agent-security

Scan an AI agent configuration for risky permissions, leaked secrets, unpinned MCP servers and prompt injection in instruction files, with a bundled scanner that masks secrets. Use when asked to "check my .claude settings", to review or harden CLAUDE.md, .cursor rules, .mcp.json, hooks, skills or plugins, or before trusting a cloned repository. Not for application code (prompt-injection-review, semgrep-agentic) or MCP server code (mcp-server-review).

Build a security evaluation for an agent with benign tasks, injections planted in tool results, and utility and attack-success-rate scores, using a bundled standard-library runner and a policy hook. Use when asked "what is our attack success rate?", to measure prompt-injection resistance, or to compare defences. Not for a manual code review without numbers (prompt-injection-review), and not a replacement for the full AgentDojo benchmark.

Review an AI agent session log for signs that prompt injection took effect, tool misuse, data leaving the boundary and loops, with a bundled script that normalises transcript, chat and event logs and writes a timeline of flagged events. Use when asked "what did the agent actually do in this session?", after a suspicious run, or before trusting an agent's output. Not for agent configuration (agent-config-audit), agent source code (prompt-injection-review) or AWS API activity (aws-agent-session-audit in aws-security).

Write a threat model for an LLM-agent system by drafting principals, tools, channels, data stores and controls in YAML from the code, running the atm analyser for STRIDE and OWASP findings, and summarising with incident precedents. Use when asked to "threat model this agent", for its attack surface, or for a design review. Not for scanning code (semgrep-agentic) or a ship decision (secure-agent-checklist).

Look up 80 coded AI-agent security incidents from 2023 to 2026, mapped to OWASP Agentic and LLM Top 10 and MITRE ATLAS, and summarise precedents with sources. Use when asked "has this happened before?", to justify a control with evidence, or to cite incidents in a threat model. Not for general CVE lookups or a live threat feed; it reads a daily-refreshed copy of the published dataset and falls back to a bundled snapshot offline.

Review an MCP server you wrote or plan to install for missing authentication, public network binding, tool description poisoning, path traversal, SSRF, weak input validation and secrets in logs, then report a verdict per area with severity and file:line. Use when asked "is this MCP server safe to install?", before publishing a server, or before enabling a third-party one. Not for agent configuration files (agent-config-audit) or the agent that calls the server (prompt-injection-review).

Trace untrusted input such as web pages, emails, tickets and tool results to consequential tool calls in agent code, and judge each path against provenance and approval rules. Use when asked "can this agent be prompt injected?", to find exfiltration or privilege paths, or to decide where approvals belong. Not for config files (agent-config-audit) or for measuring attack success rates (agent-eval-harness).

Run a pre-ship security checklist for an LLM agent covering identity, least privilege, approvals, sandboxing, audit, kill switch, supply chain and evals, and report pass, fail or n.a. per item with evidence. Use when asked "is this agent safe to ship?" or before deploying, open-sourcing or demoing one. Not for a deep component review (agent-threat-model, prompt-injection-review); it turns their evidence into a decision.

Scan Python, JavaScript and TypeScript agent code with 36 Semgrep rules (model output reaching shells, SQL, paths or HTML, user input in system prompts, MCP servers without auth, leaked provider keys), with a bundled offline fallback, and triage the hits. Use when asked to "scan this agent for security issues", to add agent rules to CI, or for the code step of an agent security audit. Not for general SAST, other languages or runtime behaviour.