Agent Safety Platform — pre-execution verification for AI agents.
From guardrails to guarantees.
Scan — static analysis of MCP server tool definitions, config files, and cross-server attack chains. No server connections required for config analysis.Guard — runtime verification of every tool call against YAML constraints. Blocks dangerous calls before they reach the server.Compose — cross-server compositional analysis that detects multi-hop attack chains across MCP server boundaries.
pipx install munio # Recommended: isolated CLI
pip install munio # Core library only
pip install " munio[all] " # Everything: Z3, HTTP server, adapters
Command What it does munio scan8-layer MCP server analysis (L1-L5, L7 + ML classifiers) munio config-scanSupply chain risk detection in MCP config files (10 checks) munio composeCross-server attack chain analysis munio gateMCP stdio proxy with runtime constraint enforcement munio checkVerify a single tool call from CLI munio serveHTTP API server for remote verification munio policyDeploy-time policy verification (Z3 formal proofs) munio auditAudit constraint pack changes munio initAuto-wrap MCP servers in client configs munio statusShow MCP server protection status munio restoreUndo munio init changes munio statsGate runtime statistics munio versionPrint version
Tier Engine Latency Use case 1 Python <0.01ms Denylist, allowlist, regex, threshold, rate limit, sequence 2 Z3 subprocess ~10ms Multi-variable arithmetic (COMPOSITE expressions) 3 Z3 subprocess ~50ms Complex temporal/resource constraints 4 Z3 (deploy-time) N/A Static policy verification (NO_NEW_ACCESS, DATA_FLOW, etc.)
Tier 1 covers ~90% of real-world constraints. Z3 tiers are opt-in via pip install "munio[z3]".
Type Description denylistBlock if field matches any value allowlistBlock if field does NOT match any value thresholdBlock if numeric field exceeds bounds regex_denyBlock if field matches regex pattern regex_allowBlock if field does NOT match regex compositeMulti-variable arithmetic expression check rate_limitBlock if call rate exceeds limit in time window sequence_denyBlock if tool call sequence matches a banned pattern
Layer Name Method L1 Schema JSON Schema completeness and structural validation L2 Heuristic Keyword and pattern-based prompt injection detection L2.5 Classifier English ML classifier (char n-gram + logistic regression) L2.6 Multilingual 188-language ML classifier (0.31% FPR) L3 Static 10 semantic checks (path traversal, SSRF, SQL injection, etc.) L4 Z3 Formal Z3 constraint solving with counterexample extraction L5 Compositional Cross-tool data flow and capability analysis L7 Source Source-level analysis (when available)
