Agent Security Scanner
agentvuln is an MCP server that scans AI agents for tool-calling vulnerabilities including prompt leaks, hijacking, and injections.
About
agentvuln is an MCP server titled Agent Security Scanner that focuses on risks unique to AI agents with tools: prompt leakage, hijacking, injections, and similar failure modes that static app scanners often miss. If you are a developer shipping a Claude Code skill stack, a customer-facing agent, or an internal automation with MCP plugins, this gives you a dedicated pass over agent behavior rather than only npm audit. Install the PyPI stdio server, point it at your agent configuration and tool surface, and treat findings as input to your security checklist alongside code review and secrets hygiene. It does not replace human threat modeling or production monitoring; it narrows the gap between prototype agents and something you can defend in a blog post or SOC2 conversation. Catalog placement is ship → security because that is when developers typically validate agent attack surface before distribution.
- Scans AI agents for tool-calling vulnerability classes
- Covers prompt leaks, hijacking, injections, and related issues
- PyPI package agentvuln v0.4.2 with stdio MCP transport
- Positioned as Agent Security Scanner in registry metadata
- Fits pre-launch review of custom MCP and agent workflows
Agent Security Scanner by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add agentvuln -- uvx agentvulnAdd your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Package | agentvuln |
|---|---|
| Transport | STDIO |
| Auth | None |
What it does
Run MCP-driven scans on AI agents and tool-calling stacks before launch to catch prompt leaks, hijacking, and injection risks.
Who is it for?
Best when you're launching MCP-heavy agents and need a structured scan of tool-calling and prompt-boundary risks.
Skip if: Projects with no LLM agents or tools, where only conventional web or dependency scanning is relevant.
What you get
You get an agent-focused vulnerability report to fix before launch instead of discovering leaks in production.
- Agent security scan results via MCP
- Visibility into prompt leak, hijacking, and injection classes
- Actionable findings for ship-phase remediation
By the numbers
- Version 0.4.2
- Transport: stdio
- Registry title: Agent Security Scanner
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready eviA2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
Agent and tool-calling security scanner MCP, not a general OWASP web pentest suite.
FAQ
Who is agentvuln for?
Developers and small teams shipping AI agents with tools who want MCP-accessible checks for prompt and tool abuse patterns.
When should I use agentvuln?
Run it in the ship phase after your agent and MCP tools are wired but before you publish, onboard customers, or enable autonomous actions.
How do I add agentvuln to my agent?
Install the PyPI package agentvuln, add the stdio MCP server to Claude Code or your client config, and invoke scans against your agent setup per the project docs.