AgentAuditKit

The missing npm audit for AI agents.

Security scanner for MCP-connected AI agent pipelines. Finds misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust boundary violations, and tainted data flows across 13 agent platforms.

• 190 rules across 11 security categories, covering the 2026 CVE wave
• 57 scanner modules including AST-based Python taint analysis and regex pattern scanners for TypeScript/JavaScript and Rust
• 16 CLI commands: scan, discover, pin, verify, fix, score, update, proxy, kill, watch, plus export-rules, verify-bundle, sbom, report, install-precommit, and the Security-Advisories scan flag
• OWASP coverage: Agentic Top 10 (10/10), MCP Top 10 (10/10), Adversa AI Top 25
• Compliance mapping (11 frameworks): EU AI Act Art. 15 + 55, SOC 2, ISO 27001, ISO/IEC 42001, HIPAA, NIST AI RMF, Singapore Agentic AI, India DPDP 2023, Alabama Personal Data Protection Act (HB 351, 2026), Tennessee SB 1580 Health Care AI (PRA) — PDF reports via agent-audit-kit report --format pdf --framework <name>
• Supply chain: deterministic rule bundle (export-rules), Sigstore-signed releases, CycloneDX + SPDX SBOM (sbom)
• MCP Security Index: weekly public leaderboard at sattyamjjain.github.io/agent-audit-kit — per-server grade cards (A–F), 90-day disclosure policy
• AAK Response SLA: rule coverage within 48 hours of any disclosed MCP CVE — ledger in CHANGELOG.cves.md
• Zero cloud dependencies — runs fully offline, zero network calls in the default scan path

Why This Exists

In early 2026, 30 MCP CVEs dropped in 60 days. CVE-2026-33032 (Nginx-UI MCP auth bypass, CVSS 9.8) exposed a shared-handler pattern that several other servers have. CVE-2025-59536 turned a project-local Claude Code hook into RCE. CVE-2026-34070 hit LangChain's load_prompt() with absolute-path and .. traversal. CVE-2026-21852 demonstrated source-code exfiltration via a single Claude Code config flag. A 2,614-server survey found 82% of public MCP servers had path-traversal issues. Meanwhile, every AI coding assistant adopted MCP with sparse security tooling.

AgentAuditKit is the deterministic, auditor-ready OSS scanner that closes the gap.

Quick Start

GitHub Action (Recommended)

# .github/workflows/agent-security.yml
name: Agent Security Scan
on: [push, pull_request]

permissions:
  security-events: write
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sattyamjjain/[email protected]
        with:
          fail-on: high

Findings appear as inline PR annotations in the GitHub Security tab via SARIF.

CLI

pip install agent-audit-kit
agent-audit-kit scan .

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/sattyamjjain/agent-audit-kit
    rev: v0.3.10
    hooks:
      - id: agent-audit-kit

Try It Now

Scan a deliberately vulnerable config to see AgentAuditKit in action:

git clone https://github.com/sattyamjjain/agent-audit-kit
cd agent-audit-kit
pip install -e .
agent-audit-kit scan examples/vulnerable-configs/04-hook-exfiltration/

11 vulnerability examples covering all security categories in the examples/ directory. See also the damn-vulnerable-MCP-server case study.

What It Scans

190 rules total. Every finding includes severity, evidence, remediation, OWASP references, Adversa references, and CVE links where applicable.

Agent Platforms Scanned

Claude Code, Cursor, VS Code Copilot, Windsurf, Amazon Q, Gemini CLI, Goose, Continue, Roo Code, Kiro + user-level global configs.

Language Support

Note: Phase 2 scanners (ssrf_patterns, oauth_misconfig, mcp_auth_patterns, hook_rce, skill_poisoning, mcp_tasks) are regex-based; a tree-sitter AST migration is tracked in issue #22.

CLI Reference

Commands

Scan Flags

Exit Codes

Configuration

Create .agent-audit-kit.yml in your project root:

severity: medium
fail-on: high
ignore-paths:
  - vendor/
  - third_party/
exclude-rules:
  - AAK-MCP-007    # We intentionally don't pin npx versions
include-user-config: false

CLI flags always take precedence over config file values.

GitHub Action Reference

Inputs

Outputs

SARIF Integration

With upload-sarif: true (default), findings appear:

• As inline annotations on PR diffs showing exactly which line has the issue
• In the Security tab under Code Scanning with full remediation guidance
• With OWASP references and CVE links for each finding

SARIF output conforms to SARIF 2.1.0 with fingerprints, partialFingerprints, fixes[], security-severity scores, and %SRCROOT% relative paths.

Security Scoring

agent-audit-kit score .
# Security Score: 85/100  Grade: B

Generate an SVG badge for your README: agent-audit-kit score . --badge

Frameworks & Standards

| Adversa AI MCP Security Top 25 | Fully mapped |
| EU AI Act | --compliance eu-ai-act |
| SOC 2 Type II | --compliance soc2 |
| ISO 27001:2022 | --compliance iso27001 |
| HIPAA Security Rule | --compliance hipaa |
| NIST AI RMF 1.0 | --compliance nist-ai-rmf |

Tool Pinning & Rug Pull Detection

MCP servers can silently change tool definitions after you approve them. AgentAuditKit detects this:

# Create initial pins (commit tool-pins.json to git)
agent-audit-kit pin .

# In CI, verify nothing changed
agent-audit-kit verify .

Detects: tool definitions changed (AAK-RUGPULL-001), new tools added (AAK-RUGPULL-002), tools removed (AAK-RUGPULL-003).

Comparison

See docs/comparisons.md for a fully-sourced version. Verifiable claims only.

Microsoft AGT is an ally, not a competitor. It governs agents at
runtime; agent-audit-kit audits them at CI time and produces the PDF an
auditor needs. Use both — the overlap is small, the reinforcement is
high. See docs/comparisons.md for the full
positioning write-up.

VS Code Extension

A VS Code/Cursor extension is available in vscode-extension/:

cd vscode-extension && npm install && npm run compile

Provides inline diagnostics on file save with quick-fix suggestions.

MCP Security Index

Public leaderboard of MCP servers we scan weekly:
sattyamjjain.github.io/agent-audit-kit

• Per-server grade cards (A–F)
• Weekly snapshots in data/history.json
• 90-day coordinated disclosure before anything lands on a public card — see docs/disclosure-policy.md
• Maintainer-fix earlier gets published the day the fix lands, with credit

AAK Response SLA

We publicly commit to shipping rule coverage within 48 hours of any disclosed MCP CVE. The ledger is CHANGELOG.cves.md and a GitHub Action watches NVD's MCP keyword feed every 6 hours.

Supply chain

Every v* release publishes:

• Wheel + sdist on PyPI via OIDC Trusted Publisher
• Docker image on GHCR (ghcr.io/sattyamjjain/agent-audit-kit:<tag>) with SLSA provenance attestation
• Sigstore keyless-signed rule bundle (rules.json + rules.json.sha256)
• CycloneDX + SPDX SBOM (sbom.cdx.json, sbom.spdx.json)

Verify a bundle:

agent-audit-kit verify-bundle rules.json --signature rules.json.sigstore

Contributing

git clone https://github.com/sattyamjjain/agent-audit-kit
cd agent-audit-kit
pip install -e ".[dev]"
pytest -v                          # 504 tests
ruff check .                       # Lint
mypy agent_audit_kit/              # Type check (52 source files, 0 errors)
agent-audit-kit scan .             # Self-scan

See CONTRIBUTING.md for the full development guide.

Security

Report vulnerabilities via GitHub Security Advisories or see SECURITY.md.

License

MIT