New: the Agent Incident Ledger: disclosed incidents of AI gone rogueExplore the ledger
Manifold
Illustration of a worker in a yellow hazmat suit holding a glowing green rod in red tongs, while two robots swap the number on a DAYS WITHOUT ACCIDENT sign from 2 to 3.

Remove Risky Skills, Plugins and MCP Servers From Every Endpoint

Nov 12, 20263 Min

TL;DR

  • Reacting to a risk finding shouldn’t mean opening thousands of Jira tickets. When Manifest flags a risky skill, plugin or MCP server, you can reduce the risk yourself.
  • Go as granular as you need: remove one version from a single endpoint, or remove every version from all of them.
  • A person on the security team makes every removal. Nothing is removed automatically.

A developer needs to turn a few PDFs into text, finds a skill called pdfhelper, and installs it. It works. A week later, two teammates have it too.

Then Manifest flags it High. The skill hides code that tries to secretly download and run a program from the internet, and includes a script that collects passwords and access keys from the computer and sends them to an outside server.

You could write a policy that blocks it. But a blocked skill still sits on every laptop that installed it. Removal takes it off those laptops.

Remove it in a few clicks, without the tickets

From pdfhelper’s page in Manifold, the security team removes the skill straight from developer machines. No tickets to IT and no chasing each developer to uninstall it.

Remove exactly what you need

Removal goes as wide or as narrow as the situation needs. Take it off every endpoint at once, or only the machines you pick. Remove every version of a skill, or just the risky one.

In our demo, pdfhelper runs on three endpoints, each with a different version. Versions 2.0.0 and 2.1.0 come back Clear. Only 2.2.0 is rated High. You remove 2.2.0 and leave the clean versions where they are.

A person makes every removal

Someone on the security team chooses each removal, and that choice is recorded in the audit log.

We built it this way because uninstalling software from a developer's machine is disruptive and can't be undone. A risk finding is strong evidence, but on its own it does not prove an asset has to go. Scoping it to a group, replacing it with an approved alternative, or accepting the risk is often the better answer, and the security team knows things a verdict cannot: who depends on the skill and what it would break.

The Manifest verdict narrows where that attention goes. When most of the skills, plugins and MCP servers in an environment come back clean, the team reviews a short list of flagged assets instead of every install on every machine.

Pair removal with a block policy so the asset stays gone

Removal takes the asset off the machine today. It does not stop a developer from installing the same skill again tomorrow.

For an asset you want retired for good, use both halves together. Write a policy in block mode that denies the asset, so it cannot be used from now on. Then remove it from the endpoints where it is installed, so it is not sitting there. A policy alone leaves the asset on every machine. Removal alone leaves nothing stopping a reinstall.

Tags can carry the decision across many assets, with one caution: tagging an asset as blocked records a decision and does nothing on its own. It neither removes nor denies the asset until a policy reads that tag. Write one block-mode policy that denies anything tagged blocked, and every asset you tag later is covered.

What you needWhat to use
A flagged asset on many machines that you never want backRemove from all endpoints, then tag it for a block policy
An asset that is fine for one group and not anotherRemove endpoint by endpoint, plus a block policy scoped to the other groups
A suspicious asset you are still investigatingLeave it installed, alert on its use, and review its activity
An asset a team relies on, with a safer alternative availableAgree the switch with the team first, then remove and block

Tell developers before the asset disappears

From the developer’s side, a removed skill is gone the next time their agent looks for it. Manifold notifies them on their machine. A short heads-up from the security team still goes further. Tell them what is being removed and why, and point them to an approved alternative.

Where removal stops today

Removal covers MCP servers, skills and plugins: the things an agent loads. It never uninstalls the agent itself, so Claude Code, Cursor or GitHub Copilot stay on the machine. Code editor extensions, such as those for VS Code or Cursor, can't be removed yet. Removal also works on whole assets only, so a risky configuration such as a disabled sandbox still needs a fix on the device.

Coverage depends on the agent. Removal works for agents where Manifold can both inventory assets and remove them. Today that includes Claude Code, Cursor, Codex and Kiro, among others. Other agents are not covered yet.

About the author

  • Oleksandr Yaremchuk

    Oleksandr Yaremchuk

    CTO & Co-Founder

    Oleksandr is an engineering leader with 15+ years of building and scaling teams at companies of all sizes. He co-created LLM Guard, an open-source LLM firewall with over 12 million downloads, along with the security models that power it.

Latest articles