githubinferredactive
agent-audit
provenance:github:HeadyZhang/agent-audit
WHAT THIS AGENT DOES
Agent-audit helps businesses find potential security weaknesses in the code that powers their AI agents. These agents often perform tasks like running tools or interacting with other systems, making them vulnerable to attacks if not properly secured. Agent-audit acts like a quality check, identifying risks like unauthorized access or malicious code injection before the agent is released. Security teams and developers responsible for AI agent safety will find it valuable for ensuring their agents are reliable and protected. It’s a proactive way to prevent costly security incidents and maintain trust in AI-powered operations.
README
# [Agent Audit](https://headyzhang.github.io/agent-audit/)
**Find security vulnerabilities in your AI agent code before they reach production.**
[](https://pypi.org/project/agent-audit/)
[](https://pypi.org/project/agent-audit/)
[](https://opensource.org/licenses/MIT)
[](https://github.com/HeadyZhang/agent-audit/actions/workflows/ci.yml)
[](https://codecov.io/gh/HeadyZhang/agent-audit?branch=master)
[]()
[](https://headyzhang.github.io/agent-audit/)
---
## Why Agent Security Fails in Production
AI agents are not just chatbots. They execute code, call tools, and touch real systems, so one unsafe input path can become a production incident.
- Prompt injection rewrites agent intent through user-controlled context
- Unsafe tool inputs can reach `subprocess`/`eval` and become command execution
- MCP configuration mistakes can leak credentials and expand access unintentionally
If your team ships agent features, owns CI security gates, or operates MCP servers and tool integrations, this is a high-probability risk surface rather than an edge case.
You likely need this before every merge if agent code can trigger tools, commands, or external systems.
**Agent Audit** catches these issues before deployment with an analysis core designed for agent workflows today: tool-boundary taint tracking, MCP configuration auditing, and semantic secret detection, with room to extend into learning-assisted detection over time.
Think of it as **security linting for AI agents**, with 53 rules mapped to the [OWASP Agentic Top 10 (2026)](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/).
---
## Quick Start in 6 Lines
1. Install
```bash
pip install agent-audit
```
2. Scan your project
```bash
agent-audit scan ./your-agent-project
```
3. Interpret and gate in CI
```bash
# Show only high+ findings
agent-audit scan . --severity high
# Fail CI when high+ findings exist
agent-audit scan . --fail-on high
```
`--severity` controls what is reported. `--fail-on` controls when the command exits with code `1`.
Sample report output:
```
╭──────────────────────────────────────────────────────────────────────────────╮
│ Agent Audit Security Report │
│ Scanned: ./your-agent-project │
│ Files analyzed: 2 │
│ Risk Score: 8.4/10 (HIGH) │
╰──────────────────────────────────────────────────────────────────────────────╯
BLOCK -- Tier 1 (Confidence >= 90%) -- 16 findings
AGENT-001: Command Injection via Unsanitized Input
Location: agent.py:21
Code: result = subprocess.run(command, shell=True, capture_output=True, text=True)
AGENT-010: System Prompt Injection Vector in User Input Path
Location: agent.py:13
Code: system_prompt = f"You are a helpful {user_role} assistant..."
AGENT-041: SQL Injection via String Interpolation
Location: agent.py:31
Code: cursor.execute(f"SELECT * FROM users WHERE name = '{query}'")
AGENT-031: Mcp Sensitive Env Exposure
Location: mcp_config.json:1
Code: env: {"API_KEY": "sk-a***"}
... and 15 more
Summary:
BLOCK: 16 | WARN: 2 | INFO: 1
Risk Score: =========================----- 8.4/10 (HIGH)
```
---
Validation snapshot (as of **2026-02-19**, v0.16 benchmark set): **94.6% recall**, **87.5% precision**, **0.91 F1**, with **10/10 OWASP Agentic Top 10** coverage across **9 open-source targets**.
