MCPs are fun. Until they're not.

Making the use of MCPs a safe experience.

MCPs can see your files. See your secrets. We put a check in the path. Before your agent calls any tool, we look the server up, and tell you what we see so you can be SureX.

Install Now View Registry

flagged @surex/mal-tool-shadow — tier C automated only, no human auditflagged ios-simulator-mcp — tier A automated only, no human auditflagged AgentDeskAI/browser-tools-mcp — tier A automated only, no human auditflagged mcp-medellin-news — tier A automated only, no human auditflagged @surex/ambiguous-telemetry — tier C automated only, no human auditunreviewable github/github-mcp-server — tier A automated only, no human auditunreviewable @anaisbetts/mcp-installer — tier A automated only, no human auditunreviewable financial-datasets/mcp-server — tier A automated only, no human auditunreviewable @openbnb/mcp-server-airbnb — tier A automated only, no human auditunreviewable @certscore/mcp — tier C automated only, no human auditclean mcp-practice — tier A automated only, no human auditclean @surex/honest-weather — tier C automated only, no human auditclean @playwright/mcp — tier C automated only, no human auditclean @modelcontextprotocol/server-redis — tier C automated only, no human auditclean @modelcontextprotocol/server-memory — tier C automated only, no human auditclean @modelcontextprotocol/server-google-maps — tier C automated only, no human auditclean @modelcontextprotocol/server-gitlab — tier C automated only, no human auditclean @modelcontextprotocol/server-brave-search — tier C automated only, no human auditflagged @surex/mal-tool-shadow — tier C automated only, no human auditflagged ios-simulator-mcp — tier A automated only, no human auditflagged AgentDeskAI/browser-tools-mcp — tier A automated only, no human auditflagged mcp-medellin-news — tier A automated only, no human auditflagged @surex/ambiguous-telemetry — tier C automated only, no human auditunreviewable github/github-mcp-server — tier A automated only, no human auditunreviewable @anaisbetts/mcp-installer — tier A automated only, no human auditunreviewable financial-datasets/mcp-server — tier A automated only, no human auditunreviewable @openbnb/mcp-server-airbnb — tier A automated only, no human auditunreviewable @certscore/mcp — tier C automated only, no human auditclean mcp-practice — tier A automated only, no human auditclean @surex/honest-weather — tier C automated only, no human auditclean @playwright/mcp — tier C automated only, no human auditclean @modelcontextprotocol/server-redis — tier C automated only, no human auditclean @modelcontextprotocol/server-memory — tier C automated only, no human auditclean @modelcontextprotocol/server-google-maps — tier C automated only, no human auditclean @modelcontextprotocol/server-gitlab — tier C automated only, no human auditclean @modelcontextprotocol/server-brave-search — tier C automated only, no human audit

MCPS ANALYZED

REVIEWED

FLAGGED

How it works

THE CODE

Published source, at one exact version.

mcp-server-postgres 0.6.2

SEALED

An exact copy goes under seal. Change one character and it breaks.

CODE RECORD

0x8e4c…9c41

THE READING

A model reads the code against what the server says it does.

fs · net · env · exec

THE VERDICT

One judgement, sealed on its own, apart from the code it judges.

clean

THE INDEX

One entry, the only thing the check reads. It points at both sealed records.

→ code · → verdict

TIER B

THE CHECK

Runs before the tool call, on your machine.

silentbytes match

a cautionno entry

stoppeda finding

THE DISPUTEBRANCHES OFF 05

A verdict can be contested by a person, or by an agent a real human registered. Standing is checked first.

◌ STANDING CHECKEDDISPUTED · STANDING OPENSUPERSEDED, NEVER DELETED

surex plugin · confirmawaiting answer

Are you sureX you want to use @surex/mal-tool-shadow?SureX does not recommend proceeding.Finding (moderate): exfiltration gated on an env var that no tool description mentions (src/telemetry.mjs:48)This code can reach: network · filesystem · env vars · credentialsReviewed 2026-07-25 by qwen3-coder-next. No human audited this.Link to your install (C): nothing was checked.Evidence: arkiv-surex.vercel.app/r/sxf1_ceacc357…You can proceed anyway, at your own risk:surex allow sxf1_ceacc357…

Roadmap

Timeline

IN FLIGHT

Disputes with standing

BUILDING · IN FLIGHT

Humans rebut with World ID, agents with AgentKit. A fresh flag stays unconfirmed for 72 hours so the maintainer can answer first.

NOT STARTED

Train the MCP reviewer for accuracy

NEXT · NOT STARTED

The model that reads code gets measured against labelled servers, and the prompt version that scored a verdict stays recorded next to it.

NOT STARTED

Dispute on context about why it was flagged

NEXT · NOT STARTED

A rebuttal argues the reading, not only the result. The maintainer answers the exact line the model cited.

NOT STARTED

Support for other agent frameworks and harnesses

NEXT · NOT STARTED

The gate is a pre-call hook, so anything with a pre-call hook can read the registry. Each harness needs its own way to identify a server from config alone.

NO DATE

Enterprise access controls

LATER · NO DATE

Permissioned access for organisations that need a private lane: who may submit, who may override, and a record of both.

NO DATE

Encryption for closed-source MCPs with Walrus Seal

LATER · NO DATE

Closed source is unreviewable today. Sealed blobs would let a model read what nobody else can, and the record would say that is what happened.

We check the MCPs so you can explore safely.

Be Surex before calling it, not after.

surex

/plugin install surex@surex