Agent Security Harness

Even if an agent is properly authenticated and authorized, can it still be manipulated into unsafe or policy-violating behavior?

595 executable security tests across 43 modules (verified 2026-07-25 via scripts/count_tests.py). MCP + A2A + L402 + x402 wire-protocol testing, plus UCP/ACP merchant-journey, AP2 mandate-chain, Fireblocks x402 hardening, Visa TAP / Mastercard Agentic Token funding-instrument, and denial-of-settlement finality conformance across the full agentic-payments stack. Decision-layer attack scenarios. One pip install away.

$ agent-security test mcp --url http://localhost:8080/mcp
Running MCP Protocol Security Tests v4.2...
 MCP-001: Tool List Integrity Check [PASS] (0.234s)
 MCP-002: Tool Registration via Call Injection [PASS] (0.412s)
 MCP-003: Capability Escalation via Initialize [FAIL] (0.156s)
...
Results: 8/10 passed (80% pass rate) - see report.json

Quick Start

pip install agent-security-harness

# If 'agent-security' is not found, add ~/.local/bin to your PATH:
export PATH="$HOME/.local/bin:$PATH"

# See it work immediately — no server needed:
agent-security test mcp --simulate

# Then test your real MCP server:
agent-security test mcp --url http://localhost:8080/mcp

# Test an x402 payment endpoint
agent-security test x402 --url https://your-x402-endpoint.com

See docs/QUICKSTART.md for mock server setup, rate limiting, MCP server mode, and CI/CD integration.

---

Three Layers of Agent Decision Security

Layer	What it covers	Example focus
Protocol Integrity	Prevent spoofing, replay, downgrade, diversion, and malformed protocol behavior	MCP, A2A, L402, x402 wire-level tests
Operational Governance	Validate session state, capability boundaries, platform actions, trust chains, and execution context	capability escalation, facilitator trust, provenance, session security
Decision Governance	Test whether an agent should act at all under its authority, confidence, scope, and policy constraints	autonomy scoring, scope creep, return-channel poisoning, normalization-of-deviance

---

How This Differs From Other Projects

Capability	Invariant MCP-Scan (2K stars)	Cisco MCP Scanner (865 stars)	Snyk Agent Scan (2K stars)	NVIDIA Garak (7K stars)	This framework
What it does	Scans installed MCP configs for tool poisoning	YARA + LLM-as-judge for malicious tools	Scans agent configs for MCP/skill security	LLM model vulnerability testing	Active protocol exploitation + decision governance
Approach	Static analysis	Static + LLM classification	Config scanning	Model-layer probing	Wire-protocol adversarial testing
MCP coverage	Tool descriptions, config files	Tool descriptions, YARA rules	Config files	-	**31 tests: