IntentGuard is a predictive runtime security framework that correlates AI agent behavior across multiple MCP servers to forecast attack campaigns before any individual action appears malicious. It constructs a Cross-MCP Temporal Attack Graph (CTAG) from live Filesystem and Webhook MCP event streams, then predicts the next attack stage and campaign
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 1 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
post_to_webhook
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 48e7d1e · analyzer v33 · 1w ago
danger signals2
- suspicious endpoint discord.com SainiParv05-Intentguard-48e7d1e/generate_dataset.py :60
"https://discord.com/api/webhooks/123456789/abcdef", - committed secret private key SainiParv05-Intentguard-48e7d1e/sandbox/.ssh/id_rsa :1
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 18
filesystem 5
- fs SainiParv05-Intentguard-48e7d1e/collector/event_logger.py :18
from pathlib import Path - fs SainiParv05-Intentguard-48e7d1e/generate_dataset.py :22
from pathlib import Path - fs SainiParv05-Intentguard-48e7d1e/generator/trace_generator.py :426
with open(file_path, "w", encoding="utf-8") as f: - fs SainiParv05-Intentguard-48e7d1e/mcp_servers/fake_receiver.py :32
with open(self.log_path, "a") as f: - fs (weak) SainiParv05-Intentguard-48e7d1e/tests/test_trace_generator.py :9
import shutil
network 1
- net SainiParv05-Intentguard-48e7d1e/mcp_servers/webhook_server.py :19
import httpx
tool registrations 1
- post_to_webhook SainiParv05-Intentguard-48e7d1e/mcp_servers/webhook_server.py :25
declared dependencies 3
- mcp@*
- ollama@*
- httpx@*