Skills and Model Context Protocol (MCP)

Zenborg supports custom agent skills and the Model Context Protocol (MCP). Because autonomous agents execute real code, Zenborg applies rigorous security scanning and environment isolation.

---

The Built-In Skill Security Scanner

Skills allow agents to learn new workflows, command recipes, and tool definitions. However, third-party skills from the internet can contain malicious prompts or exfiltration scripts.

Zenborg includes an automated, dependency-free security scanner that inspects all installed skills before exposing them to agents. The scanner never executes code and makes zero network requests.

The 15 Security Checks

The scanner evaluates content against 15 specific security rules:

Rule ID	Severity	Description
injection	High	Detects prompt injection attempts designed to bypass system instructions.
hidden-unicode	High	Flags zero-width spaces, directional overrides, and invisible characters that disguise malicious payloads.
hidden-comment	High	Detects hidden instructions concealed inside HTML or Markdown comments.
hidden-css	High	Identifies text disguised with CSS properties (display:none, opacity:0, font-size:0).
encoded-blob	Medium	Flags suspicious base64 or hex encoded data blobs.
decoded-eval	High	Detects dynamic evaluation (eval(), Function(), exec()) of decoded strings.
download-exec	High	Flags commands that download remote files and execute them (curl | sh, wget | bash).
secret-access	Medium	Inspects unauthorized reads of credentials, SSH keys, .env files, or cloud tokens.
secret-exfil	High	Detects patterns where sensitive variables are transmitted to external servers.
destructive	High	Flags dangerous file system commands (rm -rf /, mkfs, partition wipes).
persistence	High	Detects modifications to launch daemons, scheduled tasks, or security tool configurations.
bundled-executable	High	Flags compiled binaries or scripts disguised as configuration files.
remote-instructions	Medium	Flags instructions that instruct the agent to fetch external, unreviewed prompts.
source-url	Low	Logs untrusted external domains referenced in documentation.
scan-limit	Medium	Alerts if a skill file exceeds inspection bounds (over 2 MB per file or 8 MB total).

If high-severity findings are discovered, the skill is flagged in Settings and quarantined.

---

The Native Zenborg MCP Server

Zenborg provides its own native MCP server. It allows external MCP clients (such as Claude Desktop or custom agents) to query Zenborg’s project statuses, loop runs, and system metrics.

To inspect the native MCP server configuration, run the CLI utility:

zenborg mcp print

This command outputs the exact JSON configuration block and absolute Node.js executable paths needed to register Zenborg with your MCP clients.

---

Why Zenborg Isolates MCP Servers in Loops

While MCP is valuable for interactive chat sessions, having dozens of third-party MCP servers loaded during autonomous loops causes significant problems:

1. Context Window Exhaustion: Every active MCP server injects extensive tool definitions and JSON schemas into the prompt. A few heavy MCP servers can consume 50,000 to 100,000 tokens before the agent even reads your code.
2. Model Confusion and Tool Conflicts: When an agent has 40+ available tools, models frequently hallucinate invalid tool arguments or call irrelevant external tools instead of editing project files.
3. Flaky Network Dependencies: If an external MCP server hangs or crashes, the entire autonomous loop can stall.

How Zenborg Enforces Strict Isolation

To ensure fast, deterministic, and token-efficient execution, Zenborg disables user MCP servers during loop runs:

• Claude Code: Zenborg invokes Claude with --strict-mcp-config without passing user MCP configs.
• CLI Subprocesses: Zenborg invokes connected assistants with strict ephemeral configurations and isolated environments.

This guarantees that worker agents focus purely on local repository tools (reading files, editing files, running tests, and executing Git commands) without external tool bloat.

---

Next Steps

• Solve runtime issues in Diagnostics and Troubleshooting.
• Review licensing details in Plans and Pricing.