AI Component Vetting

AI Component Vetting is a skill we built for our own practice: it screens third-party AI tooling — MCP servers, hooks, agents, plugins, skills, and any installable Claude Code or Claude.ai add-on — for supply-chain risk before installation, the same way a vendor-risk team would vet a new vendor.

It checks for the failure modes that actually matter before a tool gets anywhere near a regulated workflow: prompt injection surface, excessive permissions, and opaque data flows that a quick read of a README won't surface.

We use it internally before installing anything into our own practice, and we're publishing it because the same risk questions apply to any regulated team adopting third-party AI tooling.

Open source, MIT-licensed, provided as-is. Built for our own vetting workflow and published for others to use or adapt — review the source before relying on it in a regulated environment.