Check library
124 security checks for AI agents
Every check Agent Verify runs, in plain English: what it finds, why it matters, and how to fix it. Each one is tested to make sure it actually fires — 48 are new in 2.0, including MCP tool poisoning, AI agents in CI, and checks for 11 agent frameworks.
Showing 124 of 124 checks
MCP (18)
- CriticalAV-MCP-003Dangerous MCP tool exposed: shell/execAn MCP server/package name matching the known "shell/exec" signature.
- CriticalAV-MCP-008Dangerous MCP tool exposed: paymentsAn MCP server/package name matching the known "payments" signature.
- CriticalAV-MCP-105NewHidden instructions inside an MCP tool descriptionAn MCP tool description contains instructions aimed at the AI — like "ignore previous instructions", "do not tell the user", or a request to read SSH keys or config fi…
- HighAV-MCP-002Dangerous MCP tool exposed: filesystemAn MCP server/package name matching the known "filesystem" signature.
- HighAV-MCP-004Dangerous MCP tool exposed: databaseAn MCP server/package name matching the known "database" signature.
- HighAV-MCP-005Dangerous MCP tool exposed: githubAn MCP server/package name matching the known "github" signature.
- HighAV-MCP-006Dangerous MCP tool exposed: gmail/driveAn MCP server/package name matching the known "gmail/drive" signature.
- HighAV-MCP-007Dangerous MCP tool exposed: browser automationAn MCP server/package name matching the known "browser automation" signature.
- HighAV-MCP-009Dangerous MCP tool exposed: dockerAn MCP server/package name matching the known "docker" signature.
- HighAV-MCP-101MCP filesystem server has access to an entire drive or home folderThe filesystem MCP server is given a whole drive or your entire home folder instead of one project folder.
- HighAV-MCP-106NewInvisible characters in tool definitions or promptsTool definitions or prompt text contain invisible Unicode characters (zero-width, bidirectional-override, or "tag" characters).
- HighAV-MCP-107NewTool description tries to change how other tools behaveA tool's description gives the AI rules about how to use a different tool (for example "whenever you use send_email, also BCC this address").
- HighAV-MCP-109NewMCP server container runs privileged or with the Docker socketA containerized MCP server is started with --privileged, host networking, host PID, extra capabilities, or the Docker socket mounted.
- HighAV-MCP-112NewMCP server listens on all network interfaces without authAn MCP server binds to 0.0.0.0 (every network interface) and has no visible authentication.
- HighAV-MCP-114NewMCP server started with sudoAn MCP server is launched through sudo (or doas/runas), so it runs as an administrator.
- MediumAV-MCP-001MCP integration with unidentified tool capabilitiesAn MCP integration pattern (`@modelcontextprotocol/`, `mcpServers`, `StdioServerTransport`) not matching any known server/tool signature.
- MediumAV-MCP-103Remote MCP server connected without authenticationA remote (HTTP/SSE) MCP server is configured with no authorization header or OAuth.
- LowAV-MCP-113NewMCP server can change its tools after you approve itThe server announces that its tool list can change while connected.
Runtime safety (29)
- CriticalAV-RUNTIME-004Command injection risk`exec(`/`spawn(` called with a variable derived from request input, `shell: true`, `child_process`, `os.system`, or `subprocess`.
- CriticalAV-RUNTIME-005Unsafe dynamic code execution`eval(`, `new Function(`, `Function('...')`, or `__import__('...')`.
- CriticalAV-RUNTIME-007Privileged or host-mounted container configuration`privileged: true`, `--privileged`, `hostPath`, `docker.sock` mount, or `hostNetwork: true`.
- CriticalAV-RUNTIME-009SQL query built from unescaped inputA SQL statement is assembled by string concatenation, formatting, or interpolation instead of bound parameters.
- CriticalAV-RUNTIME-010Unsafe deserialization of untrusted dataData is loaded with a deserializer that can execute code (pickle, marshal, unsafe YAML, torch.load without weights_only, node-serialize).
