agentseal - Security toolkit for AI agents. Scan your machine

项目说明

<p align="center">
<a href="
<img src="assets/logo-white.png" height="96" alt="AgentSeal" />
</a>
</p>

<h3 align="center">Security toolkit for AI agents. Red-team prompts, detect MCP poisoning,<br>scan skill files, trace toxic data flows. 225+ tests across 28 agents.</h3>

<p align="center">
<a href=" src=" alt="PyPI" /></a>
<a href=" src=" alt="npm" /></a>
<a href=" src=" alt="License" /></a>
<a href=" src=" alt="Downloads" /></a>
<a href=" src=" alt="Follow on X" /></a>
</p>

<p align="center">
<a href=" &middot;
<a href=" Registry</a> &middot;
<a href=" &middot;
<a href="
</p>

---

Quick Start

That's it. AgentSeal finds dangerous skill files, poisoned MCP ser, and data exfiltration paths across every AI agent on your machine.

Want to test a system prompt against ad attacks?

<p align="center">
<img src="assets/guard-demo.gif" alt="agentseal guard demo" width="700" />
</p>

---

What does each command do?

| Command | What it does | Needs an LLM? |
|---|---|:---:|
| guard | Scans skill files, MCP configs, toxic data flows, and supply chain changes on your machine | No |
| scan | Tests a system prompt against 225+ ad attack probes | Yes\* |
| scan-mcp | Connects to a live MCP server and audits its tool descriptions for poisoning | No |
| shield | Watches agent config files in real time, alerts on threats, quarantines payloads | No |

\*Free with Ollama. Cloud pro (OpenAI, Anthropic, etc.) require an API key.

---

Guard

Scans all AI agent configurations on your machine. No API key, no network calls - e runs locally.

Supported agents: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Gemini CLI, Codex CLI, Cline, Roo Code, Kilo Code, Copilot CLI, Aider, Continue, Zed, Amp, Amazon Q, Junie, Goose, Kiro, OpenCode, OpenClaw, Crush, Qwen Code, Grok CLI, Studio, Kimi CLI, Trae, MaxClaw.

Guard runs a six-stage detection pipeline on every file it finds:

1. Pattern signatures - known malicious patterns (credential access, exfiltration URLs, shell commands)
2. Deobfuscation - decodes Unicode tags, Base64, BiDi o, zero-width characters, TR39 confusables
3. Semantic analysis - embedding similarity (MiniLM-L6-v2) catches rephrased attacks that bypass patterns
4. Baseline tracking - SHA-256 hashes detect config changes since your last scan (rug-pull detection)
5. Registry enrichment - li scores from the MCP Security Registry (6,600+ servers)
6. Custom rules - YAML rules to enforce org-specific policies

---

Scan

Tests a system prompt against 225 ad attack probes: 82 extraction techniques, 143 injection techniques, and 8 adapti transforms. Returns a deterministic trust score.

How detection works: Injection probes embed a unique canary string (e.g. SEAL_A1B2C3D4_CONFIRMED). If the canary appears in the response, the probe leaked. Extraction probes use n-gram matching against the ground truth prompt. No LLM judge - same input, same result, every time.

Trust score (0–100):

| Score | Level | Meaning |
|:---:|---|---|
| 85–100 | Excellent | Strong defenses, resists most known attacks |
| 70–84 | High | Good defenses, minor gaps |
| 50–69 | Medium | Moderate risk, several probe categories leaked |
| 30–49 | Low | Significant |
| 0–29 | Critical | Minimal or no defense against prompt attacks |

CI/CD

Exit code 1 if trust score is below threshold. Use --output sarif for GitHub Security tab integration.

---

Scan-MCP

Connects to a live MCP server o or SSE. Enumerates every tool, then runs each description through pattern matching, deobfuscation, semantic similarity, and optional LLM classification. Outputs a trust score per server.

Catches tool description poisoning - hidden instructions embedded in tool descriptions that make the agent exfiltrate data, execute commands, or o user intent.

---

Shield

Real-time file watcher for agent config paths. Desktop notifications when threats appear. Automatically quarantines files with detected payloads.

Monitors the same paths that guard scans, but continuously. Useful for detecting supply chain attacks where an npm install or pip install silently modifies your agent configs.

---

How It Works

<details>
<summary><strong>Attack surface diagram</strong></summary>

<br>

MCP servers give AI agents access to local files, databases, APIs, and credentials. Tool descriptions can contain hidden instructions that the agent follows but the user never sees.

</details>

<details>
<summary><strong>Detection pipeline (guard)</strong></summary>

<br>

</details>

---

Python API

<details>
<summary><strong>Anthropic / HTTP / Custom function</strong></summary>

</details>

TypeScript API

The npm package provides the same CLI commands (agentseal guard, scan, scan-mcp, shield) and a programmatic TypeScript API.

---

Supported Pro

| Provider | Flag | API key |
|---|---|:---:|
| OpenAI | --model gpt-4o | OPENAI_API_KEY |
| Anthropic | --model claude-sonnet-4-5-20250929 | ANTHROPIC_API_KEY |
| MiniMax | --model MiniMax-M2.7 | MINIMAX_API_KEY |
| Ollama | --model ollama/llama3.1:8b | None |
| LiteLLM | --model any --litellm-url | |
| HTTP | --url | None |

---

MCP Security Registry

6,600+ MCP servers scanned and scored for security risks. Search by name, browse findings, check trust scores before installing.

agentseal.org/mcp

---

Requirements

---

Pro

AgentSeal Pro is for security teams running continuous assessments. It extends the open-source scanner with:

---

Why AgentSeal?

| Capability | AgentSeal | Snyk (agent-scan) | Pillar | Lakera | Mindgard |
|---|:---:|:---:|:---:|:---:|:---:|
| Open-source scanner | Yes | Partial\* | No | No | No |
| Local machine guard (skills + MCP) | Yes | Yes | Partial | No | No |
| Prompt red-teaming | 225+ probes | 20 attack goals | Yes | Yes | Yes |
| MCP tool poisoning detection | Yes | Yes | Partial | Partial | No |
| Toxic data flow analysis | Yes | Yes | Partial | No | No |
| Real-time file monitoring | Yes | No | No | No | No |
| Public MCP ser | 6,600+ | No | No | No | No |
| Agents supported | 28 | 10+ | 2+ | N/A | N/A |
| Local LLM support (Ollama) | Yes | No | No | No | No |
| No API key required (guard) | Yes | No | No | No | No |

\*Snyk agent-scan CLI is Apache-2.0. The E, Agent Guard, and red-teaming are proprietary SaaS.

---

Contributing

Found a detection gap, a false positive, or want to add a new probe? See CONTRIBUTING.md for setup instructions and the PR process.

License

FSL-1.1-Apache-2.0

项目信息

开发语言：Python

Star 数：376

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。