Independent evaluation guide | 18 synced entries
Secure agent tools, memory, identity, permissions, sandboxes, and MCP servers. Compare selection criteria here, then verify every claim against the linked first-party source.
Decision context
AI agent security focuses on systems that can choose actions, call tools, retain memory, and interact with external services. These capabilities turn prompt injection and untrusted context into authorization and execution risks. Model Context Protocol servers add another integration boundary involving tool descriptions, credentials, transport, and user approval. Tools in this category inspect agent workflows, scan MCP or skill definitions, protect memory, test excessive agency, and isolate runtime actions.
README-synced directory
Each listing preserves the neutral description maintained in the Awesome MLSecOps README and links to the resource's first-party source.
Apache-2.0 runtime monitoring and control engine that judges an agent's tool calls, outputs, and reasoning traces against its declared remit to detect misaligned, off-policy, or out-of-remit behaviour and block or hold actions in flight, with self-hosted deployment and SDKs for LangChain, Anthropic, TypeScript, and Claude Code
MIT-licensed Microsoft toolkit, in public preview, that intercepts every agent tool call, message, and delegation in deterministic code against a YAML policy, adds per-agent identity, sandboxing, and tamper-evident audit trails, and maps its controls to all ten OWASP Agentic Top 10 risks including ASI10 rogue agents
OWASP project providing a runtime defense layer that screens AI agent memory reads and writes against prompt injection, secret leakage, and memory poisoning
Python CLI by Repello AI for extracting agentic workflows from LangChain/LangGraph/CrewAI/AutoGen and running automated threat modeling
MIT-licensed harness behind Anthropic's agentic misalignment study that generates fictional corporate scenarios with blackmail, leaking, and replacement-threat conditions, runs them across 40+ models, and classifies whether the agent carried out the harmful insider action
Agentic LLM Vulnerability Scanner / AI red teaming kit
Go-native AI gateway that enforces guardrails, rate limits, and fine-grained access controls across LLM and MCP traffic.
MIT-licensed library from the UK AI Security Institute and Redwood Research for AI control experiments that pair benign main tasks with covert sabotage side tasks and measure how monitors, defer-to-trusted protocols, and audit-and-shutdown procedures contain an untrusted, possibly misaligned agent
Open-source local-first runtime security layer for AI agents that evaluates supported tool actions and local artifacts for prompt injection, secret exposure, unsafe commands, package risks, and MCP threats
Open-source CLI that sends LLM-generated adversarial attacks to an agent's HTTP endpoint and scores results against OWASP LLM Top 10, OWASP Agentic Top 10, NIST, and EU AI Act mappings
Self-hosted runtime that sandboxes autonomous AI agents with isolated execution, restricted networking, and human-approval gating
Apache-2.0 CLI that records an agent's model-provider exchange at the wire level for post-incident analysis, then replays the recorded run offline so a captured prompt injection becomes a repeatable test case against a candidate guardrail
MIT-licensed alignment auditing agent released by Anthropic and built on Inspect that runs multi-turn audits of a target model with simulated users and tools and scores transcripts for deception, oversight subversion, power-seeking, and other misaligned agentic behaviour
Self-hosted runtime control plane that screens AI coding-agent tool calls against a signed policy before execution, blocking or routing to human approval secret exfiltration, prompt-injection-driven actions, and destructive commands across Claude Code, Codex, and MCP servers
Static security scanner for MCP servers, AI agent skills, and plugins, with SARIF output and CI integration
Verifies an AI agent's outbound requests and MCP handoffs against a source of truth using zero-knowledge proofs, so a call only goes out if its claims check out; hooks the HTTP libraries, logs each outbound call, and blocks endpoints not on the trusted allow-list
AI control plane for managing agent access to MCPs, Skills, and Assistants with role-scoped permissions, policy enforcement, threat detection, and event logging
Agentic AI security platform that continuously assesses AI agents, MCP servers, LLM and AI-native applications, and code shipped with AI coding tools, traces attack chains, and verifies proposed fixes landed
No catalog entries match that search.
Selection framework
Assess agent-security tooling against the permissions and data paths in your architecture. Look for explicit identities, least-privilege scopes, per-tool policy, credential isolation, network controls, and durable audit records. Define which actions require human approval, such as financial transactions, data mutation, privilege changes, or external communications, and make unavailable approval or policy services fail closed. A scanner should cover indirect prompt injection and malicious tool metadata, not only user prompts. Test the complete action path because a safe model response can still trigger an unsafe downstream tool call.
Record evidence and limitations for each criterion. A catalog listing is a discovery aid, not a security certification.
Primary references