Execution boundary
Tool authorization, tenant isolation, human approval, sandboxing and network egress — not prompt guardrails alone.
Agent Security Infrastructure Tool
AI Agent Security Auditor: Config & Code Risk Scanner
Paste or import Agent/MCP configuration and code for a browser-only static scan of shell execution, secrets, remote MCP, egress, permissions, retention, logging and execution limits; then verify runtime and governance controls that static analysis cannot prove.
Browser-only scanNo loginConfig is not uploadedEvidence linesGovernance verificationMarkdown / JSON
Tool
Methodology
What the score actually checks
Data boundary
Model APIs, remote MCP, memory, vector stores, files, traces, audit records and third-party SaaS belong in one retention map.
Incident boundary
Production systems need anomaly monitoring, credential revocation, tool/MCP disable controls and minimum-necessary audit evidence.
The static scanner is rule-based and only analyzes text supplied in the current browser; common secret patterns are redacted in displayed evidence. Governance verification covers execution-time authorization, tenant boundaries, third-party retention, monitoring and incident response that a snippet cannot prove. The method follows XBSTACK's Agent Security Infrastructure framework and is informed by NIST, OWASP Agentic Top 10 and the MCP specification; it is not a certification standard.
FAQ
Frequently asked questions
Does Agent Security Auditor upload my configuration, code, or answers?
No. Configuration/code scanning, evidence extraction, scoring, Markdown generation, and JSON export run in the current browser. XBSTACK does not receive the Agent/MCP configuration or governance answers you paste or import.
Can this tool certify that an AI agent is secure or compliant?
No. It is an engineering risk screen and production-readiness checklist, not a security certification, legal opinion, GDPR/HIPAA attestation, threat model, code audit or penetration test.
Why is Tool Authorization weighted heavily?
Because tool visibility is not authorization. A production system should re-check identity, tenant, resource, scope and parameters after the model proposes a tool call and before the real executor performs the action.
Why do MCP and logs still matter when OpenAI ZDR is enabled?
ZDR controls eligible OpenAI API retention behavior. Remote MCP servers, third-party SaaS, application memory, vector stores, files, traces and audit logs remain separate retention boundaries.
Can MCP Roots replace an operating-system sandbox?
No. Roots are protocol-level capability and boundary signals. They do not replace process, filesystem, network, credential and host isolation for code or shell execution.
Does a high score mean an agent can be shipped automatically?
No. Redlines override the score. Missing execution-time authorization, missing tenant isolation, direct host-sensitive code execution, irreversible actions without authorization/approval, or sensitive egress to third parties with unknown retention can force NOT PRODUCTION READY.
