agent-audit MCP Server
HeadyZhang/agent-audit
[](https://agentrank-ai.com/tool/HeadyZhang--agent-audit/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge) Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.
claude mcp add agentrank -- npx -y agentrank-mcp-server Overview
HeadyZhang/agent-audit is a Python tool licensed under MIT. Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen. Topics: ai-agent, cli, mcp, owasp, python, security, static-analysis, vulnerability-scanner, ai-security, ai-security-tool, crewai, langchain, llm-security, llm-safety, taint-analysis, vulnerability-detection, prompt-injection, langchain-security-.
Ranked #4096 out of 24846 indexed tools.
Has 15 contributors.
Ecosystem
Score Breakdown
237 stars → growing community
Last commit 1mo ago → moderate activity
4/10 issues closed → many open issues
15 contributors → active community
No dependents → no downstream usage
996 weekly installs → early adoption
Weights: Freshness 20% · Issue Health 20% · Dependents 22% · Stars 10% · Contributors 8% · How we score →
How to Improve
Badge all embed codes →
[](https://agentrank-ai.com/tool/HeadyZhang--agent-audit/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge) <a href="https://agentrank-ai.com/tool/HeadyZhang--agent-audit/?utm_source=badge&utm_medium=readme&utm_campaign=agentrank_badge"><img src="https://agentrank-ai.com/api/v1/badge/HeadyZhang--agent-audit" alt="AgentRank"></a> Matched Queries
From the README
# [Agent Audit](https://headyzhang.github.io/agent-audit/) **Find security vulnerabilities in your AI agent code before they reach production.** --- ## Why Agent Security Fails in Production AI agents are not just chatbots. They execute code, call tools, and touch real systems, so one unsafe input path can become a production incident. - Prompt injection rewrites agent intent through user-controlled context - Unsafe tool inputs can reach `subprocess`/`eval` and become command execution - MCP configuration mistakes can leak credentials and expand access unintentionally If your team ships agent features, owns CI security gates, or operates MCP servers and tool integrations, this is a high-probability risk surface rather than an edge case. You likely need this before every merge if agent code can trigger tools, commands, or external systems. **Agent Audit** catches these issues before deployment with an analysis core designed for agent workflows today: tool-boundary taint tracking,Read full README on GitHub →
Get the weekly AgentRank digest
Top movers, new tools, ecosystem insights — straight to your inbox.