Use Case

AI Security Auditing
Before Deployment.

Every AI module you deploy is a supply-chain risk. Mr. Technology publishes scanner-backed verdicts for audited registry entries and clearly marks entries that are still pending or incomplete.

The Problem
  • ✗ NPM packages with known-malicious transitive dependencies
  • ✗ Hardcoded API keys and secrets in agent code
  • ✗ Over-permissioned tool bindings that exfiltrate data
  • ✗ Deprecated registries pointing to compromised packages
  • ✗ No CVE history on modules from GitHub repos
How Mr. Technology Fixes It
  • ✓ gitleaks scans mirrored source for exposed secrets and credentials
  • ✓ Semgrep checks agent-specific unsafe code and tool-call patterns
  • ✓ Trivy checks dependencies and source for known vulnerabilities
  • ✓ Provenance review records source, revision, content-hash, license, and evidence gaps
  • ✓ Verdicts distinguish CLEAN, FLAGGED, ERROR, QUARANTINE, and incomplete scans

Available Security Modules

TIER 3Dependency-Auditor

Scans lockfiles and transitive dependencies against our CVE database. Identifies known-malicious packages, deprecated registries, and supply-chain anomalies before they reach production.

CVE lookup + transitive risk scoring
TIER 4Security-Auditor

Static analysis using gitleaks, Semgrep, and Trivy. Surfaces exposed credentials, unsafe code patterns, and vulnerable dependencies; human review adds context for the paid assessment.

gitleaks + Semgrep + Trivy + human review
TIER 4MCP-Audit

Audit framework specifically for Model Context Protocol servers. Maps tool permissions, auth flows, and data exfiltration paths in MCP server implementations.

MCP-specific permission analysis

What the active audit actually runs

Tier-2 verdicts combine the scanner evidence available for each source. Entries without sufficient evidence remain visibly pending or incomplete.

gitleaks
Hardcoded credentials, API keys, tokens, private keys. Custom ruleset tuned for agent code paths.
semgrep
Static analysis against custom agent-rules — prompt injection sinks, exfil channels, unsafe tool calls.
trivy
Dependency and source vulnerability scan using Trivy's current advisory database, with recorded severity and fixed-version fields where available.
provenance review
Source path, captured commit, exact content hash, license evidence, and scanner-evidence gaps are reviewed explicitly.
verdict engine
Combines available scanner output into CLEAN, FLAGGED, ERROR, QUARANTINE, or INCOMPLETE status. Each record shows the evidence and timestamp currently stored.

Tier-2 audit pipeline active across the public registry.

Free registry. Fixed-scope assessments.

Free — no signup
Browse the full registry, inspect recorded verdicts and evidence gaps, and follow upstream source before evaluating anything in your own environment.
Publisher Skill Audit — $299 once
One repository, active scanner evidence, human review, provenance inventory, PDF + JSON report, and one remediation rescan.

Assessing a larger private skill set? Email editor@mr.technology before purchase for a separate written scope. The $299 founding offer is for one authorized repository at one pinned revision and up to 10 skill directories.

View publisher audit scope →