AgentShield

Find risky behavior in MCP and AI agent extensions before they ship.

• Contributing
• Code of Conduct
• Security Policy
• License AgentShield is an offline Rust scanner for teams shipping tool-enabled agents across the current agent stack. Native adapters cover MCP servers, OpenClaw skills, Hermes Agent configs, CrewAI, LangChain/LangGraph, GPT Actions, and Cursor Rules; the same checks help harden repos built around OpenAI Agents SDK, Claude Code, Claude Desktop MCP setups, Browser Use, FastMCP, GitHub MCP Server, Playwright MCP, and other MCP-heavy workflows. It catches command injection, credential exfiltration, SSRF, unsafe file access, runtime package installs, prompt-injection surfaces, and dependency hygiene issues before an agent can call those tools.

It runs as a CLI, GitHub Action, or library, keeps source code on your machine, and emits console, JSON, SARIF for GitHub Code Scanning, and standalone HTML reports. The current release line is 0.8.7.

At a glance

Area	What AgentShield does
Scanner surface	Normalizes seven framework/client families into one IR: MCP, OpenClaw, Hermes Agent, CrewAI, LangChain/LangGraph, GPT Actions, and Cursor Rules.
Detection	Runs 20 built-in rules for command execution, credential exfiltration, composite toxic flows, capability mismatch, SSRF, filesystem risk, runtime installs, prompt surfaces, dependency hygiene, unsafe deserialization, secret leakage, and more.
Workflow fit	Works locally, in CI, and in GitHub Code Scanning without sending source code to a hosted service.
Boundary	AgentShield is not a hosted monitoring service, runtime sandbox, or allowlist marketplace. Experimental runtime guard entrypoints are available behind opt-in feature flags; the stable contract is static scanning plus policy evaluation.

For runtime guard scope and roadmap, see docs/RUNTIME_GUARD.md.

Works With

AgentShield is useful anywhere an agent can call local tools, remote APIs, browser automation, file operations, shell commands, or MCP servers.

Ecosystem	How AgentShield helps
Claude Desktop and Claude Code	Scan MCP servers and tool repositories before adding them to Claude MCP configs or coding-agent workflows.
Cursor and Cursor Rules	Detect risky agent guidance, MCP server definitions, and tool code that can reach files, commands, or the network.
OpenAI Agents SDK	Scan tool implementations, OpenAPI/GPT Actions surfaces, and MCP-connected repos used by OpenAI agent apps.
LangGraph and LangChain	Analyze Python/TypeScript tool code and dependency surfaces before agents execute tools.
CrewAI	Check Python CrewAI tool projects for command execution, credential exfiltration, SSRF, and unsafe file access.
FastMCP, GitHub MCP Server, and Playwright MCP	Scan MCP server code, manifests, schemas, dependencies, and provenance before publishing or installing.
Browser Use and browser automation agents	Catch risky command, network, file, and dependency patterns in tool-enabled automation repos.

Runnable examples live under examples/, with focused guides for Claude MCP security, MCP security scanning, and OpenAI Agents security.

---

Why AgentShield?

AI agents are being connect