Govern at the Choke Point
MCP Safety Labels Run on the Honor System. We Checked 31 Popular Servers.
Every MCP tool describes its own risk, and clients take its word. actlint audited 31 popular servers — Stripe, GitHub, Cloudflare, Linear, Firecrawl, and more. Most labels are honest. Four are wrong, and every wrong label fails the same way.
Jul 19, 2026 · 13 min read
AI Proposes, Rules Decide
Introducing actlint
actlint is our first open-source project: a static, deterministic linter that checks whether an MCP server's declared risk hints match what it actually does.
Jul 10, 2026 · 8 min read
Agents Speak Intent, Not Implementation
MCP secures the pipe. It doesn’t govern the action.
The Model Context Protocol standardizes how agents discover and call tools. It says nothing about whether a given call should be allowed — and that question is the whole game.
Jun 24, 2026 · 7 min read