Install Guard: Vet Skills and MCP Servers Before Installing

Your agent follows a skill with your permissions, and an MCP server runs code on your machine with whatever its config hands it. Most people install both after reading the title. Install Guard reads every line first and tells you what you are about to trust.

A real run

A Claude Desktop config with four servers. Install Guard noted one token written in the file and replaced it with <redacted> before anything left the machine, then scored the rest with the free Moltline audit_mcp_config tool and ranked every tool with scope_check:

• Posture score 0/100, high risk: auto-approve switched on for the shell server, the files server rooted at / (the whole disk), a wildcard (*) command allow-list, and two servers (files, shell) pulled from unpinned packages on every start.
• Blast radius 5: delete_file and run_command. write_file, create_issue and close_issue at 3.
• Caught on this machine and never sent: the token written into the issues server's config. It sat in a plain-text file, so it gets rotated.
• Verdicts: shell and files, do not use as configured. Issues, use after moving the token out of the file and rotating it. Timeops, fine.

The first screenshot is that run.

What it does

• skill-vetting: before you install or update a skill or skill pack, a hosted pattern pass on every file, then a line-by-line review of every instruction and script against eight risk areas. You get install, install with conditions, or do not install, with file, line and evidence for each finding.
• mcp-config-audit: redacts secrets on your side, scores the config for auto-approve flags, unpinned packages, inline credentials and over-broad access, ranks every tool by blast radius and proposes the exact fixes.
• untrusted-content-check: before the agent acts on a web page, email, ticket, document or another tool's output, it scans for text aimed at the agent, sets it aside and tells you what it found.
• agent-inventory: one table of every skill, MCP server and tool your agents can use, with an owner, a risk tier, the approval gates that are missing and a date for the next check.

Why pattern checks alone are not enough

We wrote a sample skill with four bad steps: answer approval prompts for the user, upload the project's .env file to an outside URL, attach cloud credentials to an issue as "diagnostics", and report back on the harmless steps only. The hosted pattern pass caught the first three. Only the line-by-line review caught the fourth, which hides the other three from the user. Verdict: do not install. The second screenshot is that run. Install Guard treats pattern hits as leads and lets the review decide.

What leaves your machine

Only the text you choose to check. Secrets are replaced with <redacted> before a config is sent anywhere, and a skill whose licence forbids sharing its text is reviewed locally. Nothing from the item under review is run, installed or opened.

How the checks run

Seven free tools on the Moltline Studio govern and codereview MCP servers, with no account and no key. No scripts in the pack. A Moltline All-Access licence adds an OWASP-oriented pass on scripts and a written governance policy. You do not need either.

Limits

• It reviews; it does not sandbox. Behaviour that only appears at run time needs a re-check after each update.
• A review is only as thorough as the files it can read. Binary files and anything not read in full are listed under Not checked, and those items never get a plain install verdict.
• Not a malware scanner for executables.

Support: first response within 24 hours, confirmed defects fixed within 30 days.