AgentGuard Scanner

Open-source security scanner for AI agent configurations and deployments. Runs 100% locally with zero network calls for config/paste scanning.

Installation

pip install agentguard-scanner

Quick Start

Python API

import asyncio
from agentguard_scanner import VulnerabilityScanner, ScanRequest, ScanInputType

async def scan_config():
    scanner = VulnerabilityScanner()
    request = ScanRequest(
        paste_content=open("CLAUDE.md").read(),
        scan_input_type=ScanInputType.PASTE_MD,
    )
    result = await scanner.scan(request)
    for finding in result.findings:
        print(f"[{finding.severity.value}] {finding.title}")

asyncio.run(scan_config())

Scan a live agent URL

import asyncio
from agentguard_scanner import VulnerabilityScanner, ScanRequest

async def scan_url():
    scanner = VulnerabilityScanner()
    request = ScanRequest(target_url="https://my-agent.example.com")
    result = await scanner.scan(request)
    print(f"Risk score: {result.risk_score}/10")
    print(f"Findings: {result.findings_count}")

asyncio.run(scan_url())

What It Scans

URL-based scanning (connects to your agent only)

• Authentication — JWT none algorithm, expired tokens, signature bypass, algorithm confusion, session fixation, IDOR, privilege escalation
• Prompt Injection — Direct injection, indirect injection, goal hijacking, system prompt leakage (canary-based detection)
• SSRF — Localhost access, private network, cloud metadata endpoints, webhook SSRF
• MCP Security — Unauthenticated tool execution, config exposure, dangerous tools
• Tool Execution — Command injection, path traversal, arbitrary code execution, shell access
• Config Security — Exposed config files, environment variables, secret leakage, debug mode, git exposure

Paste/file scanning (zero network calls)

• Agent Configs (CLAUDE.md, .cursorrules, system prompts) — Overly permissive instructions, missing safety boundaries, privilege escalation, data exfiltration vectors, jailbreak susceptibility
• Tool Definitions (MCP configs, function schemas) — Dangerous tools, unconstrained inputs, SSRF vectors, command injection risk, missing auth
• Generic Content — Secret detection (12+ patterns), prompt injection indicators, config exposure, PII detection

Output Formats

from agentguard_scanner.formatters import format_json, format_sarif, format_table

# Human-readable table
print(format_table(result))

# Machine-readable JSON
print(format_json(result))

# SARIF 2.1.0 (GitHub Code Scanning, VS Code)
print(format_sarif(result))

License

Apache-2.0 — audit the code, use it anywhere, contribute back.