io.github.inkog-io/inkog
Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
Ask AI about io.github.inkog-io/inkog
Powered by Claude Β· Grounded in docs
I know everything about io.github.inkog-io/inkog. Ask me about installation, configuration, usage, or troubleshooting.
0/500
Reviews
Documentation
Inkog MCP Server
Security companion for AI agent development in Claude, Cursor, and Claude Code.
Ask your AI pair-programmer to build an agent. Inkog checks it as you code β scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.
Available in Claude Desktop, Cursor, Claude Code, ChatGPT, and any MCP-compatible client.
The Dev-Flow Loop
Inkog is designed to live inside the conversation where you build the agent β not as a post-hoc gate:
- Ask Claude to build a piece of agent logic.
- Ask Claude to scan it with Inkog β
"Scan this with Inkog and show me any CRITICAL or HIGH findings." - Ask Claude to explain each finding in plain English β
"Explain the top finding. What's the risk, and how do I fix it?" - Ask Claude to apply the fixes. Review the diff, approve, re-scan.
- Before shipping, verify governance β
"Verify my AGENTS.md against the code"and"Audit the agent-to-agent delegation".
Read the full walkthrough: Building Secure AI Agents with Claude Code and the Inkog MCP.
Recommended prompts
- "Scan the current directory with Inkog and show me any CRITICAL or HIGH findings."
- "Explain the top finding in plain English. What's the risk, and how do I fix it?"
- "Verify my AGENTS.md against the code."
- "Audit the agent-to-agent delegation in this crew."
- "Run a compliance report and map the findings to EU AI Act Articles 12, 14, and 15."
- "Audit the MCP servers I'm integrating with."
When to Use Inkog
- Building an AI agent β Scan during development to catch infinite loops, prompt injection, and missing guardrails before they ship
- Adding security to CI/CD β Add
inkog-io/inkog@v1to GitHub Actions for automated security gates on every PR - Preparing for EU AI Act β Generate compliance reports mapping your agent to Article 14, NIST AI RMF, OWASP LLM Top 10
- Reviewing agent code β Use from Claude Code, Cursor, or any MCP client to get security analysis while you code
- Auditing MCP servers β Check any MCP server for tool poisoning, privilege escalation, or data exfiltration before installing
- Verifying AGENTS.md β Validate that governance declarations match actual code behavior
- Building multi-agent systems β Detect delegation loops, privilege escalation, and unauthorized handoffs between agents
What Inkog Does
- Logic Flaw Detection: Find infinite loops, recursion risks, and missing exit conditions
- Security Analysis: Detect prompt injection paths, unconstrained tools, and data leakage risks
- AGENTS.md Governance: Validate that code behavior matches governance declarations
- Compliance Reporting: Generate reports for EU AI Act, NIST AI RMF, OWASP LLM Top 10
- MCP Server Auditing: Audit any MCP server before installation
- Multi-Agent Analysis: Audit Agent-to-Agent communications for logic and security issues
Installation
Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"inkog": {
"command": "npx",
"args": ["-y", "@inkog-io/mcp"],
"env": {
"INKOG_API_KEY": "sk_live_your_api_key"
}
}
}
}
Cursor
Add to your Cursor MCP settings:
{
"mcpServers": {
"inkog": {
"command": "npx",
"args": ["-y", "@inkog-io/mcp"],
"env": {
"INKOG_API_KEY": "sk_live_your_api_key"
}
}
}
}
Global Installation
npm install -g @inkog-io/mcp
Getting Your API Key
- Sign up for free at app.inkog.io
- Copy your API key from the dashboard
- Set it as
INKOG_API_KEYenvironment variable
Available Tools
P0 - Core Analysis (Essential)
| Tool | Description |
|---|---|
inkog_scan | Static analysis for logic flaws and security risks |
inkog_verify_governance | Validate AGENTS.md declarations match actual code behavior |
P1 - Enterprise Features
| Tool | Description |
|---|---|
inkog_compliance_report | Generate EU AI Act, NIST, OWASP compliance reports |
inkog_explain_finding | Get detailed remediation guidance for findings |
inkog_audit_mcp_server | Audit any MCP server before installation |
inkog_generate_mlbom | Generate ML Bill of Materials (CycloneDX, SPDX) |
P2 - Multi-Agent Analysis
| Tool | Description |
|---|---|
inkog_audit_a2a | Audit Agent-to-Agent communications |
Tool Details
inkog_scan
Static analysis for AI agent code - finds logic flaws and security risks.
