AgentArmorHQ
Sign in
Team allowlist & .mcp.json builder

Engineering Team: approved MCP servers and skills

Search and select the AI tools your team is allowed to run, set your minimum risk grade, and copy a hardened .mcp.json and Markdown security policy in one click.

  1. Pick your toolsSearch by tool name or click a starter pack below.
  2. Set your minimum gradeFlag any tool that falls below your team’s bar (Grade A, B, or C).
  3. Copy & shareDrop the hardened .mcp.json and SECURITY_MCP.md into your repo.
Starter packs:
Core Engineering (5 tools)Frontend & Design (4 tools)Search & Automation (4 tools)Strict Grade-A Audit Demo (5 tools)
Quick add:+ Figma-Context-MCP (A)+ next-devtools-mcp (A)+ firecrawl-mcp-server (A)+ exa-mcp-server (A)+ slack-mcp-server (B)
Selected tools (2):Reset to default (5 tools)

Approved catalog (2 tools)

1 of 2 meet Grade B or better; 1 below your bar need review

Remove 1 below Grade B

2 tools

Approved tools. Column headers sort the table.
Action
flotilla-mcpApp connectorDD · High risk signals Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.Below Grade BNo local folder access notedRuns shell or system commands17 stars · 379/wkRemove
skillsAI agent skillBB · Some risk signals Based on public adoption and transparency signals as of Oct 16, 2026. Our opinion, not a code audit or security guarantee.Meets Grade BNo local folder access notedNo shell command runner noted185k starsRemove

Team .mcp.json

Drop it in your repository root. Install scripts are turned off with --ignore-scripts.

json
{
  "mcpServers": {
    "flotilla-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "--ignore-scripts",
        "flotilla-mcp"
      ]
    }
  }
}

Policy for SECURITY_MCP.md

Paste into Notion, Confluence or your repository’s security policy.

markdown
# Engineering Team — Approved AI Agent Skills & MCP Allowlist
Last updated: 2026-10-29 · Minimum required grade: **Grade B** (Some risk signals)

## Approved Catalog
| Tool | Kind | AgentArmorHQ Grade | Local Files | Command Execution |
| :--- | :--- | :--- | :--- | :--- |
| [flotilla-mcp](https://agentarmorhq.com/skills/paipaiio-flotilla-mcp) | App connector | **Grade D (High risk signals)** | No local folder access noted | Runs shell or system commands |
| [skills](https://agentarmorhq.com/skills/anthropics-skills) | AI agent skill | **Grade B (Some risk signals)** | No local folder access noted | No shell command runner noted |

## Team Hardening Rules
1. **Minimum Grade Gate:** Only install MCP servers and agent skills with an AgentArmorHQ risk grade of **B** or better unless explicitly reviewed.
2. **Disable Install Hooks:** Always pass `--ignore-scripts` when running `npx` MCP connectors.
3. **Workspace Isolation:** Never pass `/` or `~` to filesystem connectors; scope every connector to a single repository folder.
4. **Scoped Credentials:** Use read-only, expiring tokens in `.mcp.json` and never commit live tokens to version control.

_Generated via [AgentArmorHQ](https://agentarmorhq.com/allowlist). Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee._
Continuous monitoring

Get an email the day any tool on your allowlist gets a bad version

Watch 3 packages for free, or monitor up to 100 across your stack with daily email alerts, change history and full reports on Team.

See Team & Pro plansCheck a live .mcp.json

Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee.