Scan Agent2Agent (A2A) protocol implementation code for anti-patterns found in the reference SDKs and sample agents: an Agent Card fetching a client-supplied push-notification webhook URL with no host allowlist (SSRF), a request handler wired up with no authentication at all, and a literal credential embedded directly in Agent Card metadata (which is served publicly).

Scan a single file for A2A (Agent2Agent) protocol anti-patterns

Recursively scan a directory of A2A agent source for protocol anti-patterns

List every A2A (Agent2Agent) protocol pattern this auditor detects, grouped by category

Scan a Python snippet defining a multi-agent orchestration (LangGraph, CrewAI, or AutoGen/ag2) for excessive agency reachable through delegation or group membership — an agent with no dangerous tool of its own that can still reach one (shell/code-exec/file-write/network/credentials) through another agent it can hand off to.

Scan a single Python file for excessive-agency paths across LangGraph/CrewAI/AutoGen orchestration constructs

Recursively scan a directory of Python files and report excessive-agency paths found in each. Each file's agent/tool graph is analyzed independently — variable references don't resolve across files, so a Crew/GroupChat whose members are defined in a different file than the assembling call won't be connected.

List every dangerous-capability rule this auditor looks for at the end of a delegation path, grouped by category

Scan a text string or code snippet for insecure AI/LLM integration patterns (client-exposed keys, unsafe output handling, excessive agent tool permissions, PII sent to a model, prompt injection surface).

Scan a single file for insecure AI/LLM integration patterns

Recursively scan a directory for insecure AI/LLM integration patterns. Automatically skips node_modules, .git, dist, and binary files.

List all AI/LLM security patterns that the scanner can detect, grouped by category (including any custom rules loaded from .guardbee/rules)

Scan MCP server source for OWASP MCP08:2025 (Lack of Audit and Telemetry) gaps: tools registered with no audit trail, raw args/results logged, audit hard-disabled, silent catch blocks, audit events without a session/request id.

Scan a single file for OWASP MCP08 audit/telemetry gaps

Recursively scan a directory of MCP server source for OWASP MCP08 audit/telemetry gaps

List every OWASP MCP08 audit-gap check this auditor runs

Run a full compliance scan for a URL against a regulatory framework (KVKK, GDPR, or CCPA) using the GuardBee scanner. Returns a gap analysis and action plan.

Get compliance findings from a completed GuardBee scan, optionally filtered by severity

Fetch and analyze a privacy policy page for completeness against GDPR/KVKK requirements. Works without an API key.

List all compliance requirements for a framework with legal basis references

Compare KVKK, GDPR, and CCPA requirements side by side to understand overlaps and gaps

Scan agent/MCP source for OWASP MCP10:2025 context oversharing — full conversation dumps, unscoped memory tools, shared global session stores, system-prompt leaks via tools, cross-session tool-result bleed, and unfiltered vector queries.

Scan a single file for OWASP MCP10 context-oversharing issues

Recursively scan a directory for OWASP MCP10 context-oversharing issues

List every OWASP MCP10 context-oversharing check this auditor runs

Audit npm dependencies for known CVEs using the OSV database. Reads exact versions from package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock (v1 and berry) or bun.lock, falling back to package.json ranges

Audit Python dependencies for known CVEs using the OSV database. Reads exact versions from uv.lock, poetry.lock or Pipfile.lock, falling back to requirements.txt / pyproject.toml

Audit a single package by name, version, and ecosystem

Auto-detect and audit every supported project in a directory: npm (package-lock, pnpm, yarn, bun), Python (uv, Poetry, Pipenv, requirements), Rust (Cargo.lock), Go (go.mod), Ruby (Gemfile.lock) and PHP (composer.lock)

Enumerate all DNS records for a domain and detect misconfigurations: SPF, DMARC, DKIM key strength, MTA-STS/TLS-RPT, MX, DNSSEC (signed / broken / weak algorithms) and CAA (including whether it blocks the CA of the live certificate) and nameservers (lame delegation, anonymous zone transfer, open recursion)

