Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Invaris AgentSec is an open-source framework for red-teaming complete AI-agent workflows before attackers reach them. Instead of checking only whether a model answers a malicious prompt, it drives adversarial scenarios through the agent’s tools, memory, retrieved documents, identity controls, and delegation logic. You define what the agent may do, what it must never do, and how much execution is allowed; AgentSec then runs repeatable tests and reports the observed actions and policy violations. That makes it useful for developers asking whether an agent knows when not to act—not merely whether it can finish a task.
What is Invaris AgentSec?
Invaris AgentSec is a developer-facing, open-source security and reliability testing framework from Invaris Labs. Its central idea is to test an autonomous agent as a system: model, prompt, tools, memory, retrieval, identity, and orchestration together. The project describes this as making agent testing repeatable and approachable in the same way that teams test an API.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters because an agent can produce a harmless-looking final answer after doing something unsafe internally. It might read a confidential record, invoke a tool the user did not authorize, carry a malicious instruction into long-term memory, or continue making expensive calls after the useful work is complete. AgentSec is designed to expose those behaviors before deployment.
Why are ordinary prompt tests insufficient for tool-using agents?
Prompt-only checks isolate the language model, while an agent’s risk usually appears at the boundaries between components. AgentSec follows the untrusted input through the workflow and observes what the agent actually does.
#1 Best Overall
- Untrusted inputs are everywhere. Email, web pages, retrieved documents, tool responses, and MCP server descriptions can all contain instructions that were not written by the user or developer.
- Tools create side effects. Reading data is different from sending it, changing a record, approving a payment, or deleting an object. A model can select a dangerous tool even when its final text sounds cautious.
- State persists. A poisoned memory entry can influence later sessions, so a single successful test is not enough if the malicious instruction survives.
- Autonomy compounds small errors. Excessive tool calls, repeated retries, and missing termination conditions can turn a minor planning mistake into a large bill or a non-terminating loop.
- Multiple agents can confuse authority. A delegated worker may receive privileges that the original user never granted, creating a confused-deputy path to escalation.
The project’s framing is practical: do not just test whether an agent can complete a task; test whether it knows when not to act.
What security and reliability risks does AgentSec test?
AgentSec’s documented suite spans the main ways an autonomous workflow can be manipulated or exceed its authority. Findings are mapped to the OWASP Top 10 for Agentic Applications categories ASI01–ASI10.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Area | What the test tries to reveal | Why it matters |
|---|---|---|
| Direct prompt injection | Whether hostile instructions in the user-facing prompt override the agent’s governing policy. | The attacker may steer planning, tool choice, or disclosure. |
| Indirect prompt injection | Whether instructions hidden in email, browser content, retrieved documents, or other external data are treated as commands. | The user may never see the payload, yet the agent can still obey it. |
| Unauthorized tool use | Whether the agent invokes a tool or performs an action outside the current task’s authorization. | A valid credential does not make every available operation legitimate. |
| Secret and sensitive-data leakage | Whether protected values appear in responses, tool arguments, logs, or destinations that were not approved. | Leakage can occur while the agent appears to be completing a normal request. |
| Memory poisoning | Whether malicious content is written to memory and later treated as trusted context. | One poisoned interaction can affect future users or sessions. |
| Tool-output and MCP poisoning | Whether malicious tool responses or server metadata alter the agent’s plan. | Descriptions and outputs are part of the agent’s instruction surface. |
| Runaway execution | Whether calls, tokens, cost, or elapsed steps exceed policy, or whether the workflow lacks a reliable stop condition. | Failures can create outages, unbounded spend, or repeated side effects. |
| Dangerous data composition | Whether data read by one tool is sent to another destination without explicit authorization. | Each individual tool may be allowed while the combination is unsafe. |
| Identity and session confusion | Whether the agent mixes users, sessions, roles, or authorization context. | Confused identity can expose another person’s data or privileges. |
| Delegation abuse | Whether a sub-agent can escalate privileges or persuade another agent to perform a forbidden action. | Trust boundaries become unclear in multi-agent systems. |
| Behavioral regression | Whether a model, prompt, tool, or policy change reintroduces a previously fixed behavior. | Security can degrade during ordinary releases. |
How does an AgentSec scenario attack an agent?
A scenario supplies adversarial content, lets the real workflow run, and evaluates the resulting behavior against your policy. The important unit is not a single generated sentence but the sequence of observations and actions.
- Deliver an attack through a realistic channel. The payload may be a direct user message, a hostile document, an email body, browser content, an MCP description, or a crafted tool response.
