AgentAuditKit
The missing npm audit for AI agents.
Static security scanner for MCP-connected AI agent pipelines. It finds misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust-boundary violations and tainted data flows across 10 agent platforms — and emits the compliance evidence an auditor asks for afterwards.
It runs fully offline. No account, no telemetry, no model in the loop.
Quick start
pip install agent-audit-kit
agent-audit-kit scan .
aak is installed as a shorthand for the same command.
As a pre-commit hook:
# .pre-commit-config.yaml
repos:
- repo: https://github.com/sattyamjjain/agent-audit-kit
rev: v0.6.4
hooks:
- id: agent-audit-kit
In CI:
# .github/workflows/agent-security.yml
- uses: sattyamjjain/agent-audit-kit@v0.6.4
with:
severity: medium
fail-on: high
upload-sarif: true
The action writes SARIF; upload it with github/codeql-action/upload-sarif
to land findings in the GitHub Security tab. Full
GitHub Action reference ·
CLI reference ·
pre-commit hook.
What it finds
348 rules across 14 security categories:| Category | Rules | What it detects |
|---|---|---|
| MCP Configuration | 67 | Missing auth, wildcard CORS, 0.0.0.0 binds, SSRF, OAuth 2.1 and RFC 9728 gaps |
| Supply Chain | 110 | Unpinned packages, typosquats, install scripts, and verified CVE version pins |
| Tool Poisoning | 30 | Invisible Unicode, prompt injection in tool and parameter descriptions, rug pulls |
| Secret Exposure | 18 | Provider keys, tokens in configs and env files, credentials in logs |
| Agent Config | 18 | Permission escalation, auto-approve, headless trust in CI |
| A2A Protocol | 13 | Missing mutual auth, unbounded delegation, transitive trust |
| Hook Injection | 17 | Hook RCE, exfiltration through lifecycle hooks |
| Taint Analysis | 14 | @tool parameters reaching shell, SQL, filesystem and network sinks |
| Transport Security | 15 | Cleartext transports, DNS rebinding, session and body-size limits |
| Legal Compliance | 19 | Copyleft licences, PII surface, and regional AI duties |
| Trust Boundaries | 17 | Project-scoped trust, untrusted workspace escalation |
| MCP Server Card | 4 | Static audit of SEP-1649 server cards |
| Composition | 3 | Risk that exists only between components, not in any one of them |
| Agentic Skills | 3 | OWASP Agentic Skills Top 10 surface in skill bundles |
Every finding carries severity, evidence, a file and line, and remediation. Full detail per rule is in the rule reference.
Why not a hosted scanner
- Offline and deterministic. Your code and secrets never leave the machine, and the same input always yields the same findings — measured at 20/20 identical runs, 0% variance. A scanner with an LLM in the loop cannot promise that, which is what makes CI diffs and audit re-runs stable here.
- Auditor-ready evidence, not just findings. SARIF plus PDF evidence packs mapped to 14 frameworks, a CycloneDX/SPDX SBOM, and an OpenVEX document that joins to it on purl.
- Pin and verify.
pinfingerprints a tool surface at approval;verifyre-checks it afterwards. That is the only thing that catches a server which behaves until it does not — see the Deadbugz case study.
Precision is measured rather than asserted: a hand-adjudicated benign-slice false-positive rate with a Wilson interval, and any offending rule filed as an issue.
What we measured
From the State of MCP Security 2026 report (how to cite):
- 2,303 distinct public MCP configs scanned.
- 52.1% (1,200) declare a remote server with **no authentication**.
- 0 serve RFC 9728 Protected-Resource-Metadata discovery.
- 100% (424/424) of inline-auth remote configs **hardcode a static credential**.
These regenerate from results.json and are asserted in CI, so they cannot
drift from the report.
Compliance evidence
PDF and text evidence packs mapped to 14 frameworks, including two already in force that most scanners do not carry: EU AI Act Article 50 (transparency, since 2026-08-02) and Colorado SB 26-189 ADMT (effective 2027-01-01).
agent-audit-kit report . --framework eu-ai-act --format pdf
agent-audit-kit sbom . --format cyclonedx -o sbom.cdx.json
agent-audit-kit vex . -o vex.openvex.json
Every control row cites a real clause, and a row the scanner cannot evidence says so instead of printing a tick. Full list of the 348 rules mapped to 14 frameworks: compliance reference.
