Praxen plugin
An AI agent behavior verifier plugin: it compares declared authority with code and settings and reports the gaps.
- 64 ★ on the repository
- Last commit
- Apache-2.0
Minimal access
Why this level
- The plugin reads the agent's workspace, including configuration and possible secrets, and writes reports only to `./reports/`.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/praxenDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The plugin reads the agent's workspace, including configuration and possible secrets, and writes reports only to `./reports/`.
This is third-party code. Review the repository files before installing.
What it does
Praxen verifies that an agent does its job and only its job. First you describe the agent's task in a Worker Remit document: mission, authorized tools, approved channels, counterparties and forbidden actions. You can write it by hand or ask Praxen to draft it. Then you point it at evidence: source code, deployment state, behavioral logs or governance documents. The plugin reads the agent's workspace in place without modifying it and writes reports to `./reports/` as HTML, JSON and a text summary. It looks for divergence between policy and implementation, secret exposure, configuration gaps such as auto-approved commands, capability drift and chains of findings that together form a dangerous attack path. Findings are mapped to the OWASP Top 10 for LLM applications and for agentic systems of 2026 and to the RAISE maturity score.
Who it is for. Security teams and developers who ship AI agents and want to check before release that agents do only what is permitted.
Good fit when
- Before an agent's release the code must be reconciled with the description of its authority.
- A project is suspected of exposed secrets and dangerous settings such as auto-approved command execution.
- A new version added tools and outbound destinations missing from the approved baseline.
- Third-party plugins and unpinned dependencies are connected and need supply-chain assessment.
- An audit needs a report in HTML and JSON tied to OWASP.
Not a fit when
- You need monitoring of an already running agent: Praxen verifies before deployment and at each release.
- The agent runs on a weak model: the check relies on a Sonnet-class model or higher.
- You expect an automatic pass or fail: the report is meant as a senior reviewer's notes.
Example request
Run a Praxen behavior analysis on ./my-agent: find the Worker Remit or ask me and prepare the report.Limitations
A coding agent with good instruction following (tested on Claude Code and OpenAI Codex) and Python 3.9 or newer for report rendering are required. Praxen runs on a frontier model: Sonnet-class or higher in Claude Code and a comparable tier in Codex, and on small models the cross-referencing succeeds poorly. RAISE maturity scores and results between runs can differ. Verification happens before deployment, and runtime monitoring is outside the project. Examples in `examples/` hold finished reports, not scan targets.
How to disable. Run `claude plugin uninstall praxen@open-agent-ai-security` in Claude Code or the equivalent Codex command. The `./reports/` directory with reports stays and is deleted by hand.
FAQ
How do I install Praxen in Claude Code?
Two commands: `claude plugin marketplace add open-agent-ai-security/plugins` and `claude plugin install praxen@open-agent-ai-security`. For OpenAI Codex it is similar: `codex plugin marketplace add open-agent-ai-security/plugins` and `codex plugin add praxen@open-agent-ai-security`.
What is a Worker Remit?
A Markdown document describing an agent's job: mission, authorized tools, approved channels, counterparties and forbidden actions. Praxen checks code and behavior against it, and a template sits in `WORKER_REMIT_template.md`.
Does Praxen change the agent's code?
No. The plugin reads the agent's workspace in place and writes findings only to `./reports/`. Nothing is sent outside.
What does the report look like?
A self-contained HTML file, machine-readable JSON and a text summary. Each finding answers whether observed behavior matches declared intent and is tagged by OWASP and RAISE.
Does Praxen work with other agents?
Yes. Without a marketplace it is enough to point any agent at the repository. An agent with tool use and multi-step instruction following fits, but the project is validated on Claude Code and Codex.
Discussion
No questions or reviews yet.
Related
PluginsA plugin that checks the commands, URLs and file writes an AI agent attempts and blocks the dangerous ones before they run
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
Prowler plugin for Claude Code
Prowler for Claude Code
A plugin that takes a cloud account toward CIS, PCI-DSS and other frameworks: reads Prowler Cloud reports, fixes failures and proposes a rescan
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
README in short
The name comes from the Greek praxis, turning theory into practice: the project compares an agent's declared intent with its observed behavior. The project sponsor, Exabeam, contributed the initial code and continues to support it.