Fast deterministic MCP pre-filter that blocks known scope-creep (S3) and prompt-injection (S2b) tool-call patterns before an agent runs them. ~25 microsecond overhead, no LLM in the hot path; a first-line pre-filter, not a sandbox.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
ALETHEIA_OPERATOR_SECRETAPI keyoptionalOperator token required to loosen an already-running session's mandate at runtime.
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
aletheia_mandate_enforcerSystem prompt directive establishing operational safety boundaries, tool-use conservatism, and mandatory clearance through Aletheia.System prompt directive establishing operational safety boundaries, tool-use conservatism, and mandatory clearance through Aletheia.
System prompt directive establishing operational safety boundaries, tool-…No input schema was published for this tool.
task_descriptionThe primary task and authorized objective for the agent.The primary task and authorized objective for the agent.
No input schema was published for this tool.
workspace_rootThe root directory confining all operations.The root directory confining all operations.
No input schema was published for this tool.
allow_writeprivilegedWhether filesystem modifications are permitted ('true' or 'false').Whether filesystem modifications are permitted ('true' or 'false').
No input schema was published for this tool.
aletheia_set_mandateEstablish or update the active operational safety mandate for this agent session. Declares permissible boundaries, allowed tools, filesystem directories, write permissions, and risk tolerance. Loosening restrictions requires operatorSecret.Establish or update the active operational safety mandate for this agent session. Declares permissible boundaries, allowed tools, filesystem directories, write permissions, and risk tolerance. Loosening restrictions requires operatorSecret.
No input schema was published for this tool.
aletheia_get_mandateRetrieve the current operational safety mandate, permissions, and active boundary constraints.Retrieve the current operational safety mandate, permissions, and active boundary constraints.
No input schema was published for this tool.
aletheia_interceptUniversal sub-millisecond safety gatekeeper. Evaluates any proposed tool invocation against Signature S3 (Scope Creep) and S2b (Prompt Injection) to block destructive, out-of-boundary, or compromised actions before execution.Universal sub-millisecond safety gatekeeper. Evaluates any proposed tool invocation against Signature S3 (Scope Creep) and S2b (Prompt Injection) to block destructive, out-of-boundary, or compromised actions before execution.
No input schema was published for this tool.
aletheia_safe_bashExecute a shell/bash command with inline sub-millisecond Signature S3 scope creep protection. Blocks destructive deletes (rm -rf), disk formatting, fork bombs, credential harvesting, privilege escalation, and unauthorized network egress.Execute a shell/bash command with inline sub-millisecond Signature S3 scope creep protection. Blocks destructive deletes (rm -rf), disk formatting, fork bombs, credential harvesting, privilege escalation, and unauthorized network egress.
No input schema was published for this tool.
aletheia_safe_sqlprivilegedAudit or execute a database query with Signature S3 safety filters. Detects destructive DDL (DROP, TRUNCATE), unbounded DML (DELETE/UPDATE without WHERE), and privilege tampering.Audit or execute a database query with Signature S3 safety filters. Detects destructive DDL (DROP, TRUNCATE), unbounded DML (DELETE/UPDATE without WHERE), and privilege tampering.
No input schema was published for this tool.
aletheia_get_telemetryRetrieve runtime safety telemetry: total tool calls evaluated, block rate %, latency percentiles (p50, p95, p99 < 1ms), and violation counts broken down by signature.Retrieve runtime safety telemetry: total tool calls evaluated, block rate %, latency percentiles (p50, p95, p99 < 1ms), and violation counts broken down by signature.
No input schema was published for this tool.
10 of 10 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Fast deterministic MCP pre-filter that blocks known scope-creep (S3) and prompt-injection (S2b) tool-call patterns before an agent runs them. ~25 microsecond overhead, no LLM in the hot path; a first-line pre-filter, not a sandbox.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.