Open source agent security
agent-audit-kit
SAST scanner for AI agents. Full OWASP Agentic Top-10 + MCP Top-10.
SAST-style security scanner for agentic AI systems. Catches prompt-injection surfaces, tool-call abuse patterns, MCP STDIO injection (CVE-2026-30623), excessive agency, audit-trail gaps, and the rest of the OWASP Agentic + MCP threat surface, all caught at static-analysis time, before the agent reaches production.
Quickstart
Drop into any Python project. Outputs SARIF that GitHub Code Scanning understands natively. About 30 seconds.
pip install agent-audit-kit
agent-audit-kit scan ./your-agent-project --format sarif > agent-audit.sarifOr use the GitHub Action for CI-time scanning on every PR.
Rule catalogue
148 rules across these families. Each rule ships with a working detector, a remediation snippet, and a SARIF severity.
OWASP Agentic Top-10
Full 10/10 coverage. Prompt injection, sensitive info disclosure, supply-chain, data + model poisoning, improper output handling, excessive agency, tool integration risks, weak validation, audit trail gaps.
OWASP MCP Top-10
Full 10/10 coverage. STDIO config injection, MCP auth bypass, tool definition tampering, transport confusion, sandbox escape patterns, and the rest of the MCP threat surface.
Compliance rule families
Each maps a subset of the rule catalogue.
What it catches that nothing else does
MCP STDIO config injection
Rule family for CVE-2026-30623: unsanitised MCP STDIO configs that amount to RCE-by-design. Detected at config parse time. Most agent SAST tools don't cover the MCP transport at all.
Tool-call allow-list drift
Flags when an agent gains tool access that isn't in the declared allow-list. Catches scope-creep before a deploy compounds it.
Audit-trail-gap detection
Static-analysis pass that flags agent runs that can't be reconstructed from logs alone. The audit-trail-first principle, enforced at CI time.
Capability-lease enforcement
Flags long-lived keys passed to tool calls when capability-leases (short-lived, scoped, revocable) are the safer pattern. Cross-checks against Okta NHI / Cisco AWI integration points.
Interoperates with
OWASP-Agentic 10/10 coverage cross-mapped.
Listed as a SAST action. Drop into any GitHub Actions workflow.
Use it in your CI today
MIT-licensed. Public roadmap. 48-hour CVE-to-rule SLA. Star the repo to track new rule families as they ship.