Every agent, skill and MCP server you install is a stranger's code running as you. This inspects it before it lands, contains it while it runs, and gives you one clear answer.
Agents and skills spread like npm packages or browser extensions. Most are fine. The dangerous ones look identical — until they're already running with your keys.
A single markdown file or setup.sh can read your SSH keys, dump your environment to a webhook, or pipe a remote script straight into your shell.
Hidden instructions in tool descriptions. Zero-width characters your eyes can't see. Text that tells your agent to leak secrets and stay quiet about it.
→ prompt injection · tool poisoning · hidden unicodeThe rug pull: an artifact you approved that mutates in a later update.
No one reviews every line of every add-on. So the risky ones just walk in.
Shell access, your credentials, your files. Trust it and you trust its author.
This is a real scan report, replayed. Nothing is uploaded and nothing is executed — the scanner only ever reads.
The first three read without executing. The fourth doesn't need to trust the code at all — it controls what the running process can reach.
Read the code, manifests and model-facing text before anything runs.
afw scanPin what you approved, then catch the update that silently changes it.
afw pinUnsigned and unknown sources are held to a stricter bar automatically.
--verify-signaturesDefault-deny egress, live MCP inspection, kernel-level network jail.
afw run --isolateThis page is the 30-second version. Stop here, or keep going.
No account. No API key. No telemetry. It runs entirely on your machine.