Agent Audit Kit

AgentAuditKit The missing npm audit for AI agents.

---

Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust boundary violations, and tainted data flows across 13 agent platforms.

Two things it does that hosted scanners can't:

1. Runs fully offline and deterministically. Your code, configs, and secrets never leave the machine; the default scan path makes zero network calls, and the same input always yields the same finding (no model in the loop). No account, no telemetry.
2. Produces auditor-ready compliance-evidence packs. SARIF for the GitHub Security tab plus PDF evidence reports mapped to 13 frameworks (EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes) — what you hand an auditor, not just a list of findings.

• 225 rules across 11 security categories, covering the 2026 CVE wave
• Rule count is computed from the registry and verified in CI (test_rule_count_is_canonical).
• 79 scanner modules including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
• 16 CLI commands: scan, discover, pin, verify, fix, score, update, proxy, kill, watch, plus export-rules, verify-bundle, sbom, report, install-precommit, and the Security-Advisories scan flag
• OWASP coverage: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
• Compliance mapping (13 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, NSA MCP Security CSI (U/OO/6030316-26, May 2026), Singapore Agentic AI, India DPDP 2023, Alabama Personal Data Protection Act (HB 351, 2026), Tennessee SB 1580 Health Care AI (PRA), MCP 2026 Roadmap (May 2026) — PDF reports via agent-audit-kit report --format pdf --framework
• Supply chain: deterministic rule bundle (export-rules), Sigstore-signed releases, CycloneDX + SPDX SBOM (sbom)
• MCP Security Index: weekly public leaderboard at sattyamjjain.github.io/agent-audit-kit — per-server grade cards (A–F), 90-day [disclosure policy](docs/disclosure-policy.md)
• CVE coverage: newly disclosed MCP CVEs are triaged and turned into rules as they land — surfaced automatically by the NVD watcher ([cve-watcher.yml](.github/workflows/cve-watcher.yml)) and logged in [CHANGELOG.cves.md](CHANGELOG.cves.md)
• Zero cloud dependencies — runs fully offline, zero network calls in the default scan path

Why This Exists

In early 2026, 30 MCP CVEs dropped in 60 days. CVE-2026-33032 (Nginx-UI MCP auth bypass, CVSS 9.8) exposed a shared-handler pattern that several other servers have. CVE-2025-59536 turned a project-local Claude Code hook into RCE. CVE-2026-34070 hit LangChain's load_prompt() with absolute-path and .. traversal. CVE-2026-21852 demonstrated source-code exfiltration via a single Claude Code config flag. A 2,614-server survey found 82% of public MCP servers had path-traversal issues. On 2026-05-01, OX Security disclosed 10+ CVEs across DocsGPT, GPT-Researcher, Agent-Zero, LettaAI, LiteLLM, LangFlow, Flowise, Bisheng, and Langchain-Chatchat — all rooted in the same MCP STDIO command-injection class AAK-MCP-STDIO-CMD-INJ-* covers. Meanwhile, every AI coding assistant adopted MCP with sparse security tooling.

AgentAuditKit is the deterministic, auditor-ready OSS scanner that closes the gap.

> Architectural note: AAK rules are multi-arm adjudicators (pin arm + source/config arm + explicit-reject short-circuit + adjudicator log), not single-shot regex matchers. See [docs/notes/adjudicator-pattern.md](docs/notes/adjudicator-pattern.md) for the four-arm structure and the Mozilla / arXiv precedents.

---

Quick Start

GitHub Action (Recommended)

# .github/workflows/agent-security.yml
name: Agent Security Scan
on: [push, pull_request]

permissions:
  security-events: write
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sattyamjjain/agent-audit-kit@v0.3.41
        with:
          fail-on: high

Findings appear as inline PR annotations in the GitHub Security tab via SARIF.

CLI

pip install agent-audit-kit
agent-audit-kit scan .