- HighAV-FW-003CrewAI agent runs code outside a sandboxA CrewAI agent can execute code, and it is not set to the Docker-sandboxed "safe" mode.
- HighAV-FW-005AutoGen executes generated code on the hostAutoGen is configured to run model-generated code directly on the local machine.
- HighAV-FW-008Computer-use tool without a visible sandboxThe agent is given a computer-use tool (control of a mouse, keyboard, and screen) with no sign it runs in an isolated VM or container.
- HighAV-FW-009NewLlamaIndex PandasQueryEngine runs model-written codeThe app uses LlamaIndex's PandasQueryEngine, which executes Python the model writes.
- HighAV-FW-014Newsmolagents code agent may import anythingA smolagents CodeAgent is allowed to import "*" or system modules (os, subprocess, socket…) while running locally.
- HighAV-FW-015NewLangChain loads a saved index with dangerous deserialization onA LangChain vector store (FAISS, etc.) is loaded with allow_dangerous_deserialization=True.
- HighAV-FW-019NewGoogle ADK runs generated code without a sandboxA Google ADK agent uses UnsafeLocalCodeExecutor to run model-written code on the host.
- HighAV-RUNTIME-002Prompt injection surface detectedA `systemPrompt`/`system_prompt` pattern without a `sanitize`/`validate`/`escape`/boundary pattern nearby.
- HighAV-RUNTIME-008Unsandboxed browser automationPuppeteer/Playwright/Selenium usage combined with `page.evaluate(`, `--no-sandbox`, or `dangerouslySetInnerHTML`.
- HighAV-RUNTIME-011File access with a caller-controlled pathA file is read, written, or deleted using a path taken directly from request, tool, or model input, with no visible check that it stays inside an allowed folder.
- HighAV-RUNTIME-012Model output used in an action without validationText produced by the model flows straight into code execution, a database query, or HTML rendering, with no schema validation or sanitization step visible.
- HighAV-RUNTIME-013External content fed into the prompt without isolationThe agent pulls in outside content (web pages, emails, retrieved documents) and adds it to its prompt, with no visible marking of that content as untrusted data.
- HighAV-RUNTIME-017NewServer-side template built from user or model textA template engine compiles text that came from a user or the model.
- HighAV-RUNTIME-019NewTool or web results placed in the system promptContent from tools, web pages, search results or emails is inserted into the system message.
- MediumAV-DATA-008NewWeb pages loaded into the knowledge base without checksWeb pages are fetched and stored in the vector database with no source allowlist or cleaning step.
- MediumAV-FW-010NewVercel AI SDK agent allowed hundreds of stepsA Vercel AI SDK call allows 100 or more tool steps per request.
- MediumAV-RUNTIME-006Debug settings alongside production config`debug: true`, `NODE_ENV=development`, `DEBUG=*`, or `FLASK_DEBUG=1` alongside `production`/`deploy`/`release` keywords.
- MediumAV-RUNTIME-014Agent loop with no step limitThe agent's reasoning/tool loop is configured with no maximum number of steps.
- MediumAV-RUNTIME-018NewRegular expression built from user or model inputA regular expression pattern comes straight from user, tool, or model input.
- LowAV-FW-017NewCrewAI crew with tools and no request limitA CrewAI crew whose agents have tools sets no max_rpm, max_iter or max_execution_time.
- LowAV-RUNTIME-001Unbounded memory persistenceA `persist: true`/`ttl: null`/`retention: forever` pattern.
- LowAV-RUNTIME-003No execution rate limitingAbsence of `rate limit`, `throttle`, `budget`, `max calls`, or `quota` patterns.
- LowAV-RUNTIME-015NewTool makes HTTP calls with no timeoutA tool calls requests.* without a timeout.
- LowAV-RUNTIME-016NewModel calls have no output token limitThe agent calls the model with tools but never sets a maximum output size.
