix issues control is the tools icon on Workspace posture, Dependencies, and MCP servers. One click plans the workspace; you confirm before any file is written.

The confirm dialog groups every action and says why:

• Delete known-bad or OSV malware pins (and that MCP server) from the manifest.
• Pin / upgrade unpinned or range specs, and vulnerable exact pins, to the highest OSV-clean version that fits (same major first; later major only if every same-major release is still dirty).
• Skip what cannot be edited safely: URL/docker MCP, git/file specs, hashed lockfile with no sibling manifest, Swift/Hex/Gradle DSLs, or no clean published version.

Edits manifests (package.json, requirements.txt, pom.xml, go.mod, Cargo.toml, Gemfile, composer.json, pubspec.yaml, mcp.json, and similar). It does not rewrite hashed lockfiles and does not run npm, npx, pip, cargo, go, or mvn. After a write, posture counts refresh from disk and Checked this workspace records when Fix issues last ran and when malware/CVE last hit zero.

Why this exists

• Agents edit lockfiles and MCP configs. That’s where malicious packages and vulnerable versions land.
• MCP servers often run via npx / pip. Those pins are dependencies too — just not in your package.json.
• You need visibility in the editor. Review baseline vs “delta since this session opened” before you trust outputs.

Coverage

• Dependencies: workspace manifests and lockfiles across OSV ecosystems (npm including bun.lock, PyPI including pyproject.toml, Maven pom.xml / Gradle lockfiles, Go, Cargo, RubyGems, NuGet, Packagist, GitHub Actions, Pub, Hex, Swift, Hackage, CRAN, Conan). With a lockfile, locked transitives are included. Manifest-only trees get a coverage gap (direct pins only). Unparseable project files (e.g. Gradle DSL without gradle.lockfile) are listed as present-not-scanned, not skipped silently.
• MCP servers (MCP security): the package inferred from each server entry in workspace .vscode/mcp.json or .cursor/mcp.json (for example npx, uvx, pipx, go run, cargo install), plus user-level MCP configs. URL, docker, and java -jar servers stay unchecked with a reason.
• Unpinned MCP servers: config has a package name and no version, so the pin cannot be checked.

Findings are malicious packages or vulnerable packages (CVE or GHSA). High and critical findings require an acknowledgement in the editor.

Malicious MCP servers are removed from that config by server id. Malicious npm and PyPI pins are removed from package.json or requirements.txt.

Operation

1. Install pri17m.chaintrap-agent-shield.
2. Open a workspace folder. Status bar: Chaintrap: scanning workspace…
3. Open the Chaintrap activity bar: Workspace posture first (attention, coverage gaps, what was checked), then Dependencies or MCP servers.
4. Click Fix issues (tools icon) to delete malware pins and write exact OSV-clean versions. Confirm the dialog first.
5. Before trusting an AI agent’s output, run Chaintrap: Review agent changes since last session.

No API key is required for the workspace scan. The extension reads dependency and MCP files in open folders, does not execute workspace code, and does not upload source. It queries OSV with package name + version only. See PRIVACY.md.

Commands

MIT. github.com/pri17m/chaintrap-agent-shield