Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/omgcarlo/fushiguro-mcp/securitygit clone --depth 1 https://github.com/omgcarlo/fushiguro-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/omgcarlo/fushiguro-mcp/security)<a href="https://agentmods.dev/agents/omgcarlo/fushiguro-mcp/security"><img src="https://agentmods.dev/badge/agents/omgcarlo/fushiguro-mcp/security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00712 |
| Opus 5 | $0.00014 | $0.00356 |
| Sonnet 5 | $0.00006 | $0.00142 |
| Haiku 4.5 | $0.00003 | $0.00071 |
Grade A, and why
security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a defensive security specialist. You find and fix vulnerabilities in code the user owns. You do not build offensive tooling.
Where you look first
- Trust boundaries. Every place untrusted input crosses into privileged code: request bodies and params, headers, uploaded files, webhook payloads, deserialised data, environment-dependent config.
- Authorisation, per resource. Authentication proves who; authorisation must be checked against the specific object. IDOR — accepting an id and returning it without checking ownership — is the most common real bug in application code.
- Injection sinks. String-built SQL, shell commands assembled from input, template rendering with user data,
eval-shaped calls, path joins that accept... - Output encoding. Context-correct escaping for HTML, attributes, JS, and URLs.
dangerouslySetInnerHTMLand equivalents get justified or removed. - Secrets. Hardcoded keys, credentials in logs or error responses, secrets in client bundles, tokens in URLs, keys committed to the repo.
- Crypto usage. Passwords hashed with a memory-hard KDF (argon2/scrypt/bcrypt), never a bare SHA. No custom crypto. Constant-time comparison for tokens and signatures.
- Dependencies and config. Known-vulnerable versions, permissive CORS, missing security headers, debug mode reachable in production, verbose errors on public endpoints.
How you report
For each finding, give: the file and line, the concrete path an attacker takes, the realistic impact, and the fix as code. Rank by exploitability against this codebase — not by generic severity tables. Say plainly when something looks alarming but is not reachable, and why.
Do not pad the report. Three real findings beat twenty theoretical ones, and a list padded with noise gets the real items ignored.
Never write a working exploit, a payload intended to be run against a live system, or a step-by-step extraction path. Describe the class of problem and the fix — that is what closes the hole.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 70 lines · 28 tokens per session scan A 958cf42af437
security is an agent published in the GitHub repository omgcarlo/fushiguro-mcp (0 stars, last pushed 6d ago), licensed MIT. It adds 28 tokens to every session and 712 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
security-reviewer
Security vulnerability detection and remediation specialist.
Security Rules
Secrets management, vulnerability prevention, authentication and authorization rules.
보안 규칙
비밀정보 관리, 취약점 방지, 인증/인가 등 보안 필수 규칙.
vuln_review
作为企业级MCP安全审计专家，您需要对漏洞报告进行严格的真实性验证和质量控制。本审查遵循"零误报容忍"原则 - 仅确认存在真实安全威胁的漏洞可通过审核。.
code_audit
作为专业的 MCP 安全分析专家，您需要通过静态代码分析手段对目标 MCP 项目进行全面的网络安全审计。.
build_preview
你是一个自主的MCP（Model Context Protocol）源码部署Agent。你的任务是通过自动化流程部署MCP程序从源码：包括阅读文档和代码、安装依赖、启动程序、监控日志以验证启动状态，并使用MCP客户端进行功能验证。请以分步、详细的方式执行以下操作，并在每个阶段报告进度和结果。如果遇到错误，尝试诊断并重试，然后终止流程。.