For developers

Verify every agent before it ships.

Run the same 76 checks from your terminal and your CI pipeline. Risky changes — a pasted key, a wildcard tool list, an unsandboxed code runner, an MCP server with your whole drive — fail the build before they reach production.

Get a free API key Read the full docs

Create an API key

Sign in, open the dashboard, and generate a key on the API / CLI tab. Free accounts can use the CLI too — every scan uses one from your monthly quota.

Dashboard → API / CLI → Generate API key. Keys start with av_; regenerating one revokes the old key immediately.

Scan before you deploy

Point the CLI at your agent folder. It scans every agent file and prints the verdict, security score, and what to fix first.

npm install -g agentverify
export AGENTVERIFY_API_KEY=av_your_key
agentverify scan ./agents

Block risky merges in CI

Add this workflow and save your key as the AGENTVERIFY_API_KEY repository secret. Pull requests that make an agent unsafe fail the check before they merge.

name: Agent Verify

on:
  pull_request:
    branches: [main]

jobs:
  agentverify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify AI agents before merge
        run: npx --yes agentverify scan ./agents --ci --policy standard
        env:
          AGENTVERIFY_API_KEY: ${{ secrets.AGENTVERIFY_API_KEY }}

CI exit codes

With --ci, your pipeline can tell a real security failure apart from a broken run.

0	Verified — every scanned file passed
1	Not verified — a real security finding blocks release
2	Not assessed — not enough agent code to judge (pass --allow-not-assessed to ignore)
3	Execution error — bad key, network failure, missing file (never a security result)

Useful options

--policy financial-agent — stricter rules for agents that move money (also high-security, production-infrastructure).
--markdown — a summary you can post as a PR comment.
--json / --summary-file out.json — machine-readable results for dashboards.
--file .mcp.json — check one file, such as your MCP config.
--profile owasp-agentic-skills-2026 — assess a skill package against the OWASP Agentic Skills Top 10.

What the checks cover

Code

SQL injection, SSRF, command injection, unsafe eval and deserialization, path traversal, model output executed without validation.

Agents

Prompt injection (direct and from web pages, emails, documents), wildcard tools, missing approval gates, unbounded loops, data-exfiltration paths.

Frameworks

LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, and computer-use tools — each with framework-specific checks.

MCP & secrets

MCP servers with whole-drive access, unpinned or unauthenticated servers, 19 kinds of credentials — always redacted in reports.

Scan API

Call the scanner from your own tooling. Same checks, same quota.

curl -X POST https://agentverify-api.agentverify.workers.dev/v1/scan \
  -H "Authorization: Bearer $AGENTVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"fileName":"agent.py","content":"..."}'

Show it's verified

When an agent passes, add the live Agent Verify badge to your README. It links to the report, so buyers and reviewers can check it themselves.

Pro adds the corrected code for each finding and a PDF report for clients and auditors.

Compare plans