Amp security integration

Endor Labs inside Amp

We connected Amp to Endor Labs through MCP, giving the coding agent live vulnerability intelligence, dependency risk checks, repo scans, and security-review tooling while it works.

MCP server endorctl ai-tools Agent-native guardrails Works across MCP-capable agents

Integration result

endor-cli-tools command: ~/.local/bin/endorctl.exe args: ai-tools mcp-server

Validated with a real vulnerability lookup: lodash 4.17.20 returned 3 known vulnerabilities and a recommended safe upgrade.

Why this matters

Security feedback moves into the coding loop

Instead of waiting for CI, a client scan, or a release SBOM, Amp can ask Endor questions at the exact point where dependency and code decisions are made.

1

Before adding dependencies

Check package, ecosystem, and version for known vulnerabilities, malware risk, and recommended safe versions.

2

Before finishing changes

Run targeted scans for vulnerabilities, secrets, SAST, AI-SAST, or GitHub Actions risks where appropriate.

3

During triage

Query CVE/GHSA records and Endor resources directly from the agent workflow.

Architecture

Amp talks MCP; Endor does the security work

The integration is lightweight: Amp launches a local Endor MCP server over stdio, then calls its tools when security context is needed.

Ampcoding agent
tool caller

↓

MCP stdiolocal protocol
standard interface

↓

endorctl ai-tools mcp-serverlocal Endor server
exposes tools

↓

Endor Labsvuln DB, scans,
policy context

What Amp can call now

Available Endor tools

Dependency checks

check_dependency_for_vulnerabilities
Check a specific dependency version for known vulnerabilities.

Risk checks

check_dependency_for_risks
Check vulnerabilities plus broader package risk signals, including malware.

Vulnerability details

get_endor_vulnerability
Retrieve CVE/GHSA details from Endor’s vulnerability database.

Repo scans

scan
Scan repositories for dependencies, vulnerabilities, secrets, SAST, AI-SAST, and GitHub Actions risks.

Diff review

security_review
Analyze local changes or main-vs-last-commit diffs when Enterprise features are enabled.

Endor resources

get_resource
Retrieve projects, package versions, findings, metrics, policies, and scan results.

Validated smoke test

The integration returned real vulnerability intelligence

Prompt

Check if the npm package lodash version 4.17.20 has any vulnerabilities.

Endor result

3

known vulnerabilities

Yes

version is vulnerable

4.18.1

recommended version

Returned vulnerability IDs included GHSA advisories, proving Amp can call Endor’s MCP tool successfully.

Positioning

Endor complements SBOMator and SkillSpector

Endor Labs in Amp

Agent-native dependency risk, vulnerability lookup, secrets/SAST scans, and security checks while coding.

Formal SBOM/VEX deliverables, embedded firmware component recovery, or AI-skill-specific threat modeling.

SBOMator

Professional SBOM generation, CycloneDX/VEX, FDA/client reports, embedded SDKs, firmware, binary analysis, supplier/license enrichment.

Live agent guardrails and cloud-backed security-policy context during coding.

SkillSpector

AI agent skill security: prompt injection, exfiltration, tool poisoning, excessive agency, MCP least privilege, malicious triggers.

General-purpose SBOM generation or full software dependency-management workflows.

Cross-agent portability

The same Endor server works wherever MCP works

Claude Code, Codex, Cursor, Gemini CLI, Amp, and other MCP-capable agents can all launch the same Endor MCP server. What differs is the client-specific config and instruction file.

Reusable core

endorctl ai-tools mcp-server

Claude Code: CLAUDE.md Amp: AGENTS.md Cursor: rules Gemini: GEMINI.md Codex: project instructions

The tools are similar across agents; behavior depends on when each agent chooses to call them.

Windows implementation note

We used the direct binary because npx was unreliable here

Endor’s docs commonly use npx -y endorctl. On this Windows machine, npx downloaded the package but failed to expose the executable reliably, so Amp now calls endorctl.exe directly.

Documented pattern

npx -y endorctl ai-tools mcp-server

Good default when npx and PATH behavior are clean.

Configured pattern

~/.local/bin/endorctl.exe ai-tools mcp-server

More deterministic for this workstation.

How we should use it

Recommended operating model

A

Dependency change

When adding or upgrading a dependency, ask Endor to check the exact ecosystem, package, and version before committing.

B

Security-sensitive code

Run Endor scans or diff review before finishing work that touches auth, parsing, networking, secrets, build pipelines, or manifests.

C

Release/client package

Use SBOMator for formal deliverables, then use Endor as extra validation where cloud policy or quick triage helps.

Optional next step

Add lightweight AGENTS.md rules so Amp automatically checks Endor when dependency manifests change, without forcing a full security scan on every normal edit.

Bottom line

Endor makes Amp a safer coding partner

SBOMator remains the formal SBOM/compliance engine. SkillSpector remains the AI-skill security scanner. Endor fills the coding-loop gap: fast, agent-native security intelligence while changes are being designed and implemented.

Message to stakeholders

“We integrated Endor Labs into Amp so security checks happen before risky dependencies and code changes reach CI, release packaging, or customer deliverables.”