owasp-agentic

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable rules across 10 categories; merged into Microsoft AGT, Cisco AI Defense, MISP, OWASP, FINOS & SigmaHQ. MIT-licensed.

What can your AI agent do to the real world? Scan your code. See which tool calls have zero checks

What can your TypeScript AI agent do to the real world? Scan your code. See which tool calls have zero checks

Deterministic, policy-as-code authorization for what an AI agent is allowed to do. Every tool call checked before it runs, logged after. A runnable reference build, not output guardrails. https://demo.sarthak-gupta.com

Cryptographic trust mediation layer for AI agent frameworks. Apache 2.0 reference architecture composing device-attested admission, short-TTL scoped capabilities, runtime continuity envelopes, context provenance anchoring, agent intent binding, FHE context gate, MCP boundary mediation, signed policy bundles, and tamper-evident audit chain.

Maps an AI coding agent's actions — or a repository — to OWASP Agentic Top 10 and compliance framework controls, surfacing candidate findings with citations. Rust scanner + agent skill, SARIF output.

Making agentic AI transparent, auditable and controllable — one card at a time.

Vendor-neutral benchmark measuring how MCP security proxies/gateways DEFEND against 22+ attack vectors — crosswalked to NIST AI RMF & OWASP LLM/Agentic Top 10. CI-gated, reproducible, DOI-cited. Submit your tool to the leaderboard.

Security & assurance plane — red-teams any agent (OWASP Agentic + MITRE ATLAS), toxic-flow graph, SARIF output. Framework-neutral core (agent-assurance on npm).

Offline-verifiable Agent Assurance Evidence Object (AAEO) + deterministic policy gate for agentic AI: eval + security/red-team + governance in one signed, hash-chained, air-gap-verifiable record. Apache-2.0, offline.