Inkog MCP Server

Security companion for AI agent development in Claude, Cursor, and Claude Code.

Ask your AI pair-programmer to build an agent. Inkog checks it as you code — scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.

Available in Claude Desktop, Cursor, Claude Code, ChatGPT, and any MCP-compatible client.

The Dev-Flow Loop

Inkog is designed to live inside the conversation where you build the agent — not as a post-hoc gate:

1. Ask Claude to build a piece of agent logic.
2. Ask Claude to scan it with Inkog — "Scan this with Inkog and show me any CRITICAL or HIGH findings."
3. Ask Claude to explain each finding in plain English — "Explain the top finding. What's the risk, and how do I fix it?"
4. Ask Claude to apply the fixes. Review the diff, approve, re-scan.
5. Before shipping, verify governance — "Verify my AGENTS.md against the code" and "Audit the agent-to-agent delegation".

Read the full walkthrough: Building Secure AI Agents with Claude Code and the Inkog MCP.

Recommended prompts

- "Scan the current directory with Inkog and show me any CRITICAL or HIGH findings."
- "Explain the top finding in plain English. What's the risk, and how do I fix it?"
- "Verify my AGENTS.md against the code."
- "Audit the agent-to-agent delegation in this crew."
- "Run a compliance report and map the findings to EU AI Act Articles 12, 14, and 15."
- "Audit the MCP servers I'm integrating with."

When to Use Inkog

- Building an AI agent — Scan during development to catch infinite loops, prompt injection, and missing guardrails before they ship
- Adding security to CI/CD — Add inkog-io/inkog@v1 to GitHub Actions for automated security gates on every PR
- Preparing for EU AI Act — Generate compliance reports mapping your agent to Article 14, NIST AI RMF, OWASP LLM Top 10
- Reviewing agent code — Use from Claude Code, Cursor, or any MCP client to get security analysis while you code
- Auditing MCP servers — Check any MCP server for tool poisoning, privilege escalation, or data exfiltration before installing
- Verifying AGENTS.md — Validate that governance declarations match actual code behavior
- Building multi-agent systems — Detect delegation loops, privilege escalation, and unauthorized handoffs between agents

What Inkog Does

- Logic Flaw Detection: Find infinite loops, recursion risks, and missing exit conditions
- Security Analysis: Detect prompt injection paths, unconstrained tools, and data leakage risks
- AGENTS.md Governance: Validate that code behavior matches governance declarations
- Compliance Reporting: Generate reports for EU AI Act, NIST AI RMF, OWASP LLM Top 10
- MCP Server Auditing: Audit any MCP server before installation
- Multi-Agent Analysis: Audit Agent-to-Agent communications for logic and security issues

Installation

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "inkog": {
      "command": "npx",
      "args": ["-y", "@inkog-io/mcp"],
      "env": {
        "INKOG_API_KEY": "sk_live_your_api_key"
      }
    }
  }
}

Cursor

Add to your Cursor MCP settings:

{
  "mcpServers": {
    "inkog": {
      "command": "npx",
      "args": ["-y", "@inkog-io/mcp"],
      "env": {
        "INKOG_API_KEY": "sk_live_your_api_key"
      }
    }
  }
}

Global Installation

npm install -g @inkog-io/mcp

Getting Your API Key

1. Sign up for free at app.inkog.io
2. Copy your API key from the dashboard
3. Set it as INKOG_API_KEY environment variable

Available Tools

P0 - Core Analysis (Essential)

| Tool | Description |
|------|-------------|
| inkog_scan | Static analysis for logic flaws and security risks |
| inkog_verify_governance | Validate AGENTS.md declarations match actual code behavior |

P1 - Enterprise Features

| Tool | Description |
|------|-------------|
| inkog_compliance_report | Generate EU AI Act, NIST, OWASP compliance reports |
| inkog_explain_finding | Get detailed remediation guidance for findings |
| inkog_audit_mcp_server | Audit any MCP server before installation |
| inkog_generate_mlbom | Generate ML Bill of Materials (CycloneDX, SPDX) |

P2 - Multi-Agent Analysis

| Tool | Description |
|------|-------------|
| inkog_audit_a2a | Audit Agent-to-Agent communications |

Tool Details

inkog_scan

Static analysis for AI agent code - finds logic flaws and security risks.

Arguments:
  path     (required) File or directory path to scan
  policy   (optional) Analysis policy: low-noise, balanced, comprehensive, governance, eu-ai-act
  output   (optional) Output format: summary, detailed, sarif

Example: "Scan my LangChain agent for logic flaws"

inkog_verify_governance

Validate that AGENTS.md declarations match actual code behavior. This is Inkog's unique differentiator - no other tool does governance verification.

Arguments:
  path     (required) Path to directory containing AGENTS.md and agent code

Example: "Verify my agent's governance declarations"

inkog_compliance_report

Generate compliance reports for regulatory frameworks.

Arguments:
  path      (required) Path to scan
  framework (optional) eu-ai-act, nist-ai-rmf, iso-42001, owasp-llm-top-10, all
  format    (optional) markdown, json, pdf

Example: "Generate an EU AI Act compliance report for my agent"

inkog_explain_finding

Get detailed explanation and remediation guidance for a security finding.

Arguments:
  finding_id (optional) Finding ID from scan results
  pattern    (optional) Pattern name (e.g., prompt-injection, infinite-loop)

Example: "Explain how to fix prompt injection vulnerabilities"

inkog_audit_mcp_server

Security audit any MCP server from the registry or GitHub.

Arguments:
  server_name    (optional) MCP server name from registry (e.g., "github", "slack")
  repository_url (optional) Direct GitHub repository URL

Example: "Audit the GitHub MCP server for security issues"

inkog_generate_mlbom

Generate a Machine Learning Bill of Materials listing all AI components.

Arguments:
  path                     (required) Path to agent codebase
  format                   (optional) cyclonedx, spdx, json
  include_vulnerabilities  (optional) Include known CVEs (default: true)

Example: "Generate an MLBOM for my AI project"

inkog_audit_a2a

Audit Agent-to-Agent communications for security risks.

Arguments:
  path                    (required) Path to multi-agent codebase
  protocol                (optional) a2a, crewai, langgraph, auto-detect
  check_delegation_chains (optional) Check for infinite loops (default: true)

Example: "Audit my CrewAI multi-agent system for security risks"

Supported Frameworks

Inkog works with all major AI agent frameworks:

- LangChain / LangGraph
- CrewAI
- AutoGen
- n8n
- Flowise
- Dify
- Microsoft Copilot Studio
- Custom implementations

Configuration

All configuration is done via environment variables:

| Variable | Description | Default |
|----------|-------------|---------|
| INKOG_API_KEY | Your API key (required) | - |
| INKOG_API_URL | API base URL | https://api.inkog.io |
| INKOG_API_VERSION | API version | v1 |
| INKOG_API_TIMEOUT | Request timeout (ms) | 30000 |
| INKOG_LOG_LEVEL | Log level | info |
| INKOG_LOG_FORMAT | Log format (json/text) | json |

Development

```bash