# Reins MCP Server

> Audits Claude Code standing permission grants, scores each grant's prompt-injection blast radius, and generates deny-rule guardrails — local, read-only by default, zero network egress.

- Type: MCP server
- Author: amcdonnell-dot
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-13
- Source repository: https://github.com/amcdonnell-dot/reins
- Repo state: not archived
- Last push: 2026-08-05T14:51:57Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Anthropic
- Domains: ai-security
- Tags: ai-agent-security, permissions, claude-code, prompt-injection, least-privilege, governance, python
- Date added: 2026-08-05
- Transport: stdio
- Runtime: python
- Auth method: none
- Compatible clients: Claude Code, Claude Desktop
- Tools:
  - `reins_audit`: Audit standing permission grants across Claude Code settings sources, classified into 12 risk categories with redacted evidence
  - `reins_explain`: Deep-dive on a single grant: what it permits, why it was flagged, and remediation options
  - `reins_blast_radius`: Rank grants by worst-case prompt-injection blast radius (credential access, exfiltration, destruction, persistence, code integrity, privilege escalation)
  - `reins_generate_policy`: Generate permissions.deny rules, PreToolUse hook scripts, and a managed-settings baseline from findings (dry — never writes)
  - `reins_snapshot`: Save the current grant set as a baseline for drift detection
  - `reins_drift`: Diff live grants against the saved baseline; newly added grants are fully classified and scored
  - `reins_revoke`: Remove selected allow rules by audit-issued rule id — confirmation-gated, timestamped backups, atomic writes, read-only sources refused
- Listing page: https://exchange.tenable.com/mcp-servers/reins-mcp-server
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/reins-mcp-server.md

Every time a developer clicks "always allow," Claude Code writes a standing permission into settings files that are almost never re-read. Those allowlists accumulate embedded credentials, destructive wildcards, credential-store reads, and unrestricted push/publish rights. Reins audits that surface before a prompt-injected agent session gets to use it.

## What it does

Reins classifies every standing permission grant across Claude Code's settings sources into 12 risk categories, using shell-aware tokenization (`shlex`) rather than regex-only matching so obfuscated or compound commands still classify correctly. Every non-safe finding gets a blast-radius score answering one question: if a prompt-injected agent fired this grant right now, what happens with no human in the loop? Findings convert directly into enforceable guardrails: `permissions.deny` rules, `PreToolUse` hook scripts, and an org-distributable `managed-settings.json` baseline. A snapshot/diff mechanism means a re-audit tells you exactly which grants appeared since your last known-good baseline.

## How it works

The classification engine is pure stdlib Python with no I/O beyond the files it's told to read or write, so it's fully unit-testable independent of the MCP transport. Detectors are data: a table of regex patterns per risk category, so contributors add coverage without touching pipeline code. Blast-radius scoring is deterministic (severity × breadth × reach, no LLM in the scoring path) and every string a tool returns passes through a single redaction boundary before it leaves the process — known secret shapes and high-entropy tokens are replaced with a stable fingerprint so the same secret is recognizable across findings without the value ever appearing. Writes are confirm-gated: `reins_revoke` requires an explicit `confirm: true`, re-verifies each targeted rule is still present before touching anything, writes a timestamped backup, and performs an atomic `os.replace`. Removal is non-destructive — Claude Code simply re-prompts the next time the permission is needed. The server is stdio-only with zero network egress, enforced by an automated socket-blocking test across the full suite.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/reins-mcp-server.json. The full index and how to read it: https://exchange.tenable.com/llms.txt