AgentSec Audit's maintainer claims its released static linter detects risky agent configurations and MCP tool declarations through CLI, MCP, and CI interfaces, enabling pre-deployment security gates without executing agents.

What is this?

Why it matters to Scott

Measured heat

How the heat travelled

Evidence (4) — ⭐ canonical anchor

# AgentSec Audit

> Automated security scanning, policy linting, and compliance certification for autonomous AI agents, tool configurations, and Model Context Protocol (MCP) servers.

Built for the **OWASP Top 10 for Agentic Applications (2026 ASI01–ASI10)** and **ISO 42001 / SOC 2 Type II** processing integrity audits.

---

## Features

- **Deterministic Static AST & Schema Linter:** Scans system prompts, function calling schemas, and MCP tool declarations.
- **OWASP ASI-10 Rule Enforcement:** Detects arbitrary shell/eval execution, goal hijacking vectors, unbounded delegation depth, and unsanitized memory write loops.
- **Native MCP Interface:** Exposes `audit_agent_config` over stdio JSON-RPC so Hermes Desktop, Claude Code, and Codex can audit agents natively.
- **Turnkey CI/CD:** Ready for GitHub Actions with automated PR pass/fail gating.

---

## Quickstart

### Installation

```
git clone https://github.com/hicklax13/agentsec-audit.git
cd agentsec-audit
pip install -r requirements.txt
```

### Run a Local Security Audit

```
python -m src.cli scan ./sample_agent.json --format html --out report.html
```

---

## GitHub Action Integration

Add this to your repository workflow:

```
name: AgentSec Compliance Check
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hicklax13/agentsec-audit@v1
        with:
          config-path: "agent.json"
          fail-on-violation: "true"
```

Interpretation history

• 2026-10-10T14:19:19Z
  New Arcade.dev blog post (hn.story.50032282) adds a third data point to the static agent-config auditing category but does not validate AgentSec Audit's detection coverage, false-positive rate, or adoption — it is more category corroboration, not tool validation. The case remains a cold, unvalidated solo project inside a hot topic band.
• 2026-10-10T13:39:44Z
  evidence attached: hn.story.50032282 — Arcade.dev blog post on prompt injection detection tools for enterprise agents directly relates to static security auditing of agent configurations
• 2026-09-24T22:22:28Z
  grounded: known/low — Already held: Scott's wikis carry both halves of this story — ip:framework.decision-authority-infrastructure and ip:source.compliance-cosplay argue that static
• 2026-09-24T22:15:50Z
  Guardmcp's independent scan of the official MCP registry makes static MCP config auditing a two-implementation practice rather than one maintainer's project, lifting the case from seed to watching — but it corroborates the technique category, not AgentSec Audit's detection claims, which remain unvalidated. Both submissions flatlined at bottom-quartile velocity, so the case parks as a low-signal instance inside a hot category.
• 2026-09-24T20:37:40Z
  evidence attached: hn.story.49833750 — A second independent static MCP config scanner, applied to the official registry, corroborates the emerging static MCP configuration-auditing episode carried by this case.
• 2026-09-20T06:25:53Z
  grounded: known/low — The claimed pre-deployment checks repeat Scott’s Evaluation-Driven Development position on binding release gates and his MCP Tool Belt ebook’s requirement for s
• 2026-09-20T06:22:12Z
  case created — An installable first-party artifact establishes a distinct tooling episode, but its advertised detection coverage and compliance claims remain unvalidated.

Decision trace

• 10-11 01:19repriceNew Arcade.dev blog post (hn.story.50032282) adds a third data point to the static agent-config auditing category but does not validate AgentSec Audit's detection coverage, false-positive rate, o
• 10-11 00:43attention_routeThe editor compared this story and chose to keep watching.
• 10-11 00:39attention_candidateattach
• 10-11 00:39attachArcade.dev blog post on prompt injection detection tools for enterprise agents directly relates to static security auditing of agent configurations
• 10-11 00:39propose_attachArcade.dev blog post on prompt injection detection tools for enterprise agents directly relates to static security auditing of agent configurations
• 09-25 08:22repriceGuardmcp's independent scan of the official MCP registry makes static MCP config auditing a two-implementation practice rather than one maintainer's project, lifting the case from seed to wa
• 09-25 08:22groundAlready held: Scott's wikis carry both halves of this story — ip:framework.decision-authority-infrastructure and ip:source.compliance-cosplay argue that static linting with ISO 42001/SOC 2 market
• 09-25 06:37attachA second independent static MCP config scanner, applied to the official registry, corroborates the emerging static MCP configuration-auditing episode carried by this case.
• 09-25 06:28propose_attachA second independent static MCP config scanner, applied to the official registry, corroborates the emerging static MCP configuration-auditing episode carried by this case.
• 09-20 23:40review_screenThe new comment raises a general concern about MCP tool declaration drift but provides no new implementation result, credible contradiction, release, access change, or first-hand evidence about AgentS
• 09-20 16:25groundThe claimed pre-deployment checks repeat Scott’s Evaluation-Driven Development position on binding release gates and his MCP Tool Belt ebook’s requirement for security controls around tool access; sta
• 09-20 16:22createAn installable first-party artifact establishes a distinct tooling episode, but its advertised detection coverage and compliance claims remain unvalidated.