What Your Own Agents Can Reach

Audit what your AI agents, MCP servers, and OAuth connectors can actually touch. Scores each connector's access risk — least-privilege, over-scoped, or ungoverned — and rolls the fleet up to GOVERNED / DRIFTING / EXPOSED, with a dispositive gate for an unowned connector that can write regulated data. Deterministic, offline, scores connectors not people.

Grade your non-human-identity governance — service accounts, API keys, tokens, OAuth apps, agent credentials — on the six controls that decide whether a leaked or orphaned secret becomes a breach. The verdict is the weakest control (GOVERNED / SPRAWLING / UNMANAGED, mean shown for context only), with a dispositive leaked-key gate that forces UNMANAGED when secrets are both un-vaulted and un-revocable — reachable and un-killable at once — so a class averaging 83% still reads UNMANAGED. Names the control to harden first where a control is short; rolls the org up to GOVERNED / SPRAWLING / UNMANAGED. Runnable Python engine + workbook + inventory & credential-hardening playbooks + a 5-class sample. The credentials layer beneath the Connector Access Auditor's reach layer. Grades the setup, never people. Not a scanner, vault, or discovery tool.

Before you install a third-party MCP server or agent skill, grade whether it should be trusted at all. Mark six trust signals (publisher provenance, change history, declared-vs-actual scope, credential handling, approval behavior, sandbox containment) — the verdict is the weakest signal, TRUSTED / REVIEW / DO NOT INSTALL — with a supply-chain gate that forces DO NOT INSTALL whenever credential handling AND approval behavior are both below full, the clean-then-poisoned pattern, even at 75/100. Names the signal to vet first where an artifact is short; rolls a registry up to GOVERNED / DRIFTING / EXPOSED. Runnable Python engine + workbook + vetting & trust-hardening playbooks + a 5-artifact sample. Grades the artifact, never people. Not a code scanner or malware detector.

Could a poisoned web page, email, ticket, or document quietly take over your AI agent? Grade an agent's exposure to indirect prompt injection on six design controls (weighted to a 0-100 score, CONTAINED / HARDEN / HIGH EXPOSURE) with a dispositive kill-chain gate that forces HIGH EXPOSURE when untrusted input can enter, an unscoped tool can act, and no human is in the loop to catch it, even at 72/100. Names the control to harden first where a control is short; rolls a fleet up to DEFENSIBLE / HARDENING / EXPOSED. Runnable Python engine + workbook + exposure-mapping & control-hardening playbooks + a 5-agent sample. Grades the agent's design, never people. Not a scanner or red-team.

Prompt injection ends; a poisoned memory doesn't. A pre-deployment probe for agent memory, RAG indexes, and context stores: mark six OWASP ASI06 lifecycle controls (write-path validation, trust-aware retrieval, provenance, scope isolation, decay/TTL, audit trail) for a weighted 0-100 score and CONTAINED / HARDEN / POROUS, with a two-condition kill-chain gate that forces POROUS when poison can be both written (weak validation) and recalled as ground truth (no trust check) — even at 78/100. Names the control to fix first where a control is short; rolls a fleet up. Runnable Python engine + workbook + exposure-audit & fix-the-control playbooks + a 7-store sample. The persistence layer beside the Prompt Injection Red Team Kit. Grades the architecture, never people. Not a scanner or attack simulator.

Four gates for the four attack surfaces of an AI agent: what you install (MCP/skill trust), what it reads (prompt injection), what it remembers (context poisoning), and what it can reach (non-human identity). Secure the agent before you ship it.