Add polygraph skill: behavioral trust grades for MCP servers

[RubenSousaDinis]

polygraph — behavioral trust grades (A–F) for MCP servers and Agent Skills

Adds a polygraph/ skill (polygraph.so). Polygraph connects to an MCP
server the way an agent would, fingerprints its exact tool surface, and runs four behavioral
probes — C-01 tool-output injection, C-02 permission/egress overreach, C-03
sensitive-data leak, C-04 adversarial-input handling — then grades it A–F and can publish a
reproducible grade as an onchain EAS attestation on Base. The harness is open source, so anyone
can re-run it and disprove a bad grade.

CTA for builders

Check any MCP server before your agent uses it: npx polygraphso check <server>.
Get your own server graded at polygraph.so.

What the skill covers

• Check a grade — npx polygraphso check npm/@modelcontextprotocol/server-filesystem
• Verify before you trust — recompute the live tool-surface fingerprint and require it to match
  the attestation before letting Bankr execute (the runtime gate)
• Gate CI on grades — the GitHub Action polygraphso/litmus@v1 (or npx @polygraphso/litmus ci)
  fails a build when an MCP server or a skill it ships grades D/F — see
  polygraph/references/ci-gate.md
• Get your project graded — run the open litmus harness on your own server or skill
• Why a server got grade X — the A–F decision logic + how to read the report

Conforms to the contribution guide

• polygraph/catalog.json — slug equals the folder, install.type: bankr, so it appears in the
  Bankr Discover catalog
• polygraph/logo.svg (square mark), polygraph/SKILL.md with name + description frontmatter,
  supporting docs under polygraph/references/
• README row added; rebased onto current main

Verified against the published packages

• polygraphso — the lookup CLI (check / list)
• @polygraphso/litmus — the open harness, the ci gate, and the polygraphso/litmus@v1 GitHub
  Action

Happy to adjust naming/scope to match your conventions.

[saltoriousSIG]

A few things to address before merging!

• The skill says “one command before your agent installs anything,” but that command is npx polygraphso ..., which installs/executes a third-party npm package. Same for @polygraphso/litmus. Please pin package versions/integrity and avoid presenting npx as a no-install trust check.

• The GitHub Action is referenced as polygraphso/litmus@v1. For a security gate, this should be pinned to a commit SHA, not a mutable tag. Same concern for npx @polygraphso/litmus ci.

• The CI gate auto-discovers MCP configs and may run/grade servers from PR-controlled files. That is risky on CI, especially with Docker/socket/network/secrets available. Please add strong warnings: don’t run this with secrets on untrusted PRs, don’t use pull_request_target, pin dependencies, and prefer explicit allowlisted targets over auto-discovery for public repos.

• bearer / --bearer support can pass credentials into remote MCP checks. Please document that bearer tokens must not be provided on untrusted PRs or auto-discovered targets, and should be scoped/ephemeral.

• The runtime gate defaults to accepting A/B, but remote MCP servers cap at B because egress is unverified. That means the default accepts servers where network exfiltration was not tested. Please make this explicit in the Bankr execution path and require a higher/manual review bar before routing signed actions/payments through remote B servers.

• Attestation verification needs stricter trust rules. The docs note self-published grades are forgeable, but the examples still frame readAttestation + gateDecision as enough before “pay/execute.” Please require schema ID, chain ID, revocation status, methodology version, attester allowlist or reproducible rerun, and exact fingerprint match before any Bankr action.

• POLYGRAPH_API_URL can override the lookup endpoint. That’s useful for dev but dangerous in agent/runtime docs. Please warn not to use untrusted lookup endpoints for execution decisions, or require host allowlisting.

• The skill grading described in CI is static-only. Static scanning skill text can miss bundled scripts, install commands, remote URLs, and runtime behavior. Please avoid implying this is equivalent to behavioral MCP grading, and require manual/security review for skills with install-time code execution or transaction instructions.