Scan your tool configuration for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks instruction files, settings, MCP servers, hooks, and agent definitions.
Audit your tool configuration for security issues using AgentShield.
| File | Checks |
|---|---|
Instruction file (AGENTS.md, CLAUDE.md, equivalent) | Hardcoded secrets, auto-run instructions, prompt injection patterns |
| Tool settings/config | Overly permissive allow lists, missing deny lists, dangerous bypass flags |
| MCP config | Risky MCP servers, hardcoded env secrets, npx supply chain risks |
| Hooks | Command injection via interpolation, data exfiltration, silent error suppression |
| Agent definitions | Unrestricted tool access, prompt injection surface, missing model specs |
AgentShield must be installed. Check and install if needed:
# Check if installed
npx MDT-agentshield --version
# Install globally (recommended)
npm install -g MDT-agentshield
# Or run directly via npx (no install needed)
npx MDT-agentshield scan .
Run against the current tool or project config directory:
# Scan current project
npx MDT-agentshield scan
# Scan a specific path
npx MDT-agentshield scan --path /path/to/tool-config
# Scan with minimum severity filter
npx MDT-agentshield scan --min-severity medium
# Terminal output (default) — colored report with grade
npx MDT-agentshield scan
# JSON — for CI/CD integration
npx MDT-agentshield scan --format json
# Markdown — for documentation
npx MDT-agentshield scan --format markdown
# HTML — self-contained dark-theme report
npx MDT-agentshield scan --format html > security-report.html
Apply safe fixes automatically (only fixes marked as auto-fixable):
npx MDT-agentshield scan --fix
This will:
Run the adversarial three-agent pipeline for deeper analysis:
# Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx MDT-agentshield scan --opus --stream
This runs:
Scaffold a new secure .claude/ configuration from scratch:
npx MDT-agentshield init
Creates:
settings.json with scoped permissions and deny listCLAUDE.md with security best practicesmcp.json placeholderAdd to your CI pipeline:
- uses: affaan-m/agentshield@v1
with:
path: '.'
min-severity: 'medium'
fail-on-findings: true
| Grade | Score | Meaning |
|---|---|---|
| A | 90-100 | Secure configuration |
| B | 75-89 | Minor issues |
| C | 60-74 | Needs attention |
| D | 40-59 | Significant risks |
| F | 0-39 | Critical vulnerabilities |
Bash(*) in the allow list (unrestricted shell access)${file} interpolation2>/dev/null, || true)npx -y auto-install in MCP server configs