headyzhang/Agent Audit
Security scanner for AI agents and MCP configurations. Detects vulnerabilities based on OWASP Agentic Top 10.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 3, 2026
- License
- MIT
Pinned Snippet
uses: headyzhang/agent-audit@c3e6ce6249b3755dbef01108dcda7d00325b1d84 # v0.19.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (default: current directory) | no | . |
| format | Output format: terminal, json, sarif, markdown | no | sarif |
| output | Output file path (required for sarif format) | no | agent-audit-results.sarif |
| severity | Minimum severity to report: info, low, medium, high, critical | no | low |
| fail-on | Exit with error if findings at this severity: low, medium, high, critical | no | high |
| baseline | Path to baseline file for incremental scanning | no | — |
| upload-sarif | Upload SARIF to GitHub Security tab (true/false) | no | true |
Outputs
| name | description |
|---|---|
| total_findings | Total number of security findings detected |
| critical_count | Number of CRITICAL severity findings (security-severity >= 9.0) |
| high_count | Number of HIGH severity findings (security-severity >= 7.0, < 9.0) |
| medium_count | Number of MEDIUM severity findings (security-severity >= 4.0, < 7.0) |
| low_count | Number of LOW severity findings (security-severity < 4.0) |
| scan_status | Scan status: success (exit code 0) or failure (findings exceed fail-on threshold) |
| sarif_file | Path to the generated SARIF file (if format=sarif) |
| findings-count | Total number of findings (deprecated: use total_findings) |
| exit-code | Exit code from scan (deprecated: use scan_status) |