Perimeter is a one-command audit for your agent toolchain — MCP servers, hooks and skills. It tells you what they can do, what they cost, and what changed since last week; then gates CI.
$ perimeter audit Verdict: CRITICAL 1 critical · 2 high · 5 medium · 4 low [CRITICAL] INJECT-001 Tool poisoning: likely injection in tool description [HIGH] RISK-SHELL Arbitrary command execution [HIGH] RISK-PAYMENT Payment / financial capability [MEDIUM] RISK-FSWRITE Filesystem write access [MEDIUM] SUP-CREDS-ENV Secrets present in server config env Cost: model claude-sonnet · ~8,652 tokens/load · $0.09/load
Three questions, one command.
Catches tool poisoning, shell execution, file/credential access, payments, cloud writes and typosquatted packages — mapped to OWASP Agentic risks.
Every server burns context before it works. Measure the token footprint and dollar cost of your MCP configuration per load.
Record a baseline and flag servers that are new or silently changed — the rug-pull pattern attackers use.
--enforce exits non-zero on a finding. Block a PR before a poisoned tool reaches your agents.
perimeter session reads real agent logs and reports which tools were actually called, with exact token spend.
Text, JSON, Markdown, SARIF and a shareable HTML dashboard. Drop SARIF into GitHub code scanning.
Node built-ins only. Works offline. Install globally, run anywhere, never leaves your machine.
Two steps from an invisible setup to an audited one.
Signature-hashes every server you currently use.
Scores risk, measures cost, flags drift.
Blocks the PR / deploy when the verdict crosses your threshold.
The scanner is free and open source. Pay for governance at scale.
Runs on macOS, Linux and Windows.
$ npm install --global perimetercli $ perimeter audit Verdict: LOW (or CRITICAL, if you're on the bad kind of stack)
Not by default. The CLI is fully offline and only reads your local files. Hosted Pro features are opt-in.
MCP servers (Claude Code, Cursor, Claude Desktop, `.mcp.json`), plus agent instruction files like `AGENTS.md` and skills.
No — it's a heuristic, offline scan. It's a strong, fast first pass for CI and audit, not a runtime sandbox. Be honest about that in your own reviews.
The core CLI is MIT. Perimeter Pro is a separate hosted product.