Security posture

Every claim here is checkable without taking our word for it.

Residency

Scans, baselines, the call log and the decide screen are local files and localhost. Nothing is uploaded, so there is no vendor to breach. Watch the network while it runs.

No agent bypass

A denial names no override and no command that would lift it. Approval requires the person at the keyboard: mcpgawk approve refuses inside an agent session, and so does mcpgawk decide. These properties are pinned by the public test suite.

Consent before code runs

Scanning a local server means launching it. That never happens without your yes: non-interactive runs default to deny, and an unrecognised answer is never agreement.

The panel's token model

The panel serves on localhost and renders nothing from the network. Action buttons work only through the tokened link printed in your terminal, so a bookmark, a restored tab, or an agent that opens the page gets a read-only view.

Verdicts carry their basis

Every decision says whether it rests on a declared surface or on observed behaviour, so you can calibrate trust in a block, or in the absence of one, without guessing.

Honest limits

Agents with no hook point are named in mcpgawk status, not silently left out. Account-side connectors that cannot be scanned are listed as exactly that. A partial picture labels itself partial, and a run that could not finish is never reported as clean.

Read the code

The engine is Apache-2.0 on GitHub, with the threat model written down, including what it does not defend against.