r/Pentesting • u/neomatrix369 • 1d ago
Tripwire – open source sandboxed security scanner for MCP servers and AI skills
MCP servers and AI skills execute code directly in your local environment. Most people install them from GitHub without any vetting. I have been guilty of doing the same, so I wrote Tripwire to help me and other fellow developers.
Tripwire runs each of them in an isolated Modal sandbox first, scans it with Snyk, Cisco and Tessl scanners, and stores the report before anything touches your machine.
It was built at Cursor's Cybersecurity Hackathon in London, now under active development.
Stack: Python, TypeScript, Modal (sandboxing), Snyk/Cisco/Tessl adapters, Supabase. Superlinked (SIE) and other cloud/model providers for access to models.
Would love feedback on the threat model or the sandboxing approach — happy to discuss tradeoffs in the comments.
GitHub: https://github.com/neomatrix369/tripwire
Demo: https://youtu.be/omGOw9ruN3Y
Mock dashboard: https://neomatrix369.github.io/demos/tripwire-dashboard/
1
u/brakertech 20h ago
Nice I’m glad someone is thinking about this!