Agent Security Harness

Even if an agent is properly authenticated and authorized, can it still be manipulated into unsafe or policy-violating behavior?

603 executable security tests across 44 modules (verified 2026-08-02 via scripts/count_tests.py). MCP + A2A + L402 + x402 wire-protocol testing, plus UCP/ACP merchant-journey, AP2 mandate-chain, Fireblocks x402 hardening, Visa TAP / Mastercard Agentic Token funding-instrument, and denial-of-settlement finality conformance across the full agentic-payments stack. Decision-layer attack scenarios. One pip install away.

$ agent-security test mcp --url http://localhost:8080/mcp
Running MCP Protocol Security Tests v4.13.1...
 MCP-001: Tool List Integrity Check [PASS] (0.234s)
 MCP-002: Tool Registration via Call Injection [PASS] (0.412s)
 MCP-003: Capability Escalation via Initialize [FAIL] (0.156s)
...
Results: 8/10 passed (80% pass rate) - see report.json

Illustrative output. A target the harness cannot reach, or that answers without servicing the request, reports INCONCLUSIVE — never PASS. See v4.13.1 for why that distinction is enforced rather than assumed.

If this evidence discipline is useful in your agent-security work, star this repository to follow releases.

Evidence before coverage

Every claim in this project is bounded by the E1-E5 Evidence Class Taxonomy: observation, runtime characterization, enforcement, persistence/replay resistance, and isolation. A second axis, I0-I2, states who produced the oracle: self-authored, independently reimplemented, or an independent sensor the target does not control. Strength and independence are different properties, so both are cited. A result is not promoted beyond what its retained artifact and execution record demonstrate. Author-performed mappings and test runs are not independent certification.

The AIUC-1 Evidence Field Guide is a plain-language companion that applies this same taxonomy. It adds one distinction the ladder above does not encode: whether evidence is mapped (a documented requirement relationship), executed (a recorded run against a stated target and pinned revision), or independently reviewed (assessed by a qualified outside party). Those describe the status of evidence and are orthogonal to E1-E5, which describes its strength. A mapping alone is E1-level material regardless of how many requirements it covers. The taxonomy in this repository is canonical; the field guide is hosted outside it and is not version-pinned.