q-uestionable-ai 0.3.3

Offensive security platform for agentic AI infrastructure

{q-AI}

Offensive security platform for agentic AI infrastructure.

• Audit MCP servers
• Intercept agent traffic
• Test tool poisoning and prompt injection
• Execute multi-step attack chains
• Generate IPI payloads
• Poison coding assistant context files
• Measure RAG retrieval rank.

Local web UI orchestrates multi-module workflows. All findings stored in a SQLite database.

Research program by Richard Spicer · {q-AI}

---

Framework Coverage

All audit findings map to four security taxonomies:

Framework	Coverage
OWASP MCP Top 10	All 10 categories
OWASP Agentic Top 10	All 10 categories
MITRE ATLAS	Technique-level mapping per finding category
CWE	Weakness-level mapping per finding category

---

Install

pip install q-uestionable-ai

Or from source:

git clone https://github.com/q-uestionable-AI/qai.git
cd qai
uv sync --group dev

---

Full documentation at docs.q-uestionable.ai

---

Legal

All tools are intended for authorized security testing only. Only test systems you own, control, or have explicit permission to test. Responsible disclosure for all vulnerabilities discovered.

License

Apache 2.0

AI Disclosure

This project uses a human-led, AI-augmented workflow. See AI-STATEMENT.md