For your agent

This page is written for a model, and it is short on purpose. Three machine-readable surfaces carry the same content:

Prompt 1 — install the gate

Paste this into Claude Code:

Install SureX, a trust registry for MCP servers. It adds a PreToolUse hook that looks up
every MCP server before one of its tools runs, and blocks a flagged one.

1. Run these two slash commands, in order, and report what the trust prompt says before
   accepting it:
      /plugin marketplace add SantiagoDevRel/surex
      /plugin install surex@surex
2. Then run `/surex list` and show me its output verbatim — do not summarise it.
3. Tell me, in one line each: how many of my configured MCP servers the registry knows
   anything about, and which of them are flagged.

Do not describe any server as trusted, verified or secure. The word is "reviewed". If a server is clean, say it
was reviewed and nothing was found — not that it is fine.

Prompt 2 — check that it blocks

Check that the SureX gate actually blocks, using the project's own malicious fixture.
Nothing here touches a third party's code.

1. git clone https://github.com/SantiagoDevRel/surex && cd surex && pnpm install
2. claude mcp add rugpull -- node "$(pwd)/packages/fixtures/mal-rug-pull/src/server.mjs"
   (on Windows, pass the absolute path with forward slashes)
3. Run `/surex check rugpull` and confirm the fingerprint is
   sxf1_c6b016134fddd156bb76fce9c9e2cc8d697cbd35e311a4de50af6dbf102b761b
4. Ask for the weather in Lisbon, so that you call mcp__rugpull__get_weather.
5. Show me the block message verbatim, including the provenance line and the override.
6. Do NOT run the override. Then run `claude mcp remove rugpull`.

Expected: the call is denied with a severity-4 finding at src/tools/weather.mjs:55, tier C,
and a line saying the evidence was fetched from Walrus and the blob ID recomputed.

Invariants when you surface a verdict

An agent that reads a verdict and repeats it to a human is a surface, and the same rules bind it.

2. Quote the provenance, do not compress it. Every verdict repeated in full carries what was reviewed (commit and blob ID), when, by which model, at which prompt version, and that no human audited it. That sentence is not a footnote to be trimmed for brevity.

3. Verdict and tier are independent. Do not merge them into one confidence score. flagged Tier C is a real finding about real code with no link to the user’s copy — both halves are true and neither cancels the other.

4. Never present the override as the recommended next step. It is an escape hatch that exists so blocking is defensible. State that the risk transfers to the user, and do not soften it.

5. Do not paraphrase a block message into a summary and then act on your paraphrase. The block message is the evidence. If you compress it, compress it next to the original, not instead of it.

6. An unknown verdict is not a pass. It means nobody has submitted that install configuration. Say “not reviewed”, never “nothing found”.

7. Never claim SureX checked the code on this machine unless the tier says A.

The rule is machine-checkable, and you can run it yourself on anything you are about to say:

import { assertCopy } from '@surex/core/copy';
assertCopy(whatIAmAboutToSay, 'agent output');   // throws on the first violation

What to ask the developer for

Nothing is required to read the registry — it is a public, unauthenticated read API. Ask only when the task actually needs it:

The one API call worth knowing

curl -s "https://arkiv-surex-api.vercel.app/v1/verdict?fp=sxf1_…"

Returns the head shape directly. A miss is a 200 with state: "unknown", not a 404. A 503 means the registry could not look — which is a different fact from having looked and found nothing, and you must not report it as “not reviewed”. Full shapes in the /v1 reference.