inkog-io/inkog-mcp

**Security companion for AI agent development in Claude, Cursor, and Claude Code.**
Ask your AI pair-programmer to build an agent. Inkog checks it as you code — scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.
Available in Claude Desktop, Cursor, Claude Code, ChatGPT, and any MCP-compatible client.
The Dev-Flow Loop
Inkog is designed to live inside the conversation where you build the agent — not as a post-hoc gate:
1. **Ask Claude to build a piece of agent logic.**
2. **Ask Claude to scan it with Inkog** — "Scan this with Inkog and show me any CRITICAL or HIGH findings."
3. **Ask Claude to explain each finding in plain English** — "Explain the top finding. What's the risk, and how do I fix it?"
4. **Ask Claude to apply the fixes.** Review the diff, approve, re-scan.
5. **Before shipping, verify governance** — "Verify my AGENTS.md against the code" and "Audit the agent-to-agent delegation".
Read the full walkthrough: Building Secure AI Agents with Claude Code and the Inkog MCP.
Recommended prompts
- *"Scan the current directory with Inkog and show me any CRITICAL or HIGH findings."*
- *"Explain the top finding in plain English. What's the risk, and how do I fix it?"*
- *"Verify my AGENTS.md against the code."*
- *"Audit the agent-to-agent delegation in this crew."*
- *"Run a compliance report and map the findings to EU AI Act Articles 12, 14, and 15."*
- *"Audit the MCP servers I'm integrating with."*
When to Use Inkog
- **Building an AI agent** — Scan during development to catch infinite loops, prompt injection, and missing guardrails before they ship
- **Adding security to CI/CD** — Add inkog-io/inkog@v1 to GitHub Actions for automated security gates on every PR
- **Preparing for EU AI Act** — Generate compliance reports mapping your agent to Article 14, NIST AI RMF, OWASP LLM Top 10
- **Reviewing agent code** — Use from Claude Code, Cursor, or any MCP client to get security analysis while you code
- **Auditing MCP servers** — Check any MCP server for tool poisoning, privilege escalation, or data exfiltration before installing
- **Verifying AGENTS.md** — Validate that governance declarations match actual code behavior
- **Building multi-agent systems** — Detect delegation loops, privilege escalation, and unauthorized handoffs between agents
What Inkog Does
- **Logic Flaw Detection**: Find infinite loops, recursion risks, and missing exit conditions
- **Security Analysis**: Detect prompt injection paths, unconstrained tools, and data leakage risks
- **AGENTS.md Governance**: Validate that code behavior matches governance declarations
- **Compliance Reporting**: Generate reports for EU AI Act, NIST AI RMF, OWASP LLM Top 10
- **MCP Server Auditing**: Audit any MCP server before installation
- **Multi-Agent Analysis**: Audit Agent-to-Agent communications for logic and security issues
Installation
Claude Desktop
Add to your claude_desktop_config.json:
Cursor
Add to your Cursor MCP settings:
Global Installation
Getting Your API Key
1. Sign up for free at app.inkog.io
2. Copy your API key from the dashboard
3. Set it as INKOG_API_KEY environment variable
Available Tools
P0 - Core Analysis (Essential)
| Tool | Description |
|------|-------------|