Credibility beats coverage. These are the classes of 2025 and 2026 incidents where a policy proxy is the wrong control, so nobody adopts Aggrete for a problem it does not solve. Of the fourteen widely discussed incidents we scored, nine fall here. The scored list names each one.
| class | examples | why a proxy cannot help | the right control |
|---|---|---|---|
| Supply chain | A worm on the MCP Registry; plugin pins not verified; SDK transport flaws | The compromise is the install, before any call is made | Registry vetting, dependency scanning, pinned installs |
| Host execution | Git hooks running when an agent touches a repository | No tool call is involved | The agent vendor's sandbox |
| Client-side exfiltration | A token leaked through a URL the client downloads itself | The client acts without an MCP call | The client vendor's fix |
| Client-side policy bugs | A deny rule that silently stops applying | A policy inside the client fails with the client | Enforce outside the process, which is what a proxy is; it still cannot patch the client |
| Memory poisoning | Persistent instructions planted in assistant memory | The memory is the assistant's; no proxy sees it | Assistant vendors; the flow rule only limits what a poisoned session can send out |
| Open ports | Servers on the internet with no authentication | Someone else's misconfiguration | aggrete scan flags configs with no auth; closing the port is theirs |
| Raw shells and credentials on disk | A coding agent using a token it found in a file, through a CLI | Not a tool call; the proxy never sees it | Secret scanning, least-privilege tokens, sandboxes |
The combination of allowed reads that forms a leak. The write that follows an untrusted read. Poisoned tool descriptions, and tools that change after approval. Credentials in tool arguments. Results that describe too few people. Bulk extraction. And any of these under a rule that holds for a person's sign-off. Every one is a check you can rerun: the conformance report.
Aggrete is Apache-2.0. No model in the decision path.