Arguments:
path (required) File or directory path to scan
policy (optional) Analysis policy: low-noise, balanced, comprehensive, governance, eu-ai-act
output (optional) Output format: summary, detailed, sarif
Example: "Scan my LangChain agent for logic flaws"
inkog_verify_governance
Validate that AGENTS.md declarations match actual code behavior. This is Inkog's unique differentiator - no other tool does governance verification.
Arguments:
path (required) Path to directory containing AGENTS.md and agent code
Example: "Verify my agent's governance declarations"
inkog_compliance_report
Generate compliance reports for regulatory frameworks.
Arguments:
path (required) Path to scan
framework (optional) eu-ai-act, nist-ai-rmf, iso-42001, owasp-llm-top-10, all
format (optional) markdown, json, pdf
Example: "Generate an EU AI Act compliance report for my agent"
inkog_explain_finding
Get detailed explanation and remediation guidance for a security finding.
Arguments:
finding_id (optional) Finding ID from scan results
pattern (optional) Pattern name (e.g., prompt-injection, infinite-loop)
Example: "Explain how to fix prompt injection vulnerabilities"
inkog_audit_mcp_server
Security audit any MCP server from the registry or GitHub.
Arguments:
server_name (optional) MCP server name from registry (e.g., "github", "slack")
repository_url (optional) Direct GitHub repository URL
Example: "Audit the GitHub MCP server for security issues"
inkog_generate_mlbom
Generate a Machine Learning Bill of Materials listing all AI components.
Arguments:
path (required) Path to agent codebase
format (optional) cyclonedx, spdx, json
include_vulnerabilities (optional) Include known CVEs (default: true)
Example: "Generate an MLBOM for my AI project"
inkog_audit_a2a
Audit Agent-to-Agent communications for security risks.
Arguments:
path (required) Path to multi-agent codebase
protocol (optional) a2a, crewai, langgraph, auto-detect
check_delegation_chains (optional) Check for infinite loops (default: true)
Example: "Audit my CrewAI multi-agent system for security risks"
Supported Frameworks
Inkog works with all major AI agent frameworks:
- LangChain / LangGraph
- CrewAI
- AutoGen
- n8n
- Flowise
- Dify
- Microsoft Copilot Studio
- Custom implementations
Configuration
All configuration is done via environment variables:
| Variable | Description | Default |
|---|---|---|
INKOG_API_KEY | Your API key (required) | - |
INKOG_API_URL | API base URL | https://api.inkog.io |
INKOG_API_VERSION | API version | v1 |
INKOG_API_TIMEOUT | Request timeout (ms) | 30000 |
INKOG_LOG_LEVEL | Log level | info |
INKOG_LOG_FORMAT | Log format (json/text) | json |
Development
# Install dependencies
npm install
# Build
npm run build
# Run in development mode
npm run dev
# Run tests
npm test
# Lint
npm run lint
Why Inkog?
Security in the Dev-Flow, Not After It
Most AI agent security tools run after the code is written. Inkog lives inside the conversation where you build the agent β so findings get fixed before they land in a PR, not three weeks later.
The Only Tool with AGENTS.md Verification
Inkog is the only tool that can validate your agent's governance declarations against its actual code behavior. This is essential for:
- EU AI Act Article 14 compliance (human oversight)
- Enterprise governance requirements
- Preventing governance drift as code evolves
Purpose-Built for AI Agents
Unlike traditional code scanners (Snyk, Semgrep, SonarQube), Inkog understands AI-specific issues:
- Infinite loops and recursion risks
- Prompt injection paths
- Unconstrained tool access
- Missing exit conditions
- Cross-tenant data leakage
Multi-Framework Support
Inkog's Universal IR (Intermediate Representation) works with any agent framework. Add one integration, get analysis for all frameworks.
License
Apache-2.0 - see LICENSE
Links
Built with security by Inkog.io
