AgentArmorHQ
Sign in
Team allowlist & .mcp.json builder

Engineering Team: approved MCP servers and skills

Search and select the AI tools your team is allowed to run, set your minimum risk grade, and copy a hardened .mcp.json and Markdown security policy in one click.

  1. Pick your toolsSearch by tool name or click a starter pack below.
  2. Set your minimum gradeFlag any tool that falls below your team’s bar (Grade A, B, or C).
  3. Copy & shareDrop the hardened .mcp.json and SECURITY_MCP.md into your repo.
Starter packs:
Core Engineering (5 tools)Frontend & Design (4 tools)Search & Automation (4 tools)Strict Grade-A Audit Demo (5 tools)
Quick add:+ Figma-Context-MCP (A)+ next-devtools-mcp (A)+ firecrawl-mcp-server (A)+ exa-mcp-server (A)+ slack-mcp-server (B)+ Anthropic skills (B)
Selected tools (1):Reset to default (5 tools)

Approved catalog (1 tool)

0 of 1 meet Grade B or better; 1 below your bar need review

Remove 1 below Grade B

1 tools

Approved tools. Column headers sort the table.
Action
Hugging FaceApp connectorFF · Many risk signals Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee.Below Grade BNo local folder access notedNo shell command runner noted—Remove

Team .mcp.json

Drop it in your repository root. Install scripts are turned off with --ignore-scripts.

json
{
  "mcpServers": {}
}

Policy for SECURITY_MCP.md

Paste into Notion, Confluence or your repository’s security policy.

markdown
# Engineering Team — Approved AI Agent Skills & MCP Allowlist
Last updated: 2026-10-29 · Minimum required grade: **Grade B** (Some risk signals)

## Approved Catalog
| Tool | Kind | AgentArmorHQ Grade | Local Files | Command Execution |
| :--- | :--- | :--- | :--- | :--- |
| [Hugging Face](https://agentarmorhq.com/skills/hugging-face) | App connector | **Grade F (Many risk signals)** | No local folder access noted | No shell command runner noted |

## Team Hardening Rules
1. **Minimum Grade Gate:** Only install MCP servers and agent skills with an AgentArmorHQ risk grade of **B** or better unless explicitly reviewed.
2. **Disable Install Hooks:** Always pass `--ignore-scripts` when running `npx` MCP connectors.
3. **Workspace Isolation:** Never pass `/` or `~` to filesystem connectors; scope every connector to a single repository folder.
4. **Scoped Credentials:** Use read-only, expiring tokens in `.mcp.json` and never commit live tokens to version control.

_Generated via [AgentArmorHQ](https://agentarmorhq.com/allowlist). Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee._
Continuous monitoring

Get an email the day any tool on your allowlist gets a bad version

Watch 3 packages for free, or monitor up to 100 across your stack with daily email alerts, change history and full reports on Team.

See Team & Pro plansCheck a live .mcp.json

Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee.