Scope: what can your agents actually touch?
Score each AI agent, MCP server and OAuth connector's access as least-privilege, over-scoped or ungoverned, and roll the fleet up to GOVERNED / DRIFTING / EXPOSED.
An agent’s intelligence decides what it could do. Its authority decides what it may do. Authority has six layers: identity (who the agent is), intent (what the person actually approved), scope (what it can reach), containment (which actions may run unattended), transaction (whether it can finish a purchase with you), and outcome (whether the work it reports actually happened). The tools below grade four of them today: the agents and crawlers arriving at your site, what your own agents can reach, what they may do, and whether the work happened. Intent and transaction have no tool here yet. These are self-assessments you run on your own setup. They return a verdict and, where something is short, what to fix first.
Grade whether you can actually allow, throttle, or block the AI crawlers and scrapers hitting your site. Six weighted controls for a 0-100 score and READY / GAPS / EXPOSED, with an enforceability gate that reads EXPOSED when you can't enforce on non-compliant traffic and can't verify a real bot. Your marks, no baked-in benchmark. One .xlsx.
Your AEO can be perfect and the AI still can't read you. Grade whether each answer engine's crawler can fetch, render, and extract your money content — six access signals per engine (robots.txt, WAF/CDN, JS render, extractability, fetch health, log verification) → CRAWLABLE / PARTIALLY BLOCKED / INVISIBLE TO AI, with a worsen-only access gate (a robots.txt disallow or WAF block forces INVISIBLE regardless of score) and a site rollup naming the one engine + signal to unblock first where an engine is blocked. Knows the facts that trip people up (ChatGPT rides OAI-SearchBot not GPTBot; most AI crawlers run no JavaScript). The infrastructure gate under the AEO line. Runnable Python engine + workbook + 729-combo verifier + 2 playbooks. Deterministic, offline; grades access posture, not people.
Find out whether an AI shopping agent can machine-read, trust, and act on your product feed — before it skips you for a competitor with cleaner data. Scores each item on seven durable, protocol-agnostic signals and returns AGENT-READY / GAPS / UNREADABLE via the weakest signal, with two agent-distrust gates (a feed-vs-page contradiction, a missing identifier) that each force UNREADABLE, a catalog rollup with an exposure rate, and, where a signal is short, the fault to fix first. Grades durable feed readiness, not today's checkout protocol. Runnable engine + workbook + playbooks. Deterministic, offline, grades the feed not people.
Audit what your AI agents, MCP servers, and OAuth connectors can actually touch. Scores each connector's access risk — least-privilege, over-scoped, or ungoverned — and rolls the fleet up to GOVERNED / DRIFTING / EXPOSED, with a dispositive gate for an unowned connector that can write regulated data. Deterministic, offline, scores connectors not people.
Grade your non-human-identity governance — service accounts, API keys, tokens, OAuth apps, agent credentials — on the six controls that decide whether a leaked or orphaned secret becomes a breach. The verdict is the weakest control (GOVERNED / SPRAWLING / UNMANAGED, mean shown for context only), with a dispositive leaked-key gate that forces UNMANAGED when secrets are both un-vaulted and un-revocable — reachable and un-killable at once — so a class averaging 83% still reads UNMANAGED. Names the control to harden first where a control is short; rolls the org up to GOVERNED / SPRAWLING / UNMANAGED. Runnable Python engine + workbook + inventory & credential-hardening playbooks + a 5-class sample. The credentials layer beneath the Connector Access Auditor's reach layer. Grades the setup, never people. Not a scanner, vault, or discovery tool.
Before you install a third-party MCP server or agent skill, grade whether it should be trusted at all. Mark six trust signals (publisher provenance, change history, declared-vs-actual scope, credential handling, approval behavior, sandbox containment) — the verdict is the weakest signal, TRUSTED / REVIEW / DO NOT INSTALL — with a supply-chain gate that forces DO NOT INSTALL whenever credential handling AND approval behavior are both below full, the clean-then-poisoned pattern, even at 75/100. Names the signal to vet first where an artifact is short; rolls a registry up to GOVERNED / DRIFTING / EXPOSED. Runnable Python engine + workbook + vetting & trust-hardening playbooks + a 5-artifact sample. Grades the artifact, never people. Not a code scanner or malware detector.
