On this page
Rule Authoring
Custom rules extend built-in checks for an organization's known server patterns, prohibited launchers, authentication expectations, or tool-description policies.
A rule defines a stable identifier, title, severity, category, target, one or more match conditions, a clear finding message, and actionable remediation. Supported comparisons include equality, containment, regular expressions, existence, and grouped all-or-any conditions.
Rules can inspect normalized server names, commands, arguments, environment keys, transports, URLs, tool names and descriptions, combined tool text, and authentication types.
Review Standard
- Keep the identifier stable after publication.
- Match the narrowest reliable signal.
- Explain the risk without exposing secrets from the scanned configuration.
- Provide remediation that a reviewer can verify.
- Test a positive case, a safe negative case, and malformed input.
- Record ownership and review the rule when the underlying threat changes.