Put the AI tool supply chain under policy.
Every agent in your company connects to MCP servers and APIs that can change their instructions at any time, without notice. Toolproof turns that moving surface into a control: cryptographically signed verdicts, CI enforcement, and replayable audit evidence.
toolproof-lock — fail the build when a tool turns hostile
Commit a signed baseline of every MCP server you depend on. CI re-checks it on every run: the surface is re-observed, a semantic diff is applied against your policy, and a tool that gained reach — a new parameter, a new outbound host, rewritten instructions — blocks the merge. Approvals can be scoped to a named tool list and bounded in time, so a grant made last quarter cannot authorise today's deploy. The same discipline you already apply to dependencies, applied to the instructions your agents read.
npx -y toolproof-lock lock https://mcp.example.com/mcp # pin the approved surface (commit toolproof.lock) npx -y toolproof-lock check --policy=toolproof.policy.json # CI gate: exit 2 blocked / 1 review
Signed evidence, not screenshots
Every gate check appends a JSONL audit line containing the full signed passport and its signature — replayable by any auditor with the public key. Compliance evidence for the newest supply chain in your stack, without inventing a new process.
The agent-side guard
The check_tool MCP server lets any employee's AI check a tool before connecting — the same verdicts, same signatures, enforced at the moment of connection, not just at merge time.
- +Unlimited trust cards & grades
- +Watchlist with diff-on-change alerts
- +check_tool MCP server (Claude, Cursor, …)
- +toolproof CLI + lock gate — MIT licensed
- +Signed passports (ed25519) on every verdict
- +Org-wide baselines, managed centrally
- +Webhook alerts on drift (Slack, PagerDuty, SIEM)
- +Private watchlists & team review workflow
- +Badge + gate enforcement across all repos
- +Priority rules & signed key rotation
- +Self-hosted scanner & signing keys
- +SSO / SAML, RBAC, org audit trails
- +SIEM streaming (Splunk, Sentinel) of signed verdicts
- +Vendor due-diligence reports on demand
- +SLA + security review support
Team & Enterprise tiers are in early access — everything on the Free tier stays free and open source. No lock-in: your baselines and audit files are plain JSON in your repos.