Offline · stdlib-only · MIT
agentsec
39 small, offline security tools for people building and running AI agents: MCP servers and clients, coding agents, RAG pipelines, and tool-calling apps.
Try it in 30 seconds
pip install git+https://github.com/dunkleschitz/agentsec.git
agentsec mcpposture ~/.cursor/mcp.jsonOr clone and run a tool as a standalone script, no install required:
git clone https://github.com/dunkleschitz/agentsec.git
cd agentsec/tools/mcpposture
python3 mcpposture.py examples/risky_claude_desktop_config.jsonYou can also run five of the scanners in your browser. They execute locally with Pyodide; nothing you paste is uploaded. A labeled detection benchmark reports precision and recall on a small synthetic corpus, with a before/after table and a held-out set, and lists the misses.
The tools
Hidden instructions and rug-pulls in MCP tool manifests
Secrets leaked into agent transcripts and logs
Offline token and cost accounting for agent runs
Security smells in AI-written Python and JS/TS
Prompt-injection test harness with canary payloads
Least-privilege grades for MCP client configs
Behavioral diff of two agent runs
Least-privilege check for GitHub tokens agents used
Policy-as-code for agent tool calls
Hallucinated and typo-squatted package names
Indirect prompt injection in RAG source documents
Permission and autonomy grades for coding agents
Backdoors in AGENTS.md, CLAUDE.md, and rule files
Dangerous LLM output before it is rendered
AI bill of materials and shadow-AI drift in a repo
Lethal trifecta across an agent's whole toolset
Code-execution risk in pickle model files, unread
System-prompt leakage in transcripts and outputs
Prompt injection risk in AI-agent GitHub Actions
Taint from MCP tool arguments into dangerous sinks
Auth and injection issues in A2A Agent Cards
Runaway loops and retry storms in transcripts
Hashed MCP tool lockfile and rug-pull drift
Indirect prompt injection in tool results
SSRF and destination risk in URLs an agent fetched
Oversized tool results and context-window blowups
Floating model aliases and mid-run model switches
Missing human approval on consequential tool calls
Sensitive file paths an agent actually touched
Dangerous shell commands an agent actually ran
Unconstrained high-privilege tool-schema parameters
Poisoning in persistent agent memory stores
User input interpolated into system prompt templates
PII in transcripts, with optional redaction
Secrets flowing from tool results into later tool args
Guides
Tool results sit next to the system prompt. Scan them before the next turn.
Treat tools/list like a lockfile. Fail CI when a tool quietly changes.
No red team required. Six offline scanners, standard library only.
Heuristic scanners, not a security boundary. A clean result does not mean something is safe. Mappings to the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026) are in the README. All example secrets in the repository are fake.