SureX

In September 2025, an npm package called postmark-mcp behaved exactly like the real Postmark server for 15 versions. Version 1.0.16 added one line that BCC'd every outgoing email to an attacker. It ran for weeks.

Nothing in the MCP stack would have caught that. A server listed in your agent's config runs with your agent's permissions: your files, your keys, your shell. There is no step between "listed" and "reading your SSH keys".

SureX is that step. A Claude Code plugin fingerprints each MCP server from its install config and checks the registry before the call executes. Flagged at high severity, and the call stops alerting you. Unknown, and you get a warning. Every block is overridable in one command printed in the block itself, because a block you cannot override gets the gate uninstalled the first time it is wrong.

Entries come from humans, gated by World ID. That kills block-as-DoS. An open-source model on an on-site DGX reads submitted source against what the server claims to do.

Intent-matching checks consistency, since a server that says "runs commands as requested" agrees with itself perfectly.

Scanning already exists. A registry that is re-reviewed every release, enforced at the moment of the call, hard for its own operator to rewrite, and contestable by an agent, does not.

The plugin is where the product lives. It fires before every MCP call, and matcher sees every MCP tool and can return a deny decision. That interception point is what makes enforcement possible

Storage. Walrus and Arkiv split by access pattern, not by preference. Every record — source snapshot, verdict, dispute — is a Walrus blob, so the ID is derived from the exact bytes and nobody, us included, can quietly rewrite what a verdict said. Arkiv on Braga holds the queryable entity that points at each blob and carries the decision fields: state, severity, tier, disputed. Because the gate sits in front of every tool call, the hot path is one Arkiv query; the evidence body is fetched from Walrus only when a human is about to read it. Arkiv entities are time-scoped, which fits the record model — verdict history is append-only and source snapshots have a natural retention horizon, so expiration is something we set per record class rather than work around.

Review. Review runs on an on-site DGX against an open-source model, behind an OpenAI-compatible endpoint so the model could be swapped if the box died mid-build. Source is content-isolated in the prompt and reviewed twice, the second pass against a paraphrase. Disagreement between the two runs caps confidence instead of producing a flag. Text in the source that tries to instruct the reviewer is itself a high-severity finding, so an injection attempt becomes evidence rather than a route to a clean verdict.