Slipmark 0.6 adds MCP server to bind Codex review verdicts to their instruction files
Slipmark 0.6 introduces an MCP server for Codex, motivated by the fact that coding agents read AGENTS.md, skills, and MCP configuration as inputs, which became targets of 2026 attacks such as Ghostcommit, Deadbugz, and poisoned skills. The server gives Codex two tools: slipmark_attest, which records a verdict along with SHA-256 hashes of the files read, and slipmark_verify, which checks those verdicts against the current file contents. A companion CI action blocks pull requests when files or agent instructions changed after a verdict, or when AGENTS.md changed without human approval or instructions hid text from reviewers. The MCP server is intentionally limited: agents cannot record human approvals, run commands, or overwrite existing verdicts. A demo repository presents each attack as an open pull request.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in