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/sattyamjjain/agent-audit-kit
    rev: v0.3.41
    hooks:
      - id: agent-audit-kit

Try It Now

Scan a deliberately vulnerable config to see AgentAuditKit in action:

git clone https://github.com/sattyamjjain/agent-audit-kit
cd agent-audit-kit
pip install -e .
agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/

11 vulnerability examples covering all security categories in the [examples/](examples/) directory. See also the [damn-vulnerable-MCP-server case study](examples/case-studies/damn-vulnerable-mcp/).

---

What It Scans

| Category | Rules | What It Detects | |----------|:-----:|-----------------| | MCP Configuration | 52 | Missing auth middleware (CVE-2026-33032 class), empty IP allowlists, wildcard CORS, path traversal in resource handlers, SSRF (CWE-918), OAuth 2.1 misconfig (PKCE/S256/DPoP), Tasks primitive leakage (SEP-1686), shell injection, MCPwn middleware-asymmetry, Azure MCP no-auth (CVE-2026-32211), MCP Inspector vendored fork (CVE-2026-23744), 2026-07-28 stateless-MCP migration (Mcp-Session-Id reliance, removed tasks/list, sticky-session deployment, un-cached client tools/list), deny-by-default attested admission (signed clearance / /.well-known/mcp-clearance / pinned trust root — arXiv:2605.24248), Anthropic MCP Tunnels gateway (SSRF defense disabled / upstream.disable_ip_validation, HTTPS upstream missing upstream.tls.ca_file trust anchor, tunnel token + TLS private keys hardcoded in CI / committed Kubernetes Secrets — research preview 2026-05-19), stdio launcher injection (npx/node/bash/sh/python with -c/-e/--eval, or non-pinned interpolated argv — CVE-2026-40933), tool-gate enforcement asymmetry (allowlist / read-only / non-destructive check applied in tools/list but not tools/call — CVE-2026-46519), unauthenticated MCP HTTP/SSE server on 0.0.0.0 / wildcard CORS (GitLab/Nocturne/AgenticMail no-auth class — CVE-2026-44895/44830/50287), plus the non-loopback no-auth launch surface — mcp.json/claude_desktop_config.json/*.mcp.yaml command/args, Docker --host 0.0.0.0/-p 0.0.0.0:, and MCP Inspector / FastMCP startup binding 0.0.0.0/::/a routable IP with no token or DANGEROUSLY_OMIT_AUTH set (CWE-306; MCP Inspector exemplar CVE-2026-23744; mcp-pinot 0.0.0.0:8080 no-auth CVE-2026-49257; Windows-MCP wildcard-CORS no-auth CVE-2026-48989; ~12,520 exposed services per Censys), argv-rebuild-after-allowlist command-injection TOCTOU (a command/argv approved against an allow/deny list is re-split / re-joined / extended before subprocess/os.exec* / Node child_process.spawn/execa with no re-check — AAK-MCP-ARGV-TOCTOU-001, CWE-77 + CWE-367 / CVE-2026-53822), MCP server unauthenticated-by-default / fail-open auth (an auth function returning truthy on an empty/unset secret, a placeholder/empty secret literal — ""/changeme/os.environ.get(...,"") — or a warning-only secret gate on a 0.0.0.0 bind — AAK-MCP-NOAUTH-DEFAULT, CWE-306 + CWE-862 / CVE-2026-48814 (incomplete fix of CVE-2026-46701)) | | Supply Chain | 41 | Vulnerable LangChain / langchain-text-splitters versions, named pin rules for astro-mcp-server / chatgpt-mcp-server / docsgpt / gpt-researcher / litellm / mcp-calculate-server / semantic-kernel / @anthropic-ai/claude-code / apache-doris-mcp-server / excel-mcp-server, OX MCP-STDIO command-injection (Python/TS/Java/Rust) — AAK-MCP-STDIO-CMD-INJ-001..004 — Stainless-generator lineage, marketplace.json signatures / typosquat / mutable refs, unpinned packages, dangerous install scripts, untrusted-search-path executable