agent-audit

> Security scanner for AI agents. Find vulnerabilities in your agent setup in 30 seconds.

npx agent-audit

| Category | What it finds | |----------|--------------| | Credentials | Shared API keys across agents, hardcoded secrets in code | | Identity | Missing agent identity layer, no cryptographic verification | | MCP | MCP servers without authentication, unprotected tool endpoints | | Permissions | Overly broad agent permissions, admin/root access | | Delegation | Missing delegation chains, agents inheriting full user permissions | | Audit | No audit logging for agent actions | | Approvals | No human-in-the-loop for sensitive operations | | Resilience | Missing timeouts, no error handling on tool calls |

  Agent Security Audit
  by Authora -- https://authora.dev

  Scanning current directory...

  Scanned 47 files
  Found 3 agent(s), 2 MCP server(s)

  CRITICAL  Shared API key may be used by 3 agent files (.env)
  CRITICAL  No agent identity layer detected
  CRITICAL  2 MCP server(s) found but no agent identity
  WARNING   MCP server detected without visible auth configuration (mcp/server.ts)
  WARNING   No delegation chains -- agents may inherit unlimited permissions
  WARNING   No audit logging for agent actions detected
  INFO      No approval workflows for sensitive agent actions

  Security Posture:
    Identity layer:     No
    Delegation chains:  No
    Audit logging:      No
    Approval workflows: No

  Agent Security Score: 1.5/10  [===                     ]  Grade: F
  3 critical, 3 warnings

  Learn more: https://github.com/authora-dev/awesome-agent-security
  Fix issues: https://authora.dev/get-started

npx agent-audit [directory]     # Scan a specific directory
npx agent-audit --json          # Output as JSON
npx agent-audit --badge         # Generate README badge markdown

Add a security badge to your README: