For banks and financial institutions

Say yes to AI agents.

Approve the agents, skills and MCP servers your engineers want, with evidence. Then know the moment one changes.

Start a two-week review See a sample evidence pack
  • Runs offline
  • Signed, open data
  • No install to start
Agent decision log Illustrative
  1. github-mcp-serverPinnedApproved
  2. internal/payments-mcpBlockedFile changed
  3. npm:[email protected]BlockedTC-2026-0001
  4. write .mcp.jsonBlockedConfig write
  5. skill:pdf-toolsWarnedUnknown

Your agents pick their own suppliers.

Each one is a third party someone has to approve.

Beside your allowlist.

It decides what may run. We show what you're approving.

  • Agent settings

    Claude Code and Copilot allowlists decide which servers may load.

  • Registries and gateways

    Artifactory, Nexus and MCP gateways control where tools come from.

  • threat.cafe

    Evidence for each approval, and a block when an approved file changes.

Allowlists match names, and a name is a label. GitHub and Anthropic both say so.

Vet. Pin. Prove.

  • Vet

    Every server and skill on your allowlist, checked against the signed list and 29 rules.

  • Pin

    Approved config and skill files pinned by hash. A changed file is blocked before it runs.

  • Prove

    Every decision is logged. The evidence pack maps it to your controls.

  • SOC 2
  • ISO/IEC 42001
  • OWASP Agentic Top 10

DORA and NYDFS 500 mappings are built with you during the review.

Live from the signed feed

Get the latest list.

Every confirmed bad skill, MCP server and package. Updated as each one is confirmed.

  • 8skills
  • 19MCP servers
  • 31packages
  • 2fake installers
Newest known bad All records
  1. designed-by-ai/skills/design-mobile-appsSkillTC-2026-0034
  2. smithery-proxy-deprecatedMCP serverTC-2026-0045
  3. remote-sse-rugpull-demoMCP serverTC-2026-0051
  4. langflowPackageTC-2026-0010
  5. git-mcp-serverMCP serverTC-2026-0009
Get weekly updates Download the signed list

Built to be checked.

  • Stays in the bank

    Checks run against a local copy. Your package names, code and prompts stay with you.

  • Signed

    Every release is Ed25519 signed. Verify it with one command.

  • Open

    Apache-2.0 hook, CC-BY data. Read every line before you deploy.

  • Never "safe"

    Known bad, no known bad or unknown. No false comfort.

  • Human confirmed

    Nothing blocks until its proof is checked and its finder credited.

  • Your policy

    Block, ask a human or warn. Per status, in one file.

An allowlist review in two weeks.

Nothing to install to start. A clear answer at the end.

  1. Day 1

    Scope

    Share your approved servers and skills. Agree what success means.

  2. Week 1

    Vet

    Each item checked against the list and the rules. One record per item.

  3. Week 2

    Pin

    Optional: a pilot team pins its approved set. Warn-only.

  4. Day 14

    Decide

    Exposure report and evidence pack. Go or no-go.

You bringYour allowlist, a sponsor, 30 minutes a week.

We bringThe review, the list, the report.

Ask your fintechs for proof.

Partners can show how they control AI agents, with the same signed evidence.

What fintechs can show you

Questions risk teams ask.

We already run allowlists. Why add this?

An allowlist says what may run. It does not say what an approved server can reach, or whether it changed after you approved it. GitHub's and Anthropic's own docs note that allowlists match server names, which users can set.

Does any code or customer data leave the bank?

No. Checks run against a signed copy of the list on the machine. Decisions go to a local JSONL log you can ship to your SIEM. We never see your package names, code or prompts.

What if it blocks something we need?

Only confirmed known bad and changed pinned files block by default. Allow an item in policy.yml and dispute the record. We answer disputes within 48 hours.

Which agents does it cover?

Claude Code and Cursor through their pre-run hooks, and any pipeline through the command line.

Is threat.cafe mature enough for a bank?

We are early, so you don't have to trust us. The hook is open source, the list is public and signed, and the review starts without installing anything.

Start with your allowlist.

Give your engineers agents. Keep the risk where you can see it.

Start a two-week review Read the curation policy