TRIPWIRE
{{ monitoringLabel }}
1,184 malicious skills confirmed on a major agent marketplace // 40+ MCP CVEs disclosed in four months // 1.23M+ malicious packages blocked across npm, PyPI, Maven, NuGet, Hugging Face // 82% of MCP implementations expose path-traversal-prone file operations // 36% of tested agent skills carry a security flaw // 1,184 malicious skills confirmed on a major agent marketplace // 40+ MCP CVEs disclosed in four months // 1.23M+ malicious packages blocked across npm, PyPI, Maven, NuGet, Hugging Face // 82% of MCP implementations expose path-traversal-prone file operations // 36% of tested agent skills carry a security flaw
Frontline Hackathon London 2026 — Claude Code Integration

Every skill, MCP server, and tool your agent installs is unreviewed code, handed a trusted seat in your session.

Tripwire scans agentic artifacts before Claude Code trusts them — and blocks the ones that shouldn't be running in your terminal.

View the repo ↗
SENSOR-01
pre-tooluse hook — live scan path
SENSOR-05
SEC / 01
The scale of the problem

The perimeter around agentic tooling is undefended

Skills, MCP servers, and packages are the new install surface for coding agents — and 2026 is the year attackers noticed.

active threat / confirmed harm exposure / trend to watch what Tripwire protects
Active threat
36%
of agent skills tested in Snyk's ToxicSkills study contained a security flaw — 1,467 vulnerable or malicious payloads found.
Snyk, ToxicSkills research, 2026
Confirmed malicious
1,184
malicious skills confirmed on a single major agent-skill marketplace by independent researchers.
Antiy CERT, 2026
CVEs disclosed
40+
MCP CVEs disclosed in the first four months of 2026 alone — roughly one filed every four days.
Community CVE tracking, Jan–Apr 2026
Exposure
82%
of MCP implementations analyzed used file operations prone to path traversal; 67% carried code-injection risk.
Endor Labs, 2,614 implementations
Cumulative harm
1.23M+
cumulative malicious open-source packages blocked across npm, PyPI, Maven, NuGet and Hugging Face — up 75% YoY.
Sonatype, State of the Software Supply Chain, 2026
Trend
10x
growth in daily skill submissions to a major marketplace within weeks in early 2026 — outpacing any human review capacity.
Snyk, ToxicSkills research, 2026
SEC / 02
Anatomy of a breach

It doesn't look like an attack. That's the point.

Documented 2026 incidents follow the same three beats — a helpful-looking install, a trusted execution context, and a quiet exfiltration.

01 — INSTALL

One command, zero review

A skill, MCP server, or package is added the same way a trusted one would be. Marketplaces prioritize openness over vetting — there's no gate at the door.

02 — TRUST

The agent can't tell data from instructions

Once loaded, its content sits in the same context the agent reasons over. A dependency helper can quietly redirect installs; a config file can inject commands before any trust dialog appears.

03 — BREACH

Credentials, secrets, lateral spread

API keys, SSH keys, and environment variables are exfiltrated through normal-looking output — "installing dependency," "running scan" — while the malicious path persists for every future call.

SEC / 03
How Tripwire stops it

A scan on the wire, before anything runs

Tripwire sits between Claude Code's hook system and every skill, tool, or MCP call — dispatching to a scanner and relaying a verdict before execution proceeds.

Claude Code
Hook event
PreToolUse fires before any skill/tool/MCP call
Thin handler
Handler script
pre-tool-use.sh — checks config, shells to guard
Engine
tripwire CLI
submit-for-scan & status APIs
Dispatch
Scanner layer
Routed to the right check
built-in DepShield Ossprey
Verdict
RAG status
Exit code / stdout JSON relayed back
Green

Clean

Scanned within the validity window, no findings. Runs — soft-report only.

Amber

Reported

Findings below the block threshold. Logged and surfaced, execution allowed.

Red

Blocked

At or above threshold. Execution is refused — always with an explicit block reason.

Unscanned / Stale

Fail closed

Never scanned, or scan older than the validity window — blocked when enforcement is on.

SEC / 04
Shipped today

Five Claude Code skills, wired to a live enforcement layer

Built at Frontline Hackathon London 2026: the integration layer that connects Claude Code's hook system to Tripwire's existing scan engine — enforcing from the moment of install.

/tw-verify [name(s)]

Resolves one or more names, reports fresh / stale / unscanned / scanning / not-found status — human table and JSON.

/tw-scan [name(s)] --force

Submits artifacts for scanning via Tripwire's existing API. --force resubmits over a valid result.

/tw-enable

Turns on enforcement across skills, tools, and MCP uniformly via the config flag.

/tw-disable

Full bypass at the enforcement layer. Manual verify/scan keep working regardless.

/tw-self-check

Runs the same status logic against Tripwire's own five skills — the guard, guarding itself.

pre-tool-use.sh · fail-closed on error
Enforcement default
enabled
Scan validity window
14 days
Unscanned artifacts
blocked
Install path
tripwire setup-agent-hooks
SEC / 05
Where it goes next

From hook wiring to full dispatch coverage

The integration layer is live. What extends next is Tripwire's own dispatch capability — pluggable scanners behind the same RAG verdict contract.

Phase 1 — Hook & skill integration

Handler scripts, PreToolUse wiring, config bootstrap, the five /tw-* skills, demo artifacts, regression pass.

