MCP, Skills, Hooks & Harnesses Explained for AppSec | Endor Labs

What it claims

Endor Labs argues that the harness, not just the model, shapes how secure agent-written code is. In its Agent Security League benchmark, Claude Fable 5 in Cursor wrote functionally correct code 72.6% of the time and secure code 29.0% of the time. The same model in Claude Code scored 59.8% and 19.0%. The post places most security controls around the model, because the model cannot reliably tell data from instructions.

How it works

The post ranks control points by how binding they are.

• Rules files and skills (CLAUDE.md, AGENTS.md, Cursor rules) are text the model weighs against its other context, so it can ignore them. Skills from untrusted sources can carry injected instructions. The post points to OpenSSF's guide to security-focused AI code assistant instructions as a starting template.
• Hooks receive a structured description of the pending action and return allow, deny or ask. Some harnesses let a hook rewrite the action. A denial returns a reason the agent can read, so it can try a safer approach. Example policies are blocking reads of .env or .pem files, blocking a known-malicious package install, and catching a secret before commit.
• MCP tools are best sorted as read-only (search, logs) or action (edits, tickets, installs). One server can expose both kinds.

flowchart LR
  M[Model requests tool call] --> H{Hook running?}
  H -- no --> X[Action runs unchecked]
  H -- yes --> D{Policy}
  D -- allow --> R[Tool executor]
  D -- deny + reason --> M
  D -- ask --> U[User decides]

Evidence

The benchmark gap is not consistent. With GPT-5.5, Cursor and Codex were 1.6 points apart on security. The post concludes that the harness "can shape outcomes," not that it always does. It gives no task count or methodology for the benchmark. The post also cites IDC's July 2026 DevSecOps and Application Security Survey: 79.6% of respondents said frontier AI companies' code security features caused at least a moderate reassessment of their AppSec tools.

Limits

The post names these failure modes:

• Local MCP servers run before any control. The harness usually launches them at session start, before any prompt, so a malicious server runs before other controls see a request.
• MCP config varies by machine. Config is per user or per repository, so the same tool name can resolve to the official package, a local script or a typosquat on different laptops.
• Hooks fail open. If the hook process is not running, work continues without it.
• Hooks can be bypassed. Harnesses without hook support skip them, and so do commands run in a separate terminal.
• Hooks can be removed. A developer can delete one with a settings edit unless managed settings lock it, so the hook configuration itself needs protecting.
• Plugins carry the agent's permissions. They are third-party code and belong in inventory alongside agents, MCP servers and skills.

The page is vendor content that promotes AURI, the Endor Labs MCP server, Agent Kit and AI Coding Agent Governance. It gives no install steps or pricing.