Security for AI agents, from first commit to production.
Find leaked keys, risky tools, MCP access and prompt-injection holes in your agents. See the exact line, get the fix, and re-check until it passes — in your editor, your pull requests, or the dashboard.
No sign-up needed for your first scan · Your raw code is never stored
Try asking
Answers come from Agent Verify's checks, docs and the MCP safety directory — and, once you sign in, your own scan results.
Works with the tools your team already uses
GitHub
GitLab
Bitbucket
VS Code
Claude Code
Cursor
Slack
OpenAI
LangChainFree live scan · no account needed
Try a real scan in 10 seconds.
Try an example
Untrusted text can redirect a tool-connected agent into unsafe actions.
One free public scan per browser per hour. Don't paste real production keys — any detected secret is redacted, but rotate it anyway.
124
security checks, every one tested
11
agent frameworks with dedicated checks
19
kinds of secrets caught (and redacted)
3
compliance standards mapped: OWASP, NIST, SOC 2
Built for developers: verify agents before every deploy
Scan GitHub repos, MCP configs, and LangChain, CrewAI, AutoGen, OpenAI Agents and Claude Agent SDK projects — from the dashboard, the CLI, or a GitHub Action that blocks risky merges.
npx agentverify scan ./agents --ciFor developers →Trust signals
Built around recognized AI security frameworks.
OWASP LLM Top 10
Compliance mapping
NIST AI RMF
Risk management alignment
SOC 2
Control mapping
Patent-Pending A2SPA Protocol
Execution authorization guidance
Why it matters
AI agents often run with real authority.
Agent Verify helps you catch hardcoded credentials, broad tool access, missing approval gates, and weak execution controls before an agent reaches production. Each report turns findings into clear next steps.
Why Agent Verify?
A different question than the tools you already have.
A legitimate credential, valid API access, and an approved tool can still combine into an action an agent should never be able to take. Existing categories of security tools don't ask that question — Agent Verify does.
Traditional code security
"Is the software vulnerable?"
Identity / IAM
"Who is this, and what can it access?"
Agent Verify
"What can this AI agent actually DO with everything it has been given?"
Execution authorization (A2SPA)
"Is this exact consequential action authorized right now?"
Execution-risk coverage
What Agent Verify checks before release
Static scanning cannot prove every threat class. Agent Verify separates detected issues, possible risks, missing evidence, and not-assessed categories so teams can make honest release decisions.
Agent attack patterns
How agent behavior becomes business risk
Untrusted text can steer prompts and tool decisions.
Agents can call tools that change money, infrastructure, or data.
Untrusted input can reach shell or command execution paths.
Captured execution requests can be reused without nonce and expiry controls.
Unknown agents or plugins can inherit trust without identity verification.
Unsafe messages can propagate through agent chains.
Release-readiness evidence
Checks for signing, verification, nonce, timestamp, and fail-closed behavior.
Flags persistent or unbounded memory patterns that can carry stale context.
Finds wildcard scopes, admin permissions, and broad access.
Looks for missing rate limits, budgets, timeouts, and execution caps.
Checks whether execution leaves enough evidence for investigation.
Surfaces model and agent version evidence that should be controlled.
A2SPA guidance appears when execution-related findings need signed intent, replay protection, fail-closed behavior, or audit receipts.
Every finding mapped to
New · OWASP Agentic Skills
Assess agent skills against the OWASP Agentic Skills Top 10.
Coverage today: 3 of 10 controls (AST02, AST03, AST04) · the other 7 show as not assessed
Get evidence-based results for supply chain compromise (AST02), over-privileged skills (AST03), and insecure metadata (AST04). Every other control is shown as not assessed — never as a pass. Ask for a cryptographic signature and anyone can check the assessment against a key we publish independently.
Evidence supporting the expected security property was observed.
Agent Verify observed evidence of a security gap.
Agent Verify did not have sufficient evidence to reach a determination. This is not a pass.
Assessed against the OWASP Agentic Skills Top 10 (CC-BY-SA-4.0) at the pinned upstream commit. Not an OWASP certification or endorsement.
How it works
From scan to safer deployment.
Scan agent
Paste code or drop in your agent files — code and config together. Scans run on Agent Verify’s secure server.
Review findings
See the verdict, a 0–100 security score (higher is safer), severity, evidence, and affected controls.
Apply fixes
Use recommended fixes, corrected code, and A2SPA guidance where available.
Re-scan and share
Re-scan after changes, then keep the report private or share it when ready.
What you get
A report your team can act on.
Security report
A clear verdict, a 100-point security score (higher is safer), risk level, and finding count on the first screen.
Recommended fixes
Plain-English findings with corrected code or configuration snippets when available.
Private by default
Keep reports private, or share a public report link any time — Pro also unlocks PDF export.
Enterprise privacy & security controls
What actually protects your data — not a slogan.
We don't claim absolute security guarantees — no one honestly can. Here is exactly what Agent Verify does, verifiable in the open-source web app, CLI, and Worker API, and tested against the real Firestore emulator.
Private reports by default
A new report is owner-only until you explicitly make it public.
Owner-bound access
Firestore Security Rules enforce ownership server-side on every read/write — not just hidden in the UI.
Secret redaction
Detected credentials are redacted before they are ever stored or displayed — raw secret values never leave the scan.
Cross-account isolation
One account can never list or read another account's reports, scans, or API keys.
Revocable share links
Turn public sharing off at any time; the report goes private again immediately.
Report integrity hashing
A SHA-256 hash lets you verify a report's evidence hasn't changed since it was scanned.
API key rotation
Regenerating a key immediately revokes the previous one.
Server-side entitlement
Pro-only features are enforced by the backend, not just hidden client-side.
Fail-closed authorization
Access rules deny by default; nothing is readable unless a rule explicitly allows it.
Private proprietary scanner backend
The detection engine runs server-side and is never shipped to the browser or the CLI.
Sharing and trust
Keep reports private until they are ready.
Private report
New dashboard reports start private so you can review findings before sharing.
Public report
Make a report public with one click and send a clean report link. Turn it back to private any time.
Verified badge
Verified reports can show an embeddable badge for README and documentation pages.
Use cases
Useful wherever agents can take action.
Financial AI agents
Trading, settlement, and payment agents with execution authority.
Healthcare workflows
Clinical and records agents with patient data access.
Autonomous procurement
Purchasing agents with budget authority.
Agent marketplaces
Third-party agent review before publication.
Multi-agent systems
Orchestration chains with delegated authority.
Regulated teams
Environments that need clear security evidence.
Built for security teams
Clear answers on how your code and data are handled — before you sign up.
Visit the Trust Center →- Your raw agent code is never stored — only the results
- GitLab/Bitbucket tokens and test-agent headers encrypted at rest (AES-GCM)
- Signed, independently verifiable scan reports
- Team seats, roles and an audit log
- Public status page and changelog
Start with a private security report.
Scan agent code or configuration, review findings, apply fixes, and re-scan before deployment.
Free includes 10 scans/month and basic findings.