- Allow normal orchestration to continue. The agent can plan, call tools, read memory, delegate work, and produce its usual outputs instead of being reduced to a text-only test.
- Observe side effects and policy boundaries. The run records tool calls, arguments, data movement, step counts, token use, cost, and termination behavior.
- Classify the violation. A finding connects the delivered adversarial content to the policy rule that was broken and the action that was observed.
- Save a reproducible case. Deterministic seeds and replay allow the same scenario to be rerun after a prompt, model, tool, or policy change.
This approach can catch a dangerous composition that isolated checks miss—for example, a permitted document reader handing a secret to a permitted outbound connector even though the transfer itself was never authorized.
How do I install and run AgentSec?
The documented command-line workflow is short: install the package, define a policy, then run the test command. Execute it in an environment where the target agent and its test data can be safely exercised.
Rank #2
- Install the CLI. Use Python’s package installer:
pip install invaris-agentsec - Create
agentsec.yaml. The policy must identify the agent endpoint, list allowed tools, state forbidden actions, set step/tool/cost limits, and select the test categories you want to run. Keep the policy under version control with the agent code. - Run the suite.
agentsec testThe command executes the configured scenarios and writes reports.
- Inspect the output. JSON and HTML are documented as default report formats. Markdown and SARIF are also available when a text report or code-scanning workflow is more useful.
- Repeat under controlled conditions. Use deterministic seeds when you need comparable runs, and replay prior findings to confirm that a fix actually changes the behavior.
Because the project is intended to work like an API-testing tool, the endpoint can represent a custom agent service rather than a particular model vendor. The practical prerequisite is an adapter or interface that lets AgentSec submit scenarios and observe the agent’s actions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat should an AgentSec policy allow and forbid?
A useful policy states the agent’s authority explicitly instead of relying on a general instruction such as “be careful.” Define the smallest set of operations required for the task and put hard limits around execution.
Allowed tools and destinations
List the tools the scenario is permitted to call and the destinations those tools may reach. Separate read operations from write, send, delete, approval, or financial actions. If a tool can return secrets, define where those values may and may not be passed next.
Forbidden actions
Record actions that must never occur in the tested context, including unauthorized outbound messages, disclosure of protected data, changes to production records, privilege changes, and writes to persistent memory. A forbidden action should be observable in a trace so that a failing test has concrete evidence.
Execution limits
Set maximum steps, tool calls, token use, and cost, and require a termination condition. These controls test both safety and reliability: an agent that eventually stops after hundreds of unnecessary calls may still violate the operational policy.
Recommended Free Tools
Test categories
Select the attack classes relevant to the workflow. A browser research agent needs indirect-injection and unsafe-document cases; a support agent needs identity, session, and leakage cases; a multi-agent planner needs delegation and privilege-escalation cases. Running every category is useful for a baseline, but targeted policies make failures easier to triage.
What evidence should a failed test contain?
A useful finding lets a developer reproduce the failure and identify the exact boundary that needs changing. AgentSec’s comparison criteria call for more than a pass/fail label.
- The delivered adversarial content: the prompt, document text, tool response, or server metadata that triggered the scenario.
- The execution trace: ordered model turns, tool calls, arguments, returned data, delegation events, and termination state.
- The violated policy: the allowed-tool, forbidden-action, data-flow, identity, or resource-limit rule that was breached.
- The observed action: what the agent actually did, such as invoking an unauthorized tool or sending a secret to an unapproved destination.
- Reproduction data: the seed and scenario identity needed to replay the case after a fix.
Without this evidence, a team may know that a run failed but not whether to change the system prompt, tool permissions, memory writer, retrieval filter, identity binding, or runtime budget.
How can I scan an MCP server for poisoned tool descriptions?
Use AgentSec’s MCP scanner before trusting a server’s metadata in an agent workflow. The scanner examines the descriptions and definitions that influence tool selection, not only the code behind the server.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDocumented checks include hidden characters, homoglyphs, shadowing, misleading annotations, and changed definitions. These issues can make a tool appear to have one name or purpose to a human while presenting another instruction to a model, or can silently alter the interface after approval.
Rank #4
Run the scan as a separate gate from behavioral scenarios when onboarding or updating an MCP server. A clean metadata scan does not prove that the server’s runtime responses are safe; pair it with tool-output poisoning and dangerous-composition scenarios.
Can AgentSec run in CI and support regression testing?
Yes. The documented workflow includes GitHub Actions integration, machine-readable reports, replay, and comparison of old and new reports. That lets a security test become a release gate rather than a one-time exercise.
A practical CI sequence
- Check out the agent and its versioned
agentsec.yamlpolicy. - Install the CLI in the test environment.