Secrets & data exposure (26)
- CriticalAV-SECRET-001Hardcoded credentials (generic pattern)A field named like a credential assigned a 16+ character inline string literal.
- CriticalAV-SECRET-002OpenAI-style API key detectedA openai-style api key pattern (id: openai_key).
- CriticalAV-SECRET-003Anthropic-style API key detectedA anthropic-style api key pattern (id: anthropic_key).
- CriticalAV-SECRET-004AWS access key ID detectedA aws access key id pattern (id: aws_access_key).
- CriticalAV-SECRET-005GCP service account key material detectedA gcp service account key material pattern (id: gcp_service_account).
- CriticalAV-SECRET-006GitHub access token detectedA github access token pattern (id: github_token).
- CriticalAV-SECRET-007Stripe secret/restricted key detectedA stripe secret/restricted key pattern (id: stripe_key).
- CriticalAV-SECRET-008Slack token detectedA slack token pattern (id: slack_token).
- CriticalAV-SECRET-009Private key material detectedA private key material pattern (id: private_key_block).
- CriticalAV-SECRET-010Database connection string with embedded credentials detectedA database connection string with embedded credentials pattern (id: database_url_with_creds).
- CriticalAV-SECRET-011JWT-like token detectedA jwt-like token pattern (id: jwt_like).
- CriticalAV-SECRET-012Possible wallet private key (hex) detectedA possible wallet private key (hex) pattern (id: possible_wallet_key).
- CriticalAV-SECRET-013Google API key detectedA google api key pattern (id: google_api_key).
- CriticalAV-SECRET-014Hugging Face access token detectedA hugging face access token pattern (id: huggingface_token).
- CriticalAV-SECRET-015SendGrid API key detectedA sendgrid api key pattern (id: sendgrid_key).
- CriticalAV-SECRET-016Twilio API key detectedA twilio api key pattern (id: twilio_key).
- CriticalAV-SECRET-017npm access token detectedA npm access token pattern (id: npm_token).
- CriticalAV-SECRET-018Azure Storage account key detectedA azure storage account key pattern (id: azure_storage_key).
- CriticalAV-SECRET-019Discord bot token detectedA discord bot token pattern (id: discord_bot_token).
- HighAV-DATA-002Credential or secret placed in the system promptA password, key, or token appears to be written directly into the system prompt.
- HighAV-DATA-003Data exfiltration path: private data + untrusted input + outbound channelThis agent can read private data, takes in untrusted content (user messages, emails, web pages, documents), and can send data out (email, chat, HTTP POST, webhooks) — …
- HighAV-DATA-004NewPersonal data sent to the model without redactionFields like SSN, card number, date of birth, passport or medical data are put into a model prompt with no redaction step.
- HighAV-MCP-102Credential stored in plain text in the MCP configAn MCP server's env block contains what looks like a real token, key, or password written directly in the config file.
- HighAV-MCP-111NewAll environment variables handed to an MCP serverThe MCP client starts a server and passes it the entire environment (process.env / os.environ).
- MediumAV-DATA-001Sensitive values written to logsA log or print statement includes a field named like a password, key, token, or personal identifier.
- MediumAV-DATA-006NewSystem prompt returned to the clientAn API response includes the agent's system prompt or instructions.
Permissions (12)
- CriticalAV-PERM-003Overly broad cloud IAM permissions`"Effect":"Allow"` with `"Action":"*"`, `AdministratorAccess`, `iam:*`, or `"Resource":"*"`.
- CriticalAV-PERM-007NewAI workflow checks out untrusted PR code with secretsA pull_request_target workflow checks out the pull request's own code and runs an AI agent.
- CriticalAV-PERM-008NewAgent's Kubernetes account has cluster-adminA Kubernetes service account is bound to the cluster-admin role.
- HighAV-DATA-007NewRetrieval with no per-customer filterThe app has multiple customers (tenant/org IDs) but searches the vector store without filtering by customer.
