Vulnify

Your AI agent can delete, export and send on its own. Vulnify is the approval step it's missing: allow, review or block. Free for devs.

[Vulnify @vulnify]

Your Claude Code or Cursor agent can delete, export and email on its own. Introducing Vulnify: allow, review, or block before it runs.

Every decision comes with a 0-100 score, the reasons and a hash-chained record.

Free Developer plan. Node and Python SDKs.

[Vulnify @vulnify]

@ChitranshuSinha Good instinct to think about it early. The wrong-data case often hides in the arguments rather than the tool: reading one customer record and exporting all of them can be the same call. We work on that per-call check at Vulnify, with the reason logged.

[Vulnify @vulnify]

@jatingargiitk Good point, and it's the one most reviews miss: a read-only server whose output lands in the next prompt can still steer a write. Judging permissions across the whole connected agent, not server by server, is the right unit.

[Vulnify @vulnify]

Before you connect a remote MCP server, check what it lets a caller do: which tools write, which delete, which send.

[Vulnify @vulnify]

@BenjieMalinao The 97% is the number I'd lead with: at that approval rate the prompt trains people to say yes, so a planted command looks like every other one. Asking less often, only for what can't be undone, is how the 13.6% goes up. What's at the top of your never-on-auto list?

[Vulnify @vulnify]

@CKPillaiAI "Part of the execution path" is the line most setups miss: a check the agent only calls when it remembers is optional. That's what we build at Vulnify, a decision on each action before it runs, with the reason kept next to it.

[Vulnify @vulnify]

@deeepakbagada Nice numbers 👌 One field we'd add to that contract: whether the call failed or was refused. A crash is worth a retry; a denied call retried with the same arguments just gets denied again and burns another turn.

[Vulnify @vulnify]

@ArthurLiu0725 @ArchiveExplorer Global for that loop, so there's no path around it to discover. When writing tests is the task itself, we'd start that session without the deny rather than open exceptions mid-run. It keeps the rule easy to reason about.

[Vulnify @vulnify]

@BobBouthillier Agreed. The part that's easy to miss: reviewers only stay sharp if most actions never reach them. Let routine actions through, block the obvious ones, and save human attention for the few that actually need judgment.

[Vulnify @vulnify]

@iRomin Solid. The live re-check is what makes it safe, since a TTL alone can't see the state change inside the window. One edge worth a test: a VM caught mid-transition on resume, starting or stopping. Waiting and re-checking beats guessing either way.

[Vulnify @vulnify]

A decision your CI can read.

vulnify check --agent SalesBot --action EXPORT_DATA --resource "Customer Database" --destination EXTERNAL_EMAIL --records 12000

Exit 0 on ALLOW. 2 on REVIEW. 3 on BLOCK. Unreachable exits 1, never a silent pass.

[Vulnify @vulnify]

Values from a real test in our own org. The chat in the video is a recreation.
In Claude: https://t.co/om0yR1mAXn
Setup: https://t.co/dJd32oBGAF
Paste your MCP server URL and see what its tools can do: https://t.co/I4LvNGi5jm

[Vulnify @vulnify]

Vulnify is available in Claude's connector directory.

Here is what it does. An agent calls decide_action: EXPORT_DATA, 800 records, to an external email. Vulnify returns REVIEW, HIGH, 65.

A person approves in Vulnify or in Slack. Then get_decision reads finalDecision ALLOW.

[Vulnify @vulnify]

https://t.co/m9lWBrWsGk

[Vulnify @vulnify]

Approve from Slack.

REVIEW and BLOCK decisions post to a channel. With the Slack app, a reviewer approves or denies from the message. High-risk approvals still ask for an MFA code.

Slack gets the decision. Never the records.

[Vulnify @vulnify]

@AnthonyWidodo_ Usually yes, without meaning to: the permission to clean up and the permission to destroy are the same delete call. A split that holds up overnight is whether a copy exists. Deleting what has a backup can run while you sleep; deleting what doesn't waits for morning.

[Vulnify @vulnify]

@justelite The scary step is the config edit, not the file load: it turns one bad session into every later one. An agent whose writes are limited to the project folder it was started in can still be fooled by the file, but it can't make that change stick.

[Vulnify @vulnify]

@pauliusztin_ One chapter I'd love in a harness course: where the permission check lives. In the system prompt it's a suggestion the model can reason around; in the harness, between the tool call and the tool running, it holds even when the model is wrong.

[Vulnify @vulnify]

@witcheer Putting the chat's running total next to the per-call cost is the smart part. One paid call rarely makes anyone pause; seeing the twelfth one push a chat toward its limit does, and asking before the call that crosses it beats finding out on the bill.

[Vulnify @vulnify]

@JustJorshin A proxy, if you need the output itself. The input side is cheaper: per those docs, preToolUse still fires for HTTP MCP tools as MCP:<tool_name> and can deny, so a risky remote call can be stopped before it goes out even when the result comes back redacted.