Excessive permissions
Full filesystem access, administrator rights and write permissions where read access would suffice. Map each permission to a specific agent task.
AI AGENT SECURITY / MCP
AI security starts with access.
When an agent reads documents, calls APIs and runs tools, its answers are only part of the picture. What can it access, and what can it do without a human decision?
For teams connecting AI to software development, internal data and business workflows.
English interface · No registration
What to review before connecting production systems
Prompt injection
External documents, emails and tool results may contain instructions aimed at the agent. Separate data from commands, constrain actions and test scenarios in a controlled environment.
Data movement
Trace data from its source through models, tools and logs. Define what may leave your systems and which actions need approval.
MCP server trust
Review server origin, package version, transport and permissions. A server name or directory listing does not establish that it is safe.
Tool execution
Shell commands, downloaded executables and privileged containers increase the impact of mistakes. Restrict the execution environment and host access.
Authorisation and secrets
Review token audiences, API permissions and revocation. Never include production credentials in files submitted for review or website enquiry forms.
What the free scanner covers
MCP configuration
Static scanner
Cursor and VS Code MCP JSON/JSONC. Rules applied to recognised configuration fields.
Separately scoped assessment
Effective permissions, host settings and server behaviour.
Commands and permissions
Static scanner
Indicators of shell launch, privilege escalation, risky Docker options and broad access.
Separately scoped assessment
Actual process isolation and approval of sensitive actions.
Connections and secrets
Static scanner
Indicators of HTTP, disabled TLS verification and secret-like literals. Values are excluded from reports.
Separately scoped assessment
OAuth, API scopes, outbound traffic controls and token lifecycle.
Prompt injection and exfiltration
Static scanner
Risky settings can increase impact. The scanner cannot establish whether these vulnerabilities are present or absent.
Separately scoped assessment
External input scenarios, test records and data flow review.
Define an expert assessment
Context and boundaries
Agent workflow, data sources, integrations and system owners. Testing requires authorisation, a test environment and agreed constraints.
Checks and evidence
Identify configurations, permissions and scenarios. The proposal defines testing methods, permitted effects and evidence requirements.
Findings and remediation
Agree the report contents: areas reviewed, limitations, priorities and recommendations. Verification of fixes is scoped separately.
Share a brief, not credentials
Describe the agent's purpose, platform, agent count, data categories, connected systems and launch date. Do not send keys, passwords, production configurations or customer records. Scope, delivery feasibility and pricing are confirmed after discussion.
Discuss a projectAI SECURITY
Before you start
Does the scanner test a running agent?
No. It analyses recognised configuration fields. It does not connect to servers, execute tools or send prompts to a model.
Can it validate prompt injection protection?
A configuration file alone cannot establish resistance. This requires agreed tests of external inputs, tool permissions and agent actions in a controlled environment.
Is contact information required for a report?
No. The free scanner and report download require no registration. Requesting an assessment discussion is separate and optional.
SALEM AI / Project priorities
A project to discuss?
Describe your systems, scale and timeline. We will clarify the scope and what is needed for a proposal.