Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
Most developer tooling work still happens through a UI a human drives. Inkog MCP server moves it into the conversation instead. Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
Ask your AI pair-programmer to build an agent. Inkog checks it as you code — scanning for vulnerabilities, explaining findings in plain English, verifying AGENTS.md governance, and auditing agent-to-agent delegation. All inside the same conversation, no context switch.
The server publishes 8 tools. What each one is for:
Cursor — The Cursor tool exposed by this serverinkog_scan — Static analysis for AI agent code - finds logic flaws and security risksinkog_verify_governance — Validate that AGENTS.md declarations match actual code behavior. This is Inkog's unique differentiator - no other tool does governanceinkog_compliance_report — The inkog_compliance_report tool exposed by this serverinkog_explain_finding — Get detailed explanation and remediation guidance for a security findinginkog_audit_mcp_server — The inkog_audit_mcp_server tool exposed by this serverinkog_generate_mlbom — Generate a Machine Learning Bill of Materials listing all AI componentsinkog_audit_a2a — The inkog_audit_a2a tool exposed by this server@inkog-io/mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
Configuration is passed through the environment: INKOG_API_KEY, INKOG_API_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Inkog's toolset — Cursor, inkog_scan, inkog_verify_governance and 5 more — is a fair guide to whether it matches your workflow. It is maintained by inkog-io; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Cursor | The Cursor tool exposed by this server. |
| inkog_scan | Static analysis for AI agent code - finds logic flaws and security risks. |
| inkog_verify_governance | Validate that AGENTS.md declarations match actual code behavior. **This is Inkog's unique differentiator** - no other tool does governance verification. |
| inkog_compliance_report | The inkog_compliance_report tool exposed by this server. |
| inkog_explain_finding | Get detailed explanation and remediation guidance for a security finding. |
| inkog_audit_mcp_server | The inkog_audit_mcp_server tool exposed by this server. |
| inkog_generate_mlbom | Generate a Machine Learning Bill of Materials listing all AI components. |
| inkog_audit_a2a | The inkog_audit_a2a tool exposed by this server. |
{
"mcpServers": {
"inkog": {
"command": "npx",
"args": ["-y", "@inkog-io/mcp"],
"env": {
"INKOG_API_KEY": "sk_live_your_api_key"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| INKOG_API_KEY | Credential the server authenticates with. | Yes |
| INKOG_API_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.