Agent Audit CLI
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
- 245 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The scanner reads source files, config files and any secrets found in the project, but changes nothing itself
- The inspect command launches the given MCP server as a process, so it should be used only on trusted servers
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/agent-auditDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The scanner reads source files, config files and any secrets found in the project, but changes nothing itself
- The inspect command launches the given MCP server as a process, so it should be used only on trusted servers
This is third-party code. Review the repository files before installing.
What it does
Agent Audit checks a project with an agent before release: `agent-audit scan ./project` parses Python code, JSON and YAML configs and secret-bearing files and produces a report with a risk score from 0 to 10. Rules cover prompt injection, dangerous `subprocess` and `eval` calls from tool functions, key leaks in code and MCP configs, servers without authentication, tool shadowing and poisoned tool descriptions, and auto-approval of all tools. The engine follows data from `@tool` function parameters to a dangerous call, finds secrets in three stages and parses files such as `claude_desktop_config.json` and `.mcp.json`. The `agent-audit inspect stdio -- npx -y ...` command connects to a live MCP server and reads its tool descriptions without calling them. LangChain, CrewAI, AutoGen and AgentScope have dedicated checks. In CI use `--fail-on high`: exit code 1 appears when findings of that level or above exist. Output formats are terminal, JSON, SARIF for GitHub Code Scanning and Markdown. `--save-baseline` and `--baseline` track only new findings.
Who it is for. Teams that ship agents on LangChain, CrewAI or AutoGen and MCP servers and want to stop a vulnerability before it merges to the main branch.
Good fit when
- A pull request adds a tool function that passes a user string to `subprocess.run` with `shell=True`
- In `claude_desktop_config.json` an MCP server has an API key in plain text and no pinned package version
- Before installing someone else's MCP server you need to learn whether tool descriptions hide instructions
- CI needs a severity gate and a SARIF report in the repository Security tab
Not a fit when
- Runtime behavior of an agent must be analyzed: the scanner reads code and configs and does not check live dialogues
- The project uses a language with no Python and no MCP configs: the main code analysis targets Python
- Findings are needed with no manual triage: by the author's own measurement some detections are false
Example request
Run agent-audit scan . --severity high in the project root and go through the findings, starting with command injection in tool functionsLimitations
- The main code analysis targets Python, and the rest is covered by config, JSON, YAML and secret checks.
- On the author's own set of 81 samples precision is 68.86 percent and recall 84.32 percent, so findings need manual triage.
- The `inspect` command launches the given MCP server and reads its tools without calling them, so run only servers you trust.
- The last commit was in September 2026. The repository description says 51 rules, while the README counts 66.
How to disable. Remove the package with `pip uninstall agent-audit`. If you added the GitHub Action `HeadyZhang/agent-audit@v1`, delete the step from the workflow file.
FAQ
What is the difference between --severity and --fail-on?
`--severity` sets which findings enter the report, while `--fail-on` sets the level at which the command exits with code 1. CI usually uses `--fail-on high`.
How do I get a report for the GitHub Security tab?
Run `agent-audit scan . --format sarif --output results.sarif` or add the GitHub Action `HeadyZhang/agent-audit@v1`, where `upload-sarif` is on by default.
Is there a version as an OpenClaw skill?
Yes, `agent-audit-scanner` lives on ClawHub and installs with `npx clawhub@latest install agent-audit-scanner`. It checks installed skills and the OpenClaw configuration.
How do I avoid reviewing old findings on every run?
Save the current state with `--save-baseline baseline.json`, then run with `--baseline baseline.json --fail-on-new`. Only new findings then reach the report.
How do I read the score in the report?
The report splits findings into BLOCK, WARN and INFO, and BLOCK Tier 1 holds findings with confidence of 90 percent or higher. The overall score runs on a 0 to 10 scale with a label, for example 8.4/10 (HIGH).
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Agent Audit (this card) | no | 245 | |
| Snyk Agent Scan | no | 3,208 | a Snyk CLI that finds installed MCP servers and skills on the machine; here the agent project code and its configs are scanned |
| MCP Scanner | yes | 1,107 | the Cisco scanner checks MCP servers with three engines; here static analysis of agent code with data tracking and OWASP rules |
README in short
The README explains agent risks in production and shows installation and a first run in a few commands. Then come a sample report, a metrics snapshot on the author's own set, a table of finding categories, OpenClaw support, usage examples, baselines and a GitHub Action. It ends with a comparison against Bandit and Semgrep, the architecture and an OWASP coverage table.