Audit several domains at once (e.g. every brand or country domain) and compare them: an A–F grade per domain from all DNS, email, DNSSEC, CAA and nameserver checks, plus each domain's most serious findings

Find subdomains from Certificate Transparency logs and a common-name wordlist, and detect subdomain takeovers: CNAMEs to S3, GitHub Pages, Azure, Heroku, Netlify and other providers whose resource is gone (verified fingerprints), or to targets that no longer exist

Check specific hostnames (e.g. from your DNS zone or certificate logs) for subdomain takeover

Check a domain's email security: MX, SPF (nested lookup count), DMARC, DKIM key strength, MTA-STS and TLS-RPT, with remediation advice

Perform a targeted DNS lookup for specific record types on a domain

Find PII (TC Kimlik No, IBAN, card, passport, e-mail, phone, address…) and credentials inside a PDF, an image (screenshot, scanned page) or a text file on disk, before it is given to an LLM. PDFs are read from their text layer; images and scanned pages with OCR (Turkish and English).

Scan a document given as base64 (an attachment, an image a tool returned) for PII and credentials. The type is detected from the bytes.

List the PII and credential detectors this scanner runs

Scan MCP server source for elicitation anti-patterns from the 2026-07-28 spec: form mode requesting secrets or embedding a link, URL mode opened directly on a third-party authorize endpoint, credentials in the elicitation URL, a form answer used as the user's identity, and a result used without checking decline or cancel.

Scan a single file for elicitation anti-patterns

Recursively scan a directory of MCP server source for elicitation anti-patterns

List every elicitation check this auditor runs

Query rows from a database table with optional filters. All results pass through the KVKK/GDPR gateway — sensitive fields are automatically masked.

List all available database tables. Tables marked as 'deny' in gateway policy are omitted.

Get the column names and gateway masking policy for a table — helps the LLM understand what data it can access.

Query the gateway's own audit log — inspect which tools were called, on which tables, whether they were allowed or denied (and why), and which fields were redacted/written. Covers events since this server process started; count is capped by the gateway's audit.bufferSize (default 200).

Show the active gateway configuration: field masking rules, table policies, and audit settings.

List all red-team probes this tool can run against a target LLM/chatbot, grouped by category. Every probe is canary-based (safe) — none ask the target to produce genuinely harmful content.

Run canary-based red-team probes against a live LLM endpoint or chatbot you control, to test whether known jailbreak/extraction/obfuscation techniques bypass its guardrails. ONLY point this at an endpoint you own or are explicitly authorized to test — every probe consumes API quota on the target. Probes never request genuinely harmful content; success is measured by whether the target reproduces a random one-time token, proving an override instruction was obeyed.

Scan an MCP client config JSON string (Cursor mcp.json, Claude Desktop, Windsurf, or VS Code) for unpinned packages, secrets, wildcard auto-approve, unauthenticated remote endpoints, and typosquats.

Scan one MCP client config file, or a SKILL.md agent skill when the file has that name.

Scan one agent SKILL.md (YAML frontmatter plus body) for unrestricted allowed-tools, instruction override, credential file reads, and literal secrets. Name collisions across skills require a directory scan.

Find mcp.json, mcp_config.json, claude_desktop_config.json, and SKILL.md under a directory and audit each one. A directory scan also compares skill names. Does not start any MCP server.

Detect cross-server tool shadowing from an inventory of tool catalogs. Pass the tool names and descriptions already collected from each installed server. This tool does not connect to those servers.

OWASP MCP09:2025 — discover MCP client configs in well-known host paths (Cursor, Claude Desktop, Windsurf, VS Code, Claude Code) and flag servers that are not on an organization allowlist (Shadow MCP). Does not start any MCP server.

List the well-known MCP client config paths this auditor checks during shadow (MCP09) discovery on the current OS.

List the MCP config, agent skill, shadow-MCP discovery, and cross-server shadowing checks, with their OWASP MCP Top 10 tags.

