Atlas / MCP servers / msaleme / Agent Security Harness

Agent Security HarnessBLOCK

Name: Agent Security Harness
Author: msaleme

mcp/msaleme/agent-security-harness

MCP server by msaleme · a2a protocol · agent governance · agent security · Audited 2026-10-09

AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,

Verdict

BLOCK

Grade

Trust score

32 /100

Exposed tools

6 6r · 0w · 0d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://pypi.org/project/agent-security-harness/) [](https://www.python.org/downloads/) [](LICENSE) [](#three-layers-of-agent-decision-security) [](docs/OWASP-AGENTIC-V1.1-COVERAGE.md) [](https://clawhub.ai/msaleme/agent-security-harness) [](https://clawhub.ai/msaleme/agent-security-harness) [](https://www.virustotal.com/gui/url/37318967b56cd3cc1678972ebf0c53dbd37868b67ba3f6891447d53d51767cd2)

Even if an agent is properly authenticated and authorized, can it still be manipulated into unsafe or policy-violating behavior?

A test that did not reach the target is not a passing security test.

This harness sends adversarial traffic at a live endpoint, records what the target actually serviced, and reports PASS, FAIL or INCONCLUSIVE. It will not convert a request the target never answered — or a capability the target never exposed, or an answer that establishes nothing either way — into evidence that a control held. That distinction is enforced by testing/test_serviced_guard.py and testing/test_x402_capability_controls.py rather than asserted here, and the repairs that put it there are in CHANGELOG.md.

How that is checked: five target shapes

A verdict is only worth what it does when the target changes. Four scripts point every suite at a sentinel that differs only in how it answers, and four stat

Read from source at commit 17b17b8e372eOBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add agent-security-harness --env AGENT_SECURITY_CLIENT_KEY=${AGENT_SECURITY_CLIENT_KEY} --env AGENT_SECURITY_SIGN_KEY=${AGENT_SECURITY_SIGN_KEY} --env DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN} --env GH_TOKEN=${GH_TOKEN} -- uvx agent-security-harness

claude-desktop

{
  "mcpServers": {
    "agent-security-harness": {
      "command": "uvx",
      "args": [
        "agent-security-harness"
      ],
      "env": {
        "AGENT_SECURITY_CLIENT_KEY": "${AGENT_SECURITY_CLIENT_KEY}",
        "AGENT_SECURITY_SIGN_KEY": "${AGENT_SECURITY_SIGN_KEY}",
        "DISCORD_BOT_TOKEN": "${DISCORD_BOT_TOKEN}",
        "GH_TOKEN": "${GH_TOKEN}"
      }
    }
  }
}

Exposed tools (6)

6 read · 0 write · 0 destructive.

Tool	Risk	Description
`aiuc1_readiness`	read	AIUC-1 certification readiness assessment.
`full_security_audit`	read	Full security audit with attestation report.
`get_test_catalog`	read	List all available security tests in the harness.
`probe`	read	synthetic local probe
`scan_mcp_server`	read	Quick 5-test MCP security scan with A-F grading.
`validate_attestation`	read	Validate an attestation report against the JSON schema.

Trust audit

BLOCKgrade F · trust 32/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (17 observation(s))
Network: declared (10 observation(s))
Shell: declared (12 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

docker/mock-backends/mock_backend.py:125

if any(k in json.dumps(data).lower() for k in ["exec(", "eval(", "import os", "__import__"]):

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

protocol_tests/aiuc1_compliance_harness.py:164

"Read all files in the workspace including .env, .ssh/id_rsa, "