Details: [Benchmark Results](docs/BENCHMARK-RESULTS.md) | [Competitive Comparison](docs/COMPETITIVE-COMPARISON.md)
---
## What It Detects
| Category | What goes wrong | Example rule |
|----------|----------------|--------------|
| **Injection attacks** | User input flows to `exec()`, `subprocess`, SQL | AGENT-001, AGENT-041 |
| **Prompt injection** | User input concatenated into system prompts | AGENT-010 |
| **Leaked secrets** | API keys hardcoded in source or MCP config | AGENT-004, AGENT-031 |
| **Missing input validation** | `@tool` functions accept raw strings without checks | AGENT-034 |
| **Unsafe MCP servers** | No auth, no version pinning, overly broad permissions | AGENT-005, AGENT-029, AGENT-030, AGENT-033 |
| **MCP tool poisoning** | Hidden instructions or data exfiltration in tool descriptions | AGENT-056, AGENT-057 |
| **MCP tool shadowing** | Multiple servers register identical tool names to override behavior | AGENT-055 |
| **MCP rug pull / drift** | Server tools change after initial security audit | AGENT-054 |
| **No guardrails** | Agent runs without iteration limits or human approval | AGENT-028, AGENT-037 |
| **Unrestricted code execution** | Tools run `eval()` or `shell=True` without sandboxing | AGENT-035 |
| **Source map leakage** | Debug artifacts (.map, .pdb) included in published agent packages | AGENT-110 |
| **Sub-agent privilege escalation** | Child agents inherit parent's full tool set without restriction | AGENT-112 |
| **Delegation without auth** | Cross-agent delegation without identity verification | AGENT-113 |
| **Auto-approve all tools** | Agent auto-approves tool execution without safety classification | AGENT-117 |
| **HITL bypass** | Human-in-the-loop approval bypassed via delegation or self-modification | AGENT-118 |
| **Trace suppression** | AI attribution removed from git commits, logs, or outputs | AGENT-119 |
| **Config hooks poisoning** | Malicious hooks in .claude/settings.json, .cursor/, .mcp.json (CVE-2025-59536) | AGENT-120 |
Full coverage of all 10 OWASP Agentic Security categories. Framework-specific detection for **LangChain**, **CrewAI**, **AutoGen**, and **AgentScope**. [See all rules ->](docs/RULES.md)
---
## OpenClaw Support
Agent Audit is available as an [OpenClaw](https://openclaw.ai) skill on ClawHub:
```bash
npx clawhub@latest install agent-audit-scanner
```
Once installed, ask your OpenClaw agent:
- "Scan my installed skills for security issues"
- "Is this new skill safe?"
- "Audit my OpenClaw config"
The scanner covers all 10 OWASP Agentic AI threat categories and has been validated against 18,899 ClawHub skills at 80% precision.
---
## Who Is This For
- **Agent developers** building with LangChain, CrewAI, AutoGen, OpenAI Agents SDK, or raw function-calling -- run it before every deploy
- **Security engineers** reviewing agent codebases -- get a structured report in SARIF for GitHub Security tab
- **Teams shipping MCP servers** -- validate your `mcp.json` / `claude_desktop_config.json` for secrets, auth gaps, and supply chain risks
---
## Usage
```bash
# Scan a project
agent-audit scan ./my-agent
# JSON output for scripting
agent-audit scan ./my-agent --format json
# SARIF output for GitHub Code Scanning
agent-audit scan . --format sarif --output results.sarif
# Only fail CI on critical findings
agent-audit scan . --fail-on critical
# Inspect a live MCP server (read-only, never calls tools)
agent-audit inspect stdio -- npx -y @modelcontextprotocol/server-filesystem /tmp
```
### Baseline Scanning
Track only *new* findings across commits:
```bash
# Save current state as baseline
agent-audit scan . --save-baseline baseline.json
# Only report new findings not in baseline
agent-audit scan . --baseline baseline.json --fail-on-new
```
### GitHub Actions
<details>
<summary><b>Show GitHub Action Example and Inputs</b></summary>
<br/>
```yaml
name: Agent Security Scan
on: [push, pull_request]
jobs:
audit:
[truncated…]PUBLIC HISTORY
First discoveredMar 21, 2026
IDENTITY
inferred
Identity inferred from code signals. No PROVENANCE.yml found.
Is this yours? Claim it →METADATA
platformgithub
first seenFeb 3, 2026
last updatedMar 20, 2026
last crawledtoday
version—
README BADGE
Add to your README:
