Skip to main content

Limitations

This page is in the main navigation on purpose. It is the part most tools leave out, and it is what determines whether Unveilr Guard fits your threat model.

Enforcement is adapter-specific​

Unveilr Guard blocks actions on paths where it sits authoritatively — today, the MCP gateway. It does not intercept everything an agent does, and it never claims to.

If an agent shells out, calls an API directly, or talks to an MCP server you have not put behind the proxy, that action is not evaluated.

A local guard can be bypassed​

Any process that does not route through the interception path is not subject to it. This is a property of where the tool sits, not a defect to be patched: a user-space binary cannot be authoritative over everything on the machine.

Treat the gateway as a control over the calls you route through it — which is a real and useful control — not as a boundary around the agent.

Discovery is not proof of exploitability​

Finding that an agent can reach something is not evidence that it has, or that an attacker could. Findings describe reachable paths, and reachable is a weaker claim than exploited.

Credential discovery does not imply exfiltration​

Detecting that a credential is reachable is the entire claim. Nothing infers that it was used, read, or transmitted — and credential values are never read in the first place.

Privilege analysis may be incomplete​

Where conditional IAM cannot be fully resolved, findings say so and carry a lower confidence. An unresolved condition is reported as unresolved rather than assumed either way.

A workstation cannot see the organisation​

Cross-workstation and cross-account correlation requires the commercial control plane. A single machine has a single machine's view, and this tool does not pretend otherwise. See Open source vs Enterprise.

It is not a replacement for your existing controls​

Not CSPM, not EDR, not IAM, not SIEM, not sandboxing. It answers a narrower question: what can this agent do, and should it.

Narrow is the point. A tool that claimed to replace those would be easier to sell and impossible to trust.

Pre-1.0​

Schemas are v1alpha1 and may change before 1.0. Breaking changes are documented. The identifier scheme for findings is actively inconsistent between the shipped detector and the published catalogue — see Findings, which says so rather than papering over it.