agent-owasp-check

Agent OWASP Check

Audit an AI agent system against the OWASP Agentic Security Initiative (ASI) Top 10. Use this when you need a focused agent-security workflow rather than a broad repository scorecard.

When to Use

• Reviewing a repository that exposes agent, MCP, or LLM execution paths
• Before deploying a new multi-agent workflow or tool-using assistant
• When onboarding a new MCP server, tool layer, or prompt orchestration pattern
• During a security review of an AI-powered product feature

When NOT to Use

Instead of agent-owasp-check	Use
General repository security scoring	evaluate-repository
Ordinary web-app auth or injection review	security-scan or pr-security-review
Prompt-quality regression testing	eval-harness

Prerequisites

• The repository actually contains agent, MCP, or LLM behavior to inspect
• You can search source, config, and workflow files
• You know which runtime boundaries matter: prompts, tools, memory, logs, or external fetches

Workflow

1. Confirm the agent surface exists

git ls-files | Where-Object { $_ -match 'agent|llm|mcp|openai|anthropic|claude|langchain|gpt|gemini|codex|vertex|bedrock|ollama|litellm' }

If nothing relevant is present, stop and use a broader repository audit instead.

2. Check each ASI risk

ASI-01: Unbounded Resource Consumption

git --no-pager grep -n "maxTokens\|max_tokens\|timeout\|rate_limit\|maxRetries" -- "*.ts" "*.js" "*.py" "*.json"

Pass: Agent runs have explicit limits for time, retries, tokens, or tool calls.
Fail: The agent can loop or consume resources without a clear bound.

ASI-02: Privilege Escalation

git --no-pager grep -n "allowedTools\|toolWhitelist\|allowlist\|permissions" -- "*.ts" "*.js" "*.py" "*.json"

Pass: Tool access is scoped to the task or role.
Fail: The agent can invoke any available tool or cross trust boundaries freely.