override in skill/install flows (.env-sourced binary, workspace-prepended PATH, shutil.which over a tainted PATH, Homebrew env override — AAK-SKILL-UNTRUSTED-EXEC-PATH, CWE-426 / CVE-2026-53819) | | Tool Poisoning | 26 | Invisible Unicode / bidi, skill frontmatter injection, SKILL.md post-install commands, data-exfil primitives, skill name hijacking, cross-tool references, rug-pull (SHA-256 pinning), @mcp.tool unsafe-eval (CVE-2026-44717 generalization), OpenAPI smells (Hermes paper LAZY/BLOATED/TANGLED), Metis POMDP refusal-refeed + scoring-sink, SkillsVote lifecycle attribution, MCP Calculate Server pin. Indirect-prompt-injection detection (AAK-POISON-001..006) runs against tool descriptions and every per-parameter inputSchema.properties.*.description (recursive — nested objects, array items, anyOf/allOf/oneOf), so instruction text hidden in a single argument's docstring is caught | | Secret Exposure | 18 | Anthropic/OpenAI/AWS/GitHub/GitLab/GCP keys, Shannon-entropy detection, .env leaks, private-key files, hardcoded credential surface, token-leak via log sinks (CVE-2026-20205), ${VAR}/process.env placeholder resolution on user-supplied MCP URLs → secret exfiltration (CVE-2026-32625) | | Agent Config | 15 | Routines permission escalation + schedule injection + audit-log gaps, AGENTS.md/CLAUDE.md/.cursorrules hijacking, hidden Unicode, encoded payloads, internal scanner-fail signal, Project Deal economic-drift detection | | A2A Protocol | 13 | Missing mutual auth, unbounded delegation, transitive trust, replay protection, schema confusion, HTTP endpoints, JWT lifetime/validation, impersonation, multi-agent shared-state without lock (Code-as-Harness) | | Hook Injection | 12 | Hook RCE (CVE-2025-59536 class), shell=True + interpolation, pre-trust execution, network-capable hooks, credential exfiltration | | Taint Analysis | 13 | @tool param flows to shell/eval/SQL/SSRF/file/deserialization sinks (Python AST), load_prompt() user-path reachability, transport-flip MITM (DocsGPT + GPT-Researcher). SQL-injection sinks (AAK-TAINT-005) now detected in TypeScript/JS MCP servers too — interpolated/concatenated .query()/.execute(), knex.raw, Prisma $queryRawUnsafe — matching the Python + Rust scanners (OX MCP-SDK disclosure class). LLM-generated SQL executed on an RCE-capable DB role (AAK-LLM-SQL-RCE-001, CVE-2026-25879) — model output reaching cursor.execute/text(...)/.query() as the query itself with no allow-list, plus superuser/COPY ... FROM PROGRAM/xp_cmdshell/FILE-privilege connection roles that turn SQL injection into shell | | Transport Security | 11 | HTTP endpoints, TLS disabled, deprecated SSE, tokens in URL query strings, transport body-size limits (CVE-2026-39313), SSRF redirect bypass (CVE-2026-41481), DNS-rebinding (CVE-2025-66414/66416, CVE-2026-35568/35577) | | Legal Compliance | 12 | Copyleft licenses (AGPL/SSPL), missing licenses, DMCA-flagged packages, India PII surface, US-state consumer privacy (Alabama HB 351, Tennessee SB 1580), Singapore Agentic AI, healthcare AI triggers, EU AI Act Article 15 multilingual-eval coverage advisory (binding 2026-08-02) | | Trust Boundaries | 12 | enableAllProjectMcpServers, API URL redirects, wildcard permissions, missing deny rules, missing allowlists, Claude Code folder-trust bypass (CVE-2026-40068) |

225 rules total. Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.

Agent Platforms Scanned

Claude Code, Cursor, VS Code Copilot, Windsurf, Amazon Q, Gemini CLI, Goose, Continue, Roo Code, Kiro + user-level global configs.

