agent-audit-kit

agent-audit-kit is an open-source static analysis tool built to audit AI agent pipelines that rely on the Model Context Protocol (MCP). It ships with 225 rules grouped into 11 categories and aligned with 12 compliance frameworks, directly addressing OWASP Agentic Top 10 and MCP Top 10 threats. The scanner can map public CVEs to checks, outputs results in SARIF format, and integrates seamlessly via a GitHub Action for CI/CD pipelines.

Strengths: Broad rule coverage that keeps pace with emerging agentic threats and regulatory needs. Being open-source, it is free to use and allows teams to extend or tailor the rule set to their own architectures.

Limitations and risks: The project is likely in an early stage, meaning documentation and community support may be sparse. Rule accuracy and false positives should be validated in real pipelines. Users need a working knowledge of AI agent security and MCP communication patterns.

Ideal for: Development and security teams building or auditing MCP-connected agents, compliance officers tracking OWASP standards. Less suitable for teams that do not use MCP or have no AI agent workflows.