Shipped at Frontline Hackathon
2

DepShield

Dependency-focused scanner added as a pluggable dispatch target.

Next on the list
3

Ossprey dispatch

Access provisioning, then wiring as a second pluggable scanner.

4

CLI monitoring

Runtime visibility into what's actually being invoked, not just what's installed.

5

Full-chain validation

End-to-end verification across the whole pipeline — including running /tw-self-check as a live gate.

6

FE/BE rearchitecture

The integration layer's own frontend and backend, rebuilt on what Phases 1–5 proved out.

Enforcement should start at install, not after the first incident.

$ tripwire setup-agent-hooks
Use the "About" button in the nav to return here
{{ stat.value }}
{{ stat.label }}
No matches
{{ filterEmptyTitle }}
{{ filterEmptyDetail }}
{{ item.name }}
{{ item.statusGlyph }} {{ item.statusLabel }}
{{ item.typeLabel }}
{{ item.riskBadge }}{{ item.riskTooltip }} {{ item.qualityBadge }}{{ item.qualityTooltip }} {{ item.timeLabel }} {{ item.findingCountParts.red }}● {{ item.findingCountParts.amber }}▲ {{ item.findingCountLabel }} {{ item.scannerStatBadge }}
⟳ changed since last scan
{{ item.routerStrip.stripText }} {{ item.routerStrip.badgeLabel }}
{{ item.locusLabel }}
{{ item.availLabel }}
No matches
{{ filterEmptyTitle }}
{{ filterEmptyDetail }}
{{ row.name }}
{{ row.typeLabel }}
{{ row.timeLabel }}
{{ row.statusGlyph }} {{ row.statusLabel }}
{{ row.riskBadge }}{{ row.riskTooltip }}
{{ row.sourceLabel }}
Scan history
{{ h.name }} {{ h.timeLabel }} {{ h.duration }} {{ h.statusLabel }}
{{ selectedView.name }}
{{ selectedView.typeLabel }} · {{ selectedView.identifier }}
{{ selectedView.statusGlyph }} {{ selectedView.statusLabel }}
{{ selectedView.findingCountParts.red }}● {{ selectedView.findingCountParts.amber }}▲
{{ selectedView.findingCountLabel }}
{{ selectedView.qualityBadge }}{{ selectedView.qualityTooltip }}
{{ selectedView.riskBadge }}{{ selectedView.riskTooltip }}
{{ selectedView.locusLabel }}
{{ selectedView.availLabel }}
Last scan {{ selectedView.timeLabel }}
{{ selectedView.qualityScheduleCue }}
{{ selectedView.errorMessage }}
Risk over time
Diff vs previous scan
+ new: {{ d.message }}
resolved: {{ selectedView.diff.resolved.length }} · persisted: {{ selectedView.diff.persisted.length }}
Scanners disagree on this finding — flagged for Phase 5 reconciler review.
AI Routing
{{ selectedView.routerStrip.stripText }} {{ selectedView.routerStrip.badgeLabel }}
Models: {{ selectedView.routerStrip.envModels }}
{{ selectedView.routerStrip.signalsText }}
SIE: {{ selectedView.routerStrip.envSie }}
SIE only — not escalated · No Model Studio call
SIE not called · No Model Studio call
{{ selectedView.routerStrip.msLabel }}: {{ selectedView.routerStrip.msReasoning }}
{{ selectedView.routerStrip.rawFallback }}
{{ selectedView.findingsHeadingLabel }}
{{ f.category }}{{ f.scanner }}
{{ f.message }}
tool: {{ f.entity_name }}
{{ f.file_path }}:{{ f.location }}
{{ f.snippet }}
Sandbox evidence
sandbox_id: {{ selectedView.sandbox.id }}
egress policy: {{ selectedView.sandbox.egressPhase }}
⛔ denied egress: {{ deny.host }} — {{ deny.reason }}
✓ cleanup confirmed
Scanner outputs ({{ selectedView.scannersViewLabel }})
◌ Scan in progress — waiting for Modal scanner output…
Started {{ selectedView.scanStartedAtLabel }}
{{ scv.chevron }} {{ scv.source }}
{{ scv.tesslQuality.headerBadge }}{{ scv.tesslQuality.tooltip }} {{ scv.statusLabel }} {{ scv.checks_run }} checks {{ scv.durationLabel }}
◌ Scanner running on Modal sandbox…
{{ scv.output.raw_summary }}
⊘ {{ scv.output.reason }}
⚠ {{ scv.output.error }}
{{ scv.tesslQuality.label }}{{ scv.tesslQuality.tooltip }}
{{ scv.tesslQuality.scheduleCue }}
Modal console output
{{ scv.output.console_output }}
Findings from this scanner
{{ sf.message }}
{{ sf.file_path }}:{{ sf.location }}
{{ sf.snippet }}
Raw output
{{ scv.outputJson }}
Data Source
Controls whether the entire dashboard (all tabs) loads live data from Supabase or uses built-in demo fixtures.
{{ dataSourceChip.label }}
Monitoring
{{ monitoringHelpText }}
Threshold
Calls at or above this severity are blocked
Simulated tool calls
{{ row.tool }}
on {{ row.server }} · item status: {{ row.itemStatusLabel }}
{{ row.resultView.text }}
Last scan: {{ footerLastScan }}
Primary stack: Tripwire · Modal · Supabase · Cursor
Scanners: Cisco Skill/MCP Scanner · Snyk · Tessl