Agent endpoint with no authentication
HighAV-NET-007IdentityCore packNew in 2.0
What it finds
An HTTP route runs the agent, and nothing in the file checks who is calling it.
Why it matters
Anyone who finds the URL can use your agent — its tools, its data, and your model budget.
What an attacker could do: Strangers can run the agent and its tools, and spend your API credits.
How to fix it
Require authentication on the route (session, JWT, or API key) and rate-limit per user.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- UNAUTHENTICATED_AGENT_ENDPOINT
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM08 - Excessive Agency, LLM04 - Model Denial of Service
- NIST AI RMF
- GV-4.1
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.