- HighAV-FW-002LangChain SQL agent with unrestricted database accessA LangChain SQL agent is connected to a database with no visible table restriction or read-only connection.
- HighAV-PERM-001No permission or tool scope declaredNo `permissions`/`scope`/`tools` allowlist pattern and no wildcard pattern anywhere in the content.
- HighAV-PERM-002Unscoped delegation detectedA `delegate`/`subagent`/`handoff` pattern without a `scope`/`constrain`/`limit`/`bound` pattern nearby.
- HighAV-PERM-004NewAgent requests very broad OAuth scopesThe agent asks for full-account OAuth scopes such as GitHub "repo", Google Drive / Gmail full access, or Microsoft "*.ReadWrite.All".
- HighAV-PERM-005NewAgent connects to the database as an admin userThe agent's database connection uses an administrator account (root, postgres, sa, admin).
- HighAV-PERM-006NewAI workflow in CI with write-all permissionsA GitHub Actions workflow that runs an AI agent grants write-all permissions to the job token.
- LowAV-FW-004CrewAI agent can delegate to any crew memberA CrewAI agent has delegation turned on, so it can hand tasks to any other agent in the crew.
- LowAV-FW-016NewOpenAI Agents SDK hands full history to other agentsAgents hand off to each other with no input_filter, so each receiving agent gets the full conversation and tool history.
Human oversight (10)
- CriticalAV-HUMAN-003NewAgent can move money with no amount limitA tool the model can call creates transfers, payouts, payments or refunds, with no maximum amount and no approval step.
- HighAV-FW-013NewAI editor set to run every tool without askingThe editor's AI agent mode (VS Code Copilot / Cursor) is set to auto-approve all tools or terminal commands.
- HighAV-HUMAN-001Missing human-in-the-loop gatesA high-risk action pattern (transfer/deploy/delete/payment call) co-occurring with the absence of confirm/approve/human-review keywords.
- HighAV-HUMAN-002Built-in safety controls turned offA framework safety switch is explicitly disabled — for example auto-approving every tool call, skipping permission prompts, allowing dangerous code, or running generat…
- HighAV-HUMAN-004NewDestructive tool with no confirmationThe agent has a tool that deletes, drops, wipes or terminates things, and nothing asks a person first.
- MediumAV-FW-006OpenAI Agents SDK agent with tools but no guardrailsAn agent built with the OpenAI Agents SDK has tools, but no input or output guardrails are defined.
- MediumAV-FW-011NewSemantic Kernel auto-invokes functions with no filterSemantic Kernel automatically runs any plugin function the model picks, and no function-invocation filter is registered.
- MediumAV-FW-018NewLangGraph agent runs tools with no human checkpointA LangGraph agent has tools that change things (send, delete, pay, deploy…) and no interrupt for human review.
- MediumAV-HUMAN-005NewAgent sends emails or messages without reviewA tool lets the agent send emails, Slack messages or texts directly, with no draft or approval step.
- MediumAV-MCP-104MCP tools set to run without askingSome MCP tools are on an auto-approve / always-allow list, so the AI can call them without asking you each time.
Tools (6)
- HighAV-FW-001LangChain code or shell tool enabledThe agent is given a LangChain tool that runs shell commands, executes Python, or sends arbitrary write requests.
- HighAV-FW-012NewClaude Code allowed to run any shell commandClaude Code settings allow every Bash command without asking ("Bash" or "Bash(*)").
- HighAV-TOOL-001Unrestricted tool accessA `tools: ['*']` or `permissions: 'all'`-shaped wildcard tool declaration.
- HighAV-TOOL-003NewAgent can call any URL with any methodThe agent has a general-purpose HTTP tool that can call any URL, with no host allowlist.
- MediumAV-FW-007Claude Agent SDK agent without a tool allowlistA Claude Agent SDK agent is created without allowed_tools, disallowed_tools, or a can_use_tool permission callback.