Language Support

| Language | Scanning Method | What It Finds | |----------|----------------|---------------| | Python | AST analysis (stdlib ast) | @tool param flows to dangerous sinks (eval, subprocess, SQL, file I/O, HTTP); LangChain load_prompt() user-path reachability | | TypeScript / JS | Regex pattern scan | eval(), child_process.exec, fs.writeFileSync, SSRF patterns, OAuth token passthrough in MCP server files | | Rust | Regex pattern scan | Command::new(format!()), unsafe blocks, SQL macros without parameterization |

Note: Phase 2 scanners (ssrf_patterns, oauth_misconfig, mcp_auth_patterns, hook_rce, skill_poisoning, mcp_tasks) are regex-based; a tree-sitter AST migration is tracked in issue #22._

---

CLI Reference

Commands

| Command | Description | |---------|-------------| | agent-audit-kit scan . | Full security scan | | agent-audit-kit scan . --ci | CI mode: SARIF + --fail-on high | | agent-audit-kit discover | Find all AI agent configs on the machine | | agent-audit-kit pin . | Pin tool definitions (SHA-256 hashes) | | agent-audit-kit verify . | Check tools against pins (detect rug pulls) | | agent-audit-kit fix . --dry-run | Auto-fix common misconfigurations | | agent-audit-kit score . | Security grade (A-F) + SVG badge | | agent-audit-kit update | Update vulnerability database | | agent-audit-kit proxy --port 8765 --target URL | Start MCP interception proxy | | agent-audit-kit kill | Terminate running proxy | | agent-audit-kit export-rules --out rules.json | Write deterministic rule bundle + SHA-256 (Sigstore-signable) | | agent-audit-kit verify-bundle rules.json [--signature sig] | Verify bundle digest or Sigstore signature | | agent-audit-kit sbom . --format {cyclonedx,spdx} | Emit CycloneDX 1.5 / SPDX 2.3 SBOM for MCP deps | | agent-audit-kit report . --framework FRAMEWORK --format pdf | Auditor-ready compliance report (EU AI Act / SOC 2 / ISO 27001 / HIPAA / NIST AI RMF) | | agent-audit-kit install-precommit | Add the hook to .pre-commit-config.yaml |

Scan Flags

| Flag | Default | Description | |------|---------|-------------| | --format | console | Output: console, json, sarif | | --severity | low | Minimum severity to report | | --fail-on | none | Exit 1 at this severity: critical, high, medium, low, none | | --output / -o | stdout | Write output to file | | --ci | | Shorthand: --format sarif --fail-on high -o agent-audit-results.sarif | | --config | | Path to .agent-audit-kit.yml | | --rules | all | Comma-separated rule IDs to include | | --exclude-rules | | Comma-separated rule IDs to skip | | --ignore-paths | | Comma-separated paths to exclude | | --include-user-config | | Also scan ~/.claude/, ~/.cursor/, etc. | | --score | | Show security score and grade | | --owasp-report | | Generate OWASP coverage matrix | | --compliance FRAMEWORK | | Compliance report: eu-ai-act, soc2, iso27001, hipaa, nist-ai-rmf, mcp-2026-roadmap | | --verify-secrets | | Probe APIs to check if leaked keys are live (opt-in) | | --diff BASE_REF | | Only report findings in files changed since BASE_REF | | --llm-scan | | Local LLM semantic analysis via Ollama (opt-in) | | --strict-loading | | Fail loudly if any optional scanner module can't be imported (default: silently skip) | | --verbose / -v | | Detailed scan progress |

Exit Codes

| Code | Meaning | |:----:|---------| | 0 | Scan passed — no findings exceed --fail-on threshold | | 1 | Scan failed — findings meet or exceed --fail-on severity | | 2 | Error — invalid path, malformed config, etc. |

---

Conf

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: sattyamjjain
• Source: sattyamjjain/agent-audit-kit
• License: MIT
• Homepage: https://github.com/sattyamjjain/agent-audit-kit#readme

Install and usage instructions live in the source repository linked above.