Browse / MCP servers
dorianchn/shanchuanzhi-agent-canary
Agent Canary 3.0: open-source MCP, SDK, and CLI security toolkit with a guarded execution gateway, decoy signals, local tests, and public acceptance evidence.
- MCP
- security
- CLI
Works.Tested on 2026-10-28. From the README alone, on Linux with Haiku.
What we checked
Does it run from the README?Yes. Running in 3:53 on a clean Linux box.The run
Does it do what the README says?2 of 2 claims held up.Evidence
“The stdio MCP server runs via serve --stdio and exposes decoy tools that return fabricated results”
Expected status initiated with settlement T+0 (internal accounts). Got T+0 (internal accounts).
“Agent Canary provides decoy tools as a security toolkit”
Expected decoy reply containing settlement T+0 (internal accounts). Got T+0 (internal accounts).
Which setups did we try?Works with Haiku.Setups
Linux / Haiku: works, Oct 28, rev 146be17.
Needs keys, a login or a browser?No.Details
None seen
Is it safe to run?Made outbound HTTPS connections: yes (hosts not recorded) by <guest-path>What we saw
Review signals across current setups: connection review, sensitive read. 13 listed items (named-host connections, static matches, dependency advisories) are below and do not change this verdict. 1 static matches retained as context.
Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 104.16.9.34:443 1 attributed processes.
PID 2428: /usr/local/bin/node · <guest-path>
Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 4 findings.
OSV reports a known vulnerability in this dependency version. 6 distinct locations. 9 findings.
A repository process attempted to read this sensitive path. 4 distinct locations. 4 findings. 9 attributed processes.
Reviewed as expected for a test run: attempted writes that failed, so nothing was written; read only test files inside the test workspace or its temporary folders; resolver address lookups that send no data.
Full event, path and process lists for each observed setup:
A quiet run is not a safety guarantee.
Is it maintained?Maintained · 117 commits in 90 days · 48 merged PRs in 90 days · 13 open issues · 17 open PRsActivity
actively maintained: last commit 15 days ago; 117 commits and 48 merged PRs in 90 days; 13 open issues, 17 open PRs; latest release 2026-10-13
Can I show this on my README?Copy the badge.Badge
The run
Oct 28 · rev 146be17Independent test, not endorsed by the project.