garagon/aguara

Employs a 4-layer analysis engine combining regex pattern matching with Aho-Corasick automaton, NLP-driven AST parsing of markdown/JSON/YAML structures, cross-file taint tracking for dangerous capability chains, and SHA256-based rug-pull detection—each layer targets evasion techniques the others might miss. Supports 17 MCP client configurations (Claude Desktop, Cursor, VS Code, Windsurf, etc.) and includes dynamic confidence scoring, 6 decoders for obfuscated payloads, and context-aware rule exemptions per tool type. Available as standalone binary, Docker image, or Go library API with extensible YAML rule support and multiple output formats (JSON, SARIF, Markdown) for CI integration.