Your AI agents follow instructions from every MCP server, skill and plugin you connect, and those instructions go straight into the model as trusted input. Code review and dependency scanners can't read them. Cupel can.

Cupel scans agentic extensions before they reach your agents. It flags poisoned tool descriptions, look-alike packages and silent changes after you've approved something. Every verdict shows the exact evidence behind it.