Module unknown 

BlackList check: classify installed MCP server names against a crate::registry::Registry of known-good entries.

This is a demo-level signature check: it reads MCP server names from .mcp.json (cwd) and .claude.json (under crate::Paths::user_home) at call time, then assigns each name one of three verdicts:

• UnknownVerdictKind::KnownGood — exact name match in the registry.
• UnknownVerdictKind::Typosquat — Levenshtein distance ≤ 2 to a registry entry (and not identical).
• UnknownVerdictKind::Unknown — no match; the user has installed an MCP server AgentSec doesn’t recognise. This is neutral, not a block — it just surfaces “we’ve never seen this”.

The classify step does not consume the inventory snapshot — it re-reads the source JSON because the snapshot only stores hashes, not the full structure.

Structs

UnknownVerdict

One row of classify’s output.

Enums

UnknownVerdictKind

Three-level classification.

Functions

classify

Read MCP server names from .mcp.json and .claude.json and classify each one against registry.