Detection rule catalog
The implemented rule-set version is currently 2026.10.1. A finding also carries its individual rule version. Organization policy settings determine which enabled rules and supported parameters are used.
| Rule | Condition reviewed |
|---|---|
MF-MCP-001 |
MCP server package or image is not pinned to an exact version or digest. |
MF-MCP-002 |
Credential-like literal values appear in MCP configuration environment variables, headers or arguments. |
MF-MCP-003 |
A non-loopback remote MCP endpoint uses unencrypted HTTP. |
MF-MCP-004 |
A filesystem MCP server is granted a directory on the configured sensitive-path list. |
MF-MCP-005 |
A Docker-launched MCP server uses privileged or host-access options. |
MF-AGT-001 |
Coding agent permission prompts are bypassed. |
MF-AGT-002 |
Coding agent shell permissions are unrestricted. |
MF-AGT-003 |
Project MCP servers are automatically approved. |
MF-GHA-001 |
An AI agent workflow is given excessive GitHub token permissions. |
MF-GHA-002 |
An AI agent workflow uses an untrusted-trigger pattern covered by the analyzer. |
MF-GHA-003 |
A supported AI agent action is not pinned to an immutable commit. |
MF-GHA-004 |
A supported CI agent is configured without its expected sandbox restrictions. |
MF-MCP-101 |
An authorized live probe finds a remote MCP endpoint accepting an unauthenticated session. |
Interpret a rule result
Section titled “Interpret a rule result”The first twelve checks analyze supported source configuration. They do not establish every effective runtime permission. The remote authentication probe verifies a specific endpoint behavior within the recorded scope and request budget.
Default severities are part of the implementation; inspect the actual finding and policy catalog for its severity, description, parameters and source evidence. A condition can be expected in a particular environment and still merit a documented decision.
Remediation examples
Section titled “Remediation examples”- Pin an approved package version or image digest and rescan.
- Remove a literal credential from configuration, rotate it in its source system and use supported secret injection.
- Use HTTPS for remote endpoints and verify the endpoint’s actual authentication.
- Narrow filesystem and workflow-token permissions to the task’s needs.
- Keep agent sandboxing and approval boundaries appropriate to untrusted inputs.
ModelFence records the finding and your workflow decision. It does not rotate external credentials or edit source files for you.