- MediumAV-TOOL-002NewTool arguments used without validationTool-call arguments from the model are parsed and used directly, with no schema validation.
Network (7)
- HighAV-NET-003Webhook without visible signature verificationA `/webhook`/`/callback`/`webhookUrl` pattern without `verifySignature`/`x-hub-signature`/`stripe-signature`/`hmac` nearby.
- HighAV-NET-004Server-side request to a caller-controlled URLThe agent makes an outbound HTTP request to a URL taken directly from request, tool, or model input, with no visible host allowlist.
- HighAV-NET-005TLS certificate verification disabledHTTPS certificate checking is turned off, so the agent will accept any certificate — including an attacker's.
- HighAV-NET-006NewCode reaches the cloud metadata endpointThe code references a cloud instance-metadata address (169.254.169.254 or equivalent).
- MediumAV-MCP-110NewRemote MCP server over unencrypted HTTPA remote MCP server is reached over plain http:// rather than https://.
- MediumAV-NET-001Plaintext HTTP endpointA `http://` URL where the host is not `localhost`/`127.0.0.1`/`0.0.0.0`.
- MediumAV-NET-002Permissive CORS (wildcard origin)`Access-Control-Allow-Origin: *`, `cors({ origin: true })`, or `origin: '*'`.
Identity (4)
- HighAV-IDENT-001Rogue agent onboarding risk`registerAgent`/`onboardAgent`/`dynamic agent`/`marketplace` patterns.
- HighAV-IDENT-002NewCaller identity taken from an unverified headerThe code decides who the caller (user or agent) is from a plain X-Agent-Id / X-User-Id style header, with no signature check.
- HighAV-NET-007NewAgent endpoint with no authenticationAn HTTP route runs the agent, and nothing in the file checks who is calling it.
- MediumAV-IDENT-003NewPublished A2A agent card with no authenticationAn Agent-to-Agent (A2A) agent card advertises skills but declares no security scheme.
Supply chain (5)
- HighAV-MCP-108NewMCP server installed straight from a git repo or download linkAn MCP server is installed from a git URL or a download link instead of a published, pinned package version.
- MediumAV-DEP-001Supply chain control missing`curl | bash/sh`, unpinned `npm install`/`pip install`, `unpkg`, `cdn.jsdelivr`, or a `"latest"` version tag.
- MediumAV-DEP-002MCP server installed without a pinned versionAn MCP server is launched with `npx -y` / `uvx` using a bare package name, so whatever version is newest gets downloaded and run on every start.
- MediumAV-DEP-004NewDependency installed from a git branchA package is installed from a git repository branch (or default branch) instead of a release or a full commit hash.
- LowAV-DEP-003NewAI libraries installed without a pinned versionrequirements.txt lists AI libraries with no version or only a minimum version.
Audit & logging (3)
- MediumAV-AUDIT-001Missing audit loggingAbsence of `audit`, `logger.*`, `winston`, `pino`, or structured-log patterns alongside real execution behavior.
- MediumAV-AUDIT-002NewAudit logging turned offAudit logging is explicitly switched off.
- MediumAV-DATA-005NewFull prompts or conversations written to logsWhole prompts or conversation histories are logged.
Execution authorization (4)
- CriticalAV-EXEC-001Missing cryptographic signatureAbsence of `.sign(`, `.verify(`, `crypto.sign/verify`, JWT verification, HMAC, or an `x-signature` header pattern.
- CriticalAV-EXEC-002Missing nonce validationAbsence of `nonce`, `idempotency key`, `x-nonce`, or `requireNonce` patterns.
- HighAV-EXEC-004Missing fail-closed enforcementAbsence of an explicit `failClosed`/deny-by-default pattern, or a throw tied to a verification/authorization failure.
- MediumAV-EXEC-003Missing timestamp enforcementAbsence of `expires_at`, `valid_until`, `"exp"`, or request-expiry patterns.