Agent Security Scanner — User Guide
What is Agent Security Scanner?
Agent Security Scanner analyzes a domain for AI agent security vulnerabilities. The tool scans client-side code for exposed API keys, checks TLS configuration, analyzes input validation against prompt injection, and evaluates network policy and sandbox isolation.
Inspired by NVIDIA NemoClaw's sandbox model, the tool generates a ready-to-use YAML security policy you can implement directly.
How to use the tool
1. Fill in the form
- Domain: The domain you want to scan (e.g. "example.com")
- Brand name (optional): Company name for more targeted analysis
2. Start the scan
Click "Start scan". The tool:
- Fetches client-side code from the domain
- Searches for 8+ patterns of exposed API keys (OpenAI, Anthropic, Google, AWS, Stripe, GitHub, Supabase, Azure)
- Verifies TLS/HTTPS configuration
- Analyzes whether direct AI API calls are made from client code
- Uses Gemini AI for deep analysis of input validation, rate limiting and sandbox isolation
- Generates a YAML security policy based on findings
The analysis typically takes 15–45 seconds.
3. Read the results
The report shows:
Security Score
- Score: 0–100 points with letter grade A–F
- Category scores: Separate scores for API keys, network, input validation, TLS, rate limiting and sandbox
Detailed Checks
For each security check:
- Status: Passed, Warning or Failed
- Severity: Critical, High, Medium or Low
- Description: What the check found
- Details: Concrete findings with context
Recommendations
Prioritized list of actions sorted by severity. Each action includes:
- What needs to be fixed
- Why it matters
- Suggested solution
YAML Policy
A ready-to-use declarative security policy you can copy. The policy defines:
- Allowed AI endpoints (egress rules)
- Input validation rules
- Rate limits per user type
- Sandbox isolation configuration
4. Copy and implement
Click "Copy policy" to copy the YAML policy to your clipboard. Implement it in your infrastructure as part of your AI agent security layer.
What is scanned?
| Category | Checks |
|---|---|
| API keys | OpenAI, Anthropic, Google AI, AWS, Stripe, GitHub, Supabase, Azure keys in client code |
| Network | Direct API calls to AI providers from client, missing proxy |
| Input validation | Prompt injection protection, input sanitization |
| TLS | HTTPS configuration, certificate status |
| Rate limiting | Rate limiting on API endpoints |
| Sandbox | Isolation between agent processes and the rest of the system |
Severity levels
- Critical: Immediate risk — e.g. exposed API keys in client code
- High: Serious risk — e.g. missing input validation
- Medium: Moderate risk — e.g. missing rate limiting
- Low: Improvement potential — e.g. missing sandbox isolation
Tips
- Run the scan after each deployment of AI agents
- Use the YAML policy as a starting point and customize for your infrastructure
- Combine with manual penetration tests for full coverage
- Always prioritize "Critical" and "High" findings first
Credits
The tool costs 15 credits per scan.
Technical Background
The tool combines regex-based code scanning for known key patterns with AI-powered analysis via Gemini for deeper security assessment. No active exploitation is performed — this is a passive analysis of publicly available code and configuration.
The inspiration comes from NVIDIA NemoClaw, a sandbox framework for AI agents that uses declarative YAML policies to control agent access to external resources.
Last updated 2026-03-18