Scan a text string or code snippet for insecure MCP server/tool-definition patterns (excessive-agency tool names, shell/eval/SQL/SSRF sinks fed by raw tool input, overly permissive schemas, hardcoded secrets, wildcard CORS).

Scan a single file for insecure MCP server/tool-definition patterns

Recursively scan an MCP server's codebase for insecure tool-definition patterns. Automatically skips node_modules, .git, dist, and binary files.

List all MCP server security patterns that the auditor can detect, grouped by category

Scan agent code for memory-poisoning risks: untrusted input written into persistent, cross-session memory (MemGPT-style archival/core memory, or a vector store used as a long-term knowledge base) without visible sanitization, and memory retrievals fed into a system/assistant-role message or prompt template as trusted context.

Scan a single file for memory-write and memory-readback poisoning patterns

Recursively scan a directory of agent source code for memory-poisoning patterns

List every memory-write and memory-readback pattern this scanner detects, grouped by category

Scan a single ML model file for supply-chain risks: dangerous Python globals reachable during pickle deserialization (os/subprocess/eval/socket/etc, including inside PyTorch's zip checkpoint container), a malformed or disguised .safetensors header, a Keras Lambda-layer RCE pattern in .h5/.keras files, or a path-traversal external_data reference in .onnx files.

Recursively scan a directory for ML model files (.pt, .pth, .ckpt, .pkl, .pickle, .bin, .safetensors, .h5, .hdf5, .keras, .onnx) and report supply-chain risks in each. Automatically skips node_modules, .git, venv, and other non-model directories.

List every dangerous Python global (module.function) this scanner treats as a red flag when found referenced inside a pickled model file, grouped by risk category

Scan an MCP server's authorization code for OAuth 2.1 anti-patterns named in the MCP spec's own Security Considerations: token passthrough (forwarding a client's token to a downstream API unchanged), missing audience validation on JWT verification, OAuth/OIDC discovery SSRF, missing PKCE, loose redirect_uri validation, and hardcoded client secrets.

Scan a single file for OAuth/token-handling anti-patterns

Recursively scan a directory of MCP server source for OAuth/token-handling anti-patterns

List every OAuth/token-handling pattern this auditor detects, grouped by category

Run a unified OWASP MCP Top 10 scan over a filesystem path — orchestrates secret, server, oauth, audit-gap, context-oversharing, toxic-flow, and tool-poisoning auditors; returns A–F grade.

Connect to a live MCP server (stdio or HTTP), call tools/list, then grade toxic-flow + tool-poisoning (MCP03/MCP10).

Audit a tools/list JSON dump for toxic flows and tool-description poisoning (MCP03/MCP10).

List OWASP MCP Top 10 categories and which GuardBee scanners cover them in this meta-scan

Scan a text string — a RAG chunk, a scraped web page, a document, a tool result — for indirect prompt injection payloads (instruction-override phrases, spoofed chat-template roles, hidden/invisible text, content addressing 'the AI' directly, data-exfiltration attempts) before it reaches a model's context.

Scan a single file (a knowledge-base document, an HTML page, extracted text) for indirect prompt injection payloads

Recursively scan a directory — e.g. a RAG knowledge base or a corpus of scraped pages — for indirect prompt injection payloads. Automatically skips node_modules, .git, dist, and binary files.

List all indirect prompt injection patterns that the scanner can detect, grouped by category

Scan a raw text string (e.g. a prompt you're about to send to an LLM) for leaked credentials (API keys, private keys, JWTs) and PII (TC Kimlik No, credit card, IBAN, email, phone) — checksum-validated where applicable to keep false positives low.

Scan an OpenAI/Anthropic-style chat request body (a JSON object with a messages array and/or a system field) for leaked credentials and PII in every message's text content, before it would be sent to the model.

Scan a single file — plain text, or a JSON chat-request-body fixture (auto-detected) — for leaked credentials and PII

Recursively scan a directory of prompt logs or request-body fixtures for leaked credentials and PII

List every credential/PII pattern this scanner detects, grouped by category

Connect to an MCP server (stdio command or Streamable HTTP URL), read its current tools/list response, and store it as the trusted baseline for future drift checks. Call this once, right after you've reviewed and approved a server's tools.