- Start the agent against isolated accounts, test data, and reversible tools.
- Run
agentsec testwith deterministic settings. - Publish the JSON or HTML report as a build artifact and export SARIF when the repository’s code-scanning workflow consumes it.
- Compare the new report with the approved baseline and fail the build on newly introduced policy violations.
- Replay fixed findings periodically so that a change in model or prompt does not silently reopen them.
Keep production credentials and irreversible endpoints out of ordinary CI. The purpose of a red-team run is to exercise hostile inputs safely, not to give test payloads real-world destructive power.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How is AgentSec different from a standalone prompt-injection checker?
The difference is the scope of observation. A standalone checker asks whether a model resists a string; AgentSec asks whether the assembled agent preserves authorization and safety while acting.
| Comparison axis | AgentSec’s documented emphasis | Why a developer should care |
|---|---|---|
| Threat coverage | Injection, MCP and tool poisoning, leakage, memory, identity, dangerous data flows, delegation, and resource exhaustion. | Failures often occur between components rather than in the model’s text alone. |
| Test style | Stateful, end-to-end scenarios that exercise tools and workflow state. | You can see whether an attack produces a real side effect. |
| Evidence | Adversarial content, trace, violated policy, and observed action. | Remediation can target the exact control that failed. |
| Developer workflow | Local CLI, deterministic replay, report comparison, SARIF, GitHub Actions, dashboard, and MCP scanning. | Security checks can run alongside normal software delivery. |
| Privacy and deployment | Designed for local-by-default execution rather than requiring hosted trace processing. | Teams can reduce exposure of prompts, tool arguments, and retrieved data. |
| Framework scope | Intended for generic adapters, LangChain/LangGraph-style applications, MCP-connected agents, and custom APIs. | The key integration question is whether your agent exposes an observable endpoint and tool boundary. |
What are AgentSec’s limits and what has not been proven?
AgentSec provides a way to generate and reproduce adversarial tests; it is not evidence that an agent is secure against every attack. Coverage depends on the scenarios, policy, adapters, tools, and environments you configure.
- The authoritative project material does not publish an independently measured detection rate.
- It does not publish a production-adoption benchmark that would justify claims about industry-wide effectiveness.
- Sample scenario and finding counts in documentation are illustrative output, not performance measurements.
- A passing run means the tested scenarios respected the tested policy under those conditions; it does not certify the model, tool, MCP server, or deployment in general.
Use the framework as one layer in a defense program. Pair it with least-privilege credentials, explicit approval for high-impact actions, isolation of test data, secret management, logging, and human review where a mistake is costly or irreversible.
How should a team roll out agent red-teaming?
Start with the actions that could cause the greatest harm, then expand coverage as the workflow changes.
- Inventory authority. List every tool, destination, memory store, identity source, and delegated agent available to the workflow.
- Write the policy. Convert that inventory into allowed tools, forbidden actions, data-flow rules, and step/tool/cost limits.
- Create a baseline. Run direct and indirect injection, leakage, unauthorized-action, and runaway-execution scenarios before adding specialized cases.
- Add environment-specific attacks. Include hostile email or browser content, poisoned MCP metadata, memory persistence, identity confusion, and delegation abuse where applicable.
- Fix the control, not only the prompt. Prefer permission boundaries, destination checks, memory validation, and termination guards when the trace shows a system-level failure.
- Automate regression checks. Store findings, replay them after changes, compare reports, and gate releases on new violations.
- Review scope after every capability change. A new tool, connector, model, retrieval source, or sub-agent changes the attack surface and deserves new scenarios.
The result is a repeatable question for every release: can this agent complete the intended task while refusing actions outside the user’s authorization?
Frequently Asked Questions
Does AgentSec publish a detection-rate benchmark?
No. The project materials do not provide an independent detection-rate or production-adoption study. Documentation examples showing scenario or finding totals are illustrative output, not measured efficacy.
Can I test an agent that has no MCP connection?
Yes, provided the agent can be exercised through an endpoint or adapter that exposes its workflow and actions. MCP scanning is an additional capability for servers and metadata; it is not a prerequisite for testing other tool-using agents.
What should I isolate before running adversarial scenarios?
Use test accounts, reversible tools, synthetic records, and non-production destinations. Keep real secrets and irreversible operations outside routine runs so a successful attack scenario cannot damage live systems.
How do I investigate a finding that appears nondeterministic?
Capture the scenario identity, execution trace, policy violation, and deterministic seed when available, then replay the case. Comparing repeated traces helps distinguish model variance from a persistent permission or orchestration flaw.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
