Brin - Agent Context Security

Universal allowlist for agents. Pre-scans packages, MCP servers, repos, skills, and web pages for malware, prompt injection, and supply chain attacks. Free, no auth, sub-10ms.

The Thesis

The default approach to agent security is guardrails - restricting what the agent can do (sandbox file access, limit network calls, block tools). This cripples capability. Brin inverts it: let agents be unconstrained, but score every piece of external context they interact with. The risk was never the agent - it's the external context the agent trusts by default.

In brin-bench, Claude Opus missed 57% of the threats Brin identified - including 100% of graph-based signals like dependency chains and publisher reputation. Models see content; Brin sees identity, behavior, and trust.

What It Scores

How It Works

Single GET request, no auth, no SDK:

curl https://api.brin.sh/npm/express

Returns score (0-100), verdict, confidence, and tolerance. Response headers (x-brin-verdict, x-brin-score) enable lightweight checks without JSON parsing.

Verdicts: safe | caution | suspicious | dangerous

Tiered scanning pipeline:

MCP servers and skills always run Tier 3. Cached results return in <10ms.

Scoring dimensions: Identity (publisher legitimacy), Behavior (runtime patterns), Content (source/docs), Graph (transitive trust from knowledge graph).

Integration: Cursor Hook (Active)

Global beforeShellExecution hook at ~/.cursor/hooks/brin-check.sh intercepts every npm|yarn|pnpm|bun|pip|cargo install command. Blocks suspicious and dangerous verdicts, allows everything else. Falls through silently if Brin is unreachable - zero risk to existing workflow.

Config: ~/.cursor/hooks.json

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      {
        "command": "~/.cursor/hooks/brin-check.sh",
        "matcher": "npm|yarn|pnpm|bun|pip|cargo"
      }
    ]
  }
}

Integration: Claude Code Hook

For repos using Claude Code, add to .claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/brin-check.sh"
          }
        ]
      }
    ]
  }
}

The Claude Code script is identical in logic but reads .tool_input.command and returns {decision, reason} instead of {continue, permission, agent_message}.

Relationship to Golf

Golf - MCP Agent Security operates at the MCP protocol layer - discovering, governing, and auditing agent connections organization-wide. Brin operates at the context layer - scoring individual artifacts before agents consume them. They are complementary: Golf controls which tools agents can use; Brin scores what those tools return.

Relationship to Lint Guardrails

Lint-Enforced Agent Guardrails enforce code quality after the agent writes code. Brin enforces supply chain safety before the agent installs dependencies. Together with Ultracite & Fast Validation Recipe for formatting/linting, the enforcement stack is:

1. Brin - blocks dangerous dependencies at install time
2. Ultracite / oxlint - fixes formatting and catches lint errors on every edit
3. Custom ESLint rules - blocks anti-patterns at commit time
4. Type system - blocks type errors at compile time

The Credential Problem

MCP servers require API keys to do anything useful - database connectors, calendar tools, search APIs. Every server you add gets your credentials. Most skip OAuth (high setup effort), so keys end up pasted in config files and sent to third parties you've never audited. DAuth is Dedalus's hosted answer to this credential boundary: Cathy Di's February 2026 self-thread says secrets should be encrypted before they leave the client, exchanged for short-lived scoped action tokens, and decrypted only inside a hardened enclave at call time. Source: X/@itsCathyDi, 2026-02-24

Brin is still needed because auth isolation does not score the trustworthiness of the context, package, repo, MCP server, or skill the agent is about to consume. A separate OpenClaw/ClawHub malware evidence path documented 1,184 malicious skills, Atomic Stealer via SKILL.md prompt injection, and a top-ranked skill with multiple vulnerabilities; DAuth constrains credential handoff, while Brin and the skill-auditor catch malicious context before it is installed or loaded.

This is why Brin's context-level scoring, Golf's protocol-level governance, and the Skills.sh - Agent Skills Registry skill-auditor's 6-step vetting protocol are all necessary - each catches a different class of attack.

Supply Chain Philosophy

"Modern software rests on a deeply fragile trust model. Adding a dependency does not just import a library; it expands the trusted computing base to include an entire transitive graph of code that most teams will never inspect. Convenience is no longer free - it is an attack surface." - Aryan Mahajan, founding engineer at Dedalus Labs

The bias should shift toward owning more of the stack when the problem is bounded enough. LLMs make this practical: a smaller trusted base, fewer external failure points, less supply-chain exposure. If a component is simple enough to generate, verify, and maintain directly, that is often the more resilient choice.

Timur Shemsedinov's checklist is the operational companion to Brin: reduce dependency count, use lockfile-only CI installs, prefer private registries where governance matters, and add release-age quarantine through a package-manager-supported setting. Brin scores artifacts before consumption; npm Supply Chain Security keeps the package-manager path from auto-consuming a fresh compromised release. Source: X/@tshemsedinov, 2026-05-18

---

Timeline

• 2026-07-04 | Deep-reviewed Aryan Mahajan's dependency-trust row and preserved it as Brin's supply-chain philosophy: every dependency expands the trusted computing base, so convenience is an attack surface unless the artifact is scored or owned. Source: X/@itsaryanmahajan, 2026-03-24
• 2026-07-04 | Deep-reviewed @tshemsedinov's supply-chain hardening row and routed the detailed package-manager guidance to npm Supply Chain Security while keeping Brin as the pre-consumption context/package scorer. Source: X/@tshemsedinov, 2026-05-18
• 2026-05-31 | NVIDIA SkillSpector (928 stars) adds CI-automatable scanning: 64 vuln patterns across 16 categories including MCP tool poisoning, two-stage static plus LLM, SARIF output. Complements Brin's install-time scoring. Source: X/@dani_avila7, 2026-05-31
• 2026-05-18 | @tshemsedinov recommended supply-chain countermeasures (npm ci in CI, private dependency registry, npm install --min-release-age=7) as AI accelerates package attacks. 89 likes, 105 bookmarks. Source: X/@tshemsedinov, 2026-05-18
• 2026-07-04 | Source-reviewed Cathy Di's DAuth credential-boundary thread and split the page's security model: DAuth reduces credential exposure, while Brin remains the context/package/repo/MCP/skill trust scorer. Source: X/@itsCathyDi, 2026-02-24