Fugu

cover image
benchmarks
benchmarks
benchmarks
benchmarks
demo
demo
demo

Inspiration

I kept hearing news about security incidents affecting major companies. I wanted to understand why these incidents kept happening, even in organizations with dedicated security teams, so I started searching for research papers about how software systems become vulnerable.

As I explored AI-agent security, one problem stood out: agents read external content and use powerful tools, but that content can also contain instructions designed to manipulate them.

Research illustrates this risk:

“Not What You’ve Signed Up For” (2023) demonstrates how instructions hidden in retrieved content can redirect an AI application.
“InjecAgent” (2024) evaluates indirect prompt injection against tool-using agents, including attacks aimed at stealing private information.
“Model Context Protocol Threat Modeling” (2026) examines malicious instructions embedded in MCP tool metadata and how different clients handle that threat.

This made the problem feel close to my own workflow. Every time I added a community skill, MCP server, or plugin, I was making a trust decision about someone else’s code and instructions.

I wanted a practical way to inspect that trust before granting access: what does this extension ask the agent to do, what suspicious behavior can we observe, and what remains untested?

That became Fugu: audit before install.

What it does

Fugu helps developers audit community skills, MCP servers, and plugins before installation.

Submit a repository URL, inspect the findings and supporting evidence, and decide whether to install, investigate, or request a fix.

Fugu combines:

Hidden-instruction decoding and static source analysis.
Model-based semantic review for injection and deceptive intent.
Behavioral probes comparing an agent’s responses with and without the extension.
Reputation and dependency-vulnerability checks.
Bounded execution checks when runnable triggers and a configured chamber are available.

Each report includes a PASS, WARN, or FAIL verdict, source exhibits, confidence labels, and analysis coverage. Concrete source findings, observed behavior, and advisory model judgments are distinguished.

Reports and event histories are saved so developers can revisit the evidence without repeating the audit. A PASS applies only to performed checks; it does not certify safety.

How we built it

Fugu uses Python and FastAPI for the audit engine and API, React and TypeScript for the interface, SQLite for persistent audit history, and Docker for local execution chambers.

Nebius Token Factory hosts inference using NVIDIA Nemotron models. Nemotron Ultra performs semantic review and powers baseline and stronger extension-mounted behavioral probes. Nemotron Super supplies the everyday-agent mounted arm. Comparing responses helps reveal whether an extension redirects the agent away from the user’s task.

Optional Tavily and OSV lookups provide reputation and vulnerability context.

We also built a bring-your-own-key CLI, including an offline mode for local concealment and static checks, and deployed a password-protected web demo.

Challenges we faced

The hardest challenge was separating suspicious instructions from demonstrated behavior. A model expressing an intention is different from a tool actually executing it, so Fugu labels these evidence types separately.

Coverage was another challenge. An unavailable sandbox or failed model call must remain visible. We report skipped, failed, and incomplete checks alongside the verdict.

Evaluating the system also required comparing complete workflows, retaining failures, recording model usage, and checking whether findings actually supported the final decision.

Accomplishments we’re proud of

In our historical 12-case comparison, Fugu outperformed NVIDIA’s AI-enabled SkillSpector on expected final decisions: 7/12 versus 4/12, with mean judged diagnostic quality of 5.58/10 versus 4.29/10.

Both approaches requested the same main Nemotron Ultra model on Nebius. The study included eight security and four functional cases, with partial and failed runs retained. Saved Fugu outputs came from mixed versions, configurations differed, and functional checks extend beyond SkillSpector’s primary security scope. These are scoped pilot results, not a general accuracy claim.

Our Fugu-assisted investigations also led to three upstream fixes:

Missing HTTP timeouts in a ComfyUI agent skill.
Incorrect uppercase Go module handling in an MCP package-version tool.
An ignored JSON row limit in an agent skill.

These bugs were identified through source review during the investigations, rather than automated Fugu alerts. Maintainers confirmed the reports and shipped fixes.

We delivered an evidence interface, saved audit histories, a local CLI, a hosted demo, and published benchmark charts with their methods and limitations.

What we learned

A useful audit needs to explain what happened, why a finding matters, and what remains untested. Evidence and coverage are as important as the final verdict.

We also learned that practical validation matters: testing real repositories and discussing findings with maintainers exposed gaps that crafted examples alone could not show.