AgentSeal CLI
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
- 383 ★ on the repository
- Last commit
Extended access
Why this level
- The guard command reads the configs of every assistant on the machine, and they can hold tokens and data paths
- The shield command runs in the background and moves files into quarantine
- For scan the system prompt goes to the chosen model, cloud or local
Install
- Works in
Manual install
pip install agentsealOr `npm install agentseal`. Then `agentseal guard` checks the machine with no API key.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The guard command reads the configs of every assistant on the machine, and they can hold tokens and data paths
- The shield command runs in the background and moves files into quarantine
- For scan the system prompt goes to the chosen model, cloud or local
This is third-party code. Review the repository files before installing.
What it does
AgentSeal is a set of commands for AI agent security that installs through pip or npm. Four commands cover different jobs. `agentseal guard` walks the assistant configs on your machine, 28 of them in the list, among them Claude Code, Cursor, Windsurf, Codex CLI, Gemini CLI, Cline, Goose and OpenCode. It checks skill files and MCP settings through a six-stage pipeline: signatures, deobfuscation (Unicode tags, Base64, bidirectional overrides, zero-width characters), semantic comparison through embeddings, SHA-256 change tracking, enrichment from the MCP registry and your own YAML rules. Guard needs no API key. `agentseal scan` runs a system prompt through 225 adversarial probes: 82 extraction techniques, 143 injection techniques and 8 mutations. The result is scored deterministically by a canary string in the response, with no model as judge, and reduced to a trust score from 0 to 100. `agentseal scan-mcp` connects to a live MCP server over stdio or SSE and checks its tool descriptions for poisoning. `agentseal shield` watches agent config files, shows notifications and quarantines files with a detected payload.
Who it is for. For developers and security specialists who install many skills and MCP servers in Claude Code and Cursor and want to check them, and their own system prompts, before they do harm.
Good fit when
- You installed a dozen skills and MCP servers from different sources and want to know whether any is dangerous
- Before connecting an unfamiliar MCP server you want its tool descriptions checked for hidden instructions
- You need to confirm your agent's system prompt does not leak itself and resists instruction injection
- CI needs a gate: the build fails if the prompt's trust score is below a set threshold
- After `npm install` or `pip install` you want to notice that someone quietly changed agent configs
Not a fit when
- You need a full guarantee of security: the score shows known techniques but does not prove an absence of vulnerabilities
- You want to scan your application's code for vulnerabilities: AgentSeal looks at agent configs, prompts and MCP descriptions
- No model is available but you need `scan`: checking a prompt requires a model, local through Ollama or cloud with a key
- You need extra probes for RAG, multimodal attacks and PDF reports: those belong to the paid Pro tier
Example request
Run agentseal guard and show which of my skills and MCP servers are flagged as dangerous, with severity and the file where it was found.Limitations
Python 3.10 or newer, or Node.js 18 or newer, is required. The `guard`, `shield` and `scan-mcp` commands run without an API key, while `scan` needs a model: free and local through Ollama, or cloud OpenAI, Anthropic, MiniMax or any HTTP endpoint. Shield needs extra dependencies from `pip install agentseal[shield]`.
The README calls guard local with no network calls, yet one of its stages pulls server trust scores from the MCP Security Registry, so check network activity before running it in a closed environment. The semantic stage uses the MiniLM-L6-v2 embedding model.
The project is released under the FSL-1.1-Apache-2.0 license, which GitHub does not detect. Extended features are sold in the Pro tier. Shield moves detected files to quarantine, so after a hit check that your real config has not disappeared. Availability of model services and the registry from Russia was not checked when this card was prepared.
How to disable. Stop `agentseal shield` if it runs in the background and remove the package with `pip uninstall agentseal` or `npm uninstall agentseal`. Delete the `.agentseal.yaml` file in the project by hand, and review the files shield quarantined and either restore or delete them.
FAQ
How do I install AgentSeal and check my skills?
Run `pip install agentseal` or `npm install agentseal`, then `agentseal guard`. No API key is needed: the command finds skill files and MCP configs for every installed assistant and returns a report with severities.
How do I check an MCP server for poisoned tool descriptions?
Use `agentseal scan-mcp --server npx @modelcontextprotocol/server-filesystem /tmp` for a stdio server or `agentseal scan-mcp --sse http://localhost:3001/sse` for SSE. AgentSeal lists the tools and checks descriptions with patterns, deobfuscation and semantic similarity.
How do I test a system prompt against attacks?
Run `agentseal scan --prompt "..." --model ollama/llama3.1:8b` or point to a file with `--file`. The tool runs 225 probes and prints a trust score from 0 to 100. For CI there is `--min-score 75`: below that score the exit code is 1.
How does AgentSeal differ from Snyk Agent Scan?
Both look for dangerous skills and MCP servers on the machine. In its own comparison table the author lists 225 prompt probes for AgentSeal against 20 attack goals for Snyk. AgentSeal separately offers config watching through the shield command and SARIF output for the GitHub security tab.
Do I have to pay for AgentSeal?
The base commands are open and free, cloud models for `scan` are paid to their providers and local Ollama is free. The paid Pro tier adds probes for RAG, multimodal attacks, an agent behavior map and PDF reports.
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| AgentSeal (this card) | no | 383 | |
| Snyk Agent Scan | no | 3,208 | Snyk's scanner for MCP servers, skills and agents found on the machine |
| MCP Scanner | yes | 1,107 | Cisco AI Defense's scanner for MCP servers and their tools |
| SkillSpector | no | 24,472 | NVIDIA's scanner for skills and MCP servers before installation |
README in short
The README starts with a quick start and a table of four commands, then breaks down guard, scan, scan-mcp and shield in detail. It shows attack surface and detection pipeline diagrams, Python and TypeScript APIs, the list of model providers and the MCP registry. It ends with requirements, the Pro tier and a comparison with other scanners.