OWASP Agentic Top 10 coverage
| ASI | Title | # rules |
|---|---|---|
| ASI01 | Goal Hijack | 14 |
| ASI02 | Tool Misuse | 48 |
| ASI03 | Memory Poisoning | 73 |
| ASI04 | Identity & Privilege Abuse | 74 |
| ASI05 | Cascading Failures | 56 |
| ASI06 | Unauthorized Capability Acquisition | 48 |
| ASI07 | Plan Injection | 9 |
| ASI08 | Agent Communication Poisoning | 5 |
| ASI09 | Resource Abuse | 18 |
| ASI10 | Supply-Chain | 21 |
Complete mapping for OWASP Agentic, OWASP MCP, and the NSA MCP CSI is in the standards crosswalk.
MCP Security Index
A public leaderboard of scanned public MCP servers, with per-server grade cards and a 90-day disclosure policy: sattyamjjain.github.io/agent-audit-kit.
Last published snapshot: **2026-09-07** (5 snapshots in [`history.json`](https://sattyamjjain.github.io/agent-audit-kit/data/history.json)). The build fails if this date falls more than 10 days behind, so a stalled index reports itself.CVE response
Newly disclosed MCP CVEs are triaged and turned into rules as they land, surfaced by an NVD watcher and logged in CHANGELOG.cves.md. The measured disclosure-to-rule latency is published in docs/cve-latency.md and regenerated from the ledger, not asserted.
Under the hood
103 scanner modules: AST-based taint analysis forPython, and regex dangerous-sink scanners for TypeScript/JavaScript and Rust.
2,373 tests. 27 CLI commands. Releases are Sigstore-signedand ship a deterministic rule bundle.
Mechanical fix recipes cover 11 of 348 rules
(3.2%), applied by agent-audit-kit fix. That is a scope
decision, not a coverage gap: a recipe ships only where the remediation is
deterministic and one-line — exactly one correct edit, confirmable from the
diff. Everything else stays advisory on purpose, because a fix that needs
judgement is a fix that can be wrong silently. Why the rest stay
advisory.
Documentation
Getting started · CLI reference · Rule reference · CI/CD · Comparison with other scanners · All documentation
Contributing
Issues and pull requests are welcome — see
CONTRIBUTING.md. Adding a rule means a rule definition, a
scanner, and fixtures in both directions; agent-audit-kit rule lint checks the
registry invariants.
Security
Report vulnerabilities per SECURITY.md. AgentAuditKit publishes no fixed CVE-response SLA; it publishes the measured latency instead.
License
Apache-2.0. See LICENSE. Apache-2.0 carries an explicit patent grant, which the organisations that adopt a security tool tend to ask about.
1 maintainer
Release files for agent-audit-kit 0.6.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| agent_audit_kit-0.6.4.tar.gz | 1.8 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agent_audit_kit-0.6.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.4 MB
Release files / agent_audit_kit-0.6.4.tar.gz
| Download URL | agent_audit_kit-0.6.4.tar.gz |
|---|---|
| Size | 1.8 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
cb6a0b255cd4ecdc39e0c8a9e69d2656ff1bc79fa3fce485793e3158bda855bc
|
|
BLAKE2b-256 checksum How to use checksums |
ba5c129fe675a867669d1b4a365097f3e9e4886ed8a4c974383017737123f5d5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 12, 2026.
Transparency logRelease files / agent_audit_kit-0.6.4-py3-none-any.whl
| Download URL | agent_audit_kit-0.6.4-py3-none-any.whl |
|---|---|
| Size | 675.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f6e27bdd0e93d994b96f56095d799ebcff0fcd247087101734508ff65810bd47
|
|
BLAKE2b-256 checksum How to use checksums |
3952c7fd0b6971250ebe1aef0d6677a2d7727185c7d2e7e7cb4259d9e0416d45
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 12, 2026.
Transparency log