Could a poisoned web page, email, ticket, or document quietly take over your AI agent? Grade an agent's exposure to indirect prompt injection on six design controls (weighted to a 0-100 score, CONTAINED / HARDEN / HIGH EXPOSURE) with a dispositive kill-chain gate that forces HIGH EXPOSURE when untrusted input can enter, an unscoped tool can act, and no human is in the loop to catch it, even at 72/100. Names the control to harden first where a control is short; rolls a fleet up to DEFENSIBLE / HARDENING / EXPOSED. Runnable Python engine + workbook + exposure-mapping & control-hardening playbooks + a 5-agent sample. Grades the agent's design, never people. Not a scanner or red-team.
Prompt injection ends; a poisoned memory doesn't. A pre-deployment probe for agent memory, RAG indexes, and context stores: mark six OWASP ASI06 lifecycle controls (write-path validation, trust-aware retrieval, provenance, scope isolation, decay/TTL, audit trail) for a weighted 0-100 score and CONTAINED / HARDEN / POROUS, with a two-condition kill-chain gate that forces POROUS when poison can be both written (weak validation) and recalled as ground truth (no trust check) — even at 78/100. Names the control to fix first where a control is short; rolls a fleet up. Runnable Python engine + workbook + exposure-audit & fix-the-control playbooks + a 7-store sample. The persistence layer beside the Prompt Injection Red Team Kit. Grades the architecture, never people. Not a scanner or attack simulator.
Four gates for the four attack surfaces of an AI agent: what you install (MCP/skill trust), what it reads (prompt injection), what it remembers (context poisoning), and what it can reach (non-human identity). Secure the agent before you ship it.
Check the actions your AI agent proposes against your own domain rules before any of them execute. Four constructs — functional, disjoint, range, one_of — return ADMISSIBLE / REVIEW / INADMISSIBLE per action and a batch verdict, with no admissibility score because a contradiction cannot be scored. Deterministic, offline Python engine + reproducing workbook; grades proposed actions, never people.
Grade whether an agent action is safe to run unattended, on two axes it prints separately: reversibility (can you undo it in time) and blast radius (how many records one call touches). Returns RUN UNATTENDED / RUN WITH APPROVAL / DO NOT AUTOMATE, and a typical count is never treated as a bound. Deterministic engine + workbook; grades the actions you describe, never people.
Grade whether every tool your AI agent can call has an input contract that could actually refuse a bad call. Each parameter reads TYPED / LOOSE / OPEN DOOR from its kind and its consequence — money needs a ceiling AND a cross-field rule, so a $10,000 cap that can't stop a $9,999 refund on a $12 order still reads OPEN DOOR. Deterministic engine + workbook; grades contracts, never people.
Before you flip an AI agent live, score its guardrails. Five operational controls — approval gate, logging, rollback, bounded scope, escalation — one verdict: READY / FIX / DO NOT DEPLOY. A destructive action with no human approval is a hard stop, no matter how high the rest scores. Deterministic, offline, runnable.
Evaluate AI agents at the trajectory level — tool choice, argument validity, step efficiency, cost, and policy — and gate CI on a ship / hold / fix verdict. Six deterministic evaluators, framework-agnostic, Python, zero dependencies. The fourth dev-tools gate: agent behavior.
An 8-step agent at 85% per step succeeds end-to-end just 27% of the time. Reveals each workflow's true compounded success rate, catches quiet drift (observed vs. the chain math), and verdicts every agent STABLE / SHORTEN / CHECKPOINT with a fleet drift rate. Deterministic, offline. One .xlsx.
