Invariant Labs

Invariant Labs makes AI Agents secure and reliable.

[Invariant Labs @InvariantLabsAI]

@snyksec Announcement: https://t.co/YJHrI7s38t

[Invariant Labs @InvariantLabsAI]

We’re thrilled to officially join forces with @snyksec!

Together, we’re changing the landscape of the agentic AI future. More to come!

[Luca Beurer-Kellner @lbeurerkellner]

😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked.

We discovered a new attack on agents using GitHub’s official MCP server, which can be exploited by attackers to access your private repositories.

creds to @marco_milanta

(1/n) 👇

[Invariant Labs @InvariantLabsAI]

Invariant researchers have uncovered a new security flaw in GitHub’s official MCP server, enabling attackers to exfiltrate private repository data.

The toxic flow was identified during an automated scan using Invariant's security stack.

Learn more: https://t.co/q4MYet1Z4D

[Invariant Labs @InvariantLabsAI]

🔵 New release: Invariant MCP-scan v0.2 is here!

Track, audit & secure all local MCP traffic with static+dynamic scanning, local guardrails, and customizable policies.

Ideal for orgs prioritizing agent security & compliance.

Docs: https://t.co/WrWwk4KTOL

#AI #DevSecOps

[Invariant Labs @InvariantLabsAI]

We are proud to share that AgentDojo, an Invariant research project done with @ETH, has won the first price of the @cais SafeBench competition.

We truly appreciate this recognition from the community.

Learn More: https://t.co/NBoFPUY8dt

[Invariant Labs @InvariantLabsAI]

MCP-scan: https://t.co/B7fbdBlCBH

[Invariant Labs @InvariantLabsAI]

🛡️ We are thrilled to partner with @SmitheryDotAi to protect their MCP servers with Invariant MCP-scan.

Also, a lot of features will be dropping in MCP-scan soon!

[Invariant Labs @InvariantLabsAI]

Blog post: https://t.co/8UUb4PrqsA

[Bill Doerrfeld @DoerrfeldBill]

MCP is the hottest thing in AI right now, but people aren't really talking about the security implications...

I covered a recently discovered exploit and mitigations on the @thenewstack today:

https://t.co/2U7J8WcHnD

[Marc Fischer @marc_r_fischer]

We recently shipped a lot of updates to mcp-scan:
- whitelisting of tools
- Improvements to the server (reducing false-positives, improving detection)
- run via npm/npx

Much more coming soon!

https://t.co/frHJtsELrO

#mcp

[Invariant Labs @InvariantLabsAI]

For more details on Invariant Guardrails, check out our blog post: https://t.co/DsDGanbNFh

[Invariant Labs @InvariantLabsAI]

🛡️ We just released Invariant Guardrails — a contextual guardrail system for agents and MCP-powered AI applications.

Open source & easy to deploy.

🧵

[Invariant Labs @InvariantLabsAI]

Invariant Guardrails, Gateway, and Explorer are all open-source.
https://t.co/IU8HzKvrIJ

Check them out! We would love some feedback.

[Luca Beurer-Kellner @lbeurerkellner]

🔴🌎 New MCP attack on BrowserMCP

We show an MCP attack on the popular BrowserMCP.
It allows attackers to read arbitrary files from your machine, when the agent visits the website below.

Try yourself with: https://t.co/q7EalhASmZ

No bad MCP server needed.

(1/n)👇

[Invariant Labs @InvariantLabsAI]

A small disclaimer: We use Invariant Guardrails server-side via an API, and we are collecting tool names and descriptions for security research purposes (not your user data!). Don't use it if you don't want to share your tools.

[Invariant Labs @InvariantLabsAI]

After covering MCP vulnerabilities over the last few days, today, we are launching MCP-scan, a security scanner to detect MCP attacks.

Run it now: uvx mcp-scan@latest

🧵

[Invariant Labs @InvariantLabsAI]

For more details, check out our full blog post on MCP-Scan: https://t.co/xVihAWuLwz