Connect to an MCP server and compare its current tools/list response against the stored baseline. A tool whose description, schema, or annotations changed since baseline is a 'rug pull' — approved once, silently different now. If no baseline exists yet, one is captured automatically (set autoBaseline=false to require an explicit baseline_server call first).

List every server this scanner has a stored baseline for

Scan a text string or code snippet for exposed secrets and API keys

Scan a single file for exposed secrets and API keys

Recursively scan a directory for exposed secrets and API keys. Automatically skips node_modules, .git, dist, and binary files.

Scan a git repository for secrets in what git says was added: the staged changes (before a commit) or every commit's added lines (history). History finds secrets that were deleted from the files but are still in the repository.

Scan the transcripts coding agents keep on this machine (Claude Code, Codex, Gemini CLI, Continue) for secrets that were pasted into a chat or printed by a command. Such a secret was already sent to the model provider and should be rotated. Each secret is reported once with how often it appears.

List all secret patterns that the scanner can detect

Check every dependency declared in a package.json (dependencies, devDependencies, peerDependencies, optionalDependencies) against the real npm registry -- flags any package name that doesn't exist at all (a likely LLM-hallucinated dependency an attacker may have pre-registered, i.e. 'slopsquatting'), and separately notes any that exist but were only first published very recently.

Check every dependency declared in requirements.txt or pyproject.toml against the real PyPI registry -- flags any package name that doesn't exist at all (a likely LLM-hallucinated dependency an attacker may have pre-registered), and separately notes any that exist but were only first published very recently.

Check a single package name against the real npm or PyPI registry

Auto-detect and check both npm and pip manifests (package.json, requirements.txt, pyproject.toml) in a directory against their real registries

Inspect TLS certificate, cipher suite, and protocol configuration for a single domain

Inspect TLS configuration for multiple domains in parallel

Check certificate expiry for one or more domains and highlight certificates expiring soon

Get detailed certificate information for a domain including fingerprint, SANs, and issuer chain

Evaluate free text against Agent Threat Rules (ATR) plus GuardBee KVKK/TR rules. Returns matches with follow-up scanner hints.

Read a local file and evaluate its contents against ATR + GuardBee rules

Evaluate a structured ATR AgentEvent JSON (type, content, fields, sessionId, …).

List loaded ATR + GuardBee detection rules (optionally filter by category or source).

Summarize loaded rule counts by category and source (ATR vs GuardBee)

Explain how Agent Threat Rules (ATR) complements GuardBee static MCP auditors

Show how GuardBee's runtime findings map to OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS — the mapping guardbee-proxy report uses

Scan MCP server source for tool poisoning (hidden instructions embedded in a tool's description string, read by the calling LLM as trusted context) and confused-deputy tools (a name/description promising read-only behavior while the handler has a shell/eval/file-write/env-dump sink).

Scan a single file for tool-poisoning and confused-deputy patterns in MCP tool registrations

Recursively scan a directory of MCP server source for tool-poisoning and confused-deputy patterns

List every description-injection phrase and confused-deputy sink rule this scanner detects

Audit a tools/list-shaped JSON catalog for the lethal trifecta (toxic flow): untrusted content + sensitive/private data + exfiltration or destruction on the same MCP server. Returns an A–F grade.

Scan TypeScript/JavaScript MCP server source for .tool(...) registrations and audit them for toxic flows

Scan a single source file for toxic flows

Recursively scan a directory of MCP server source for toxic flows across all registered tools

Explain the lethal trifecta / toxic-flow model this auditor uses

Scan LLM/agent application code for Unbounded Consumption ("denial of wallet") anti-patterns from OWASP LLM Top 10 2026's #6 category: LLM calls with no output token limit, hand-rolled HTTP calls to an LLM endpoint with no timeout, agent tool-calling or retry loops with no iteration cap, framework safety limits (LangChain max_iterations, openai-agents max_turns) explicitly disabled, and MCP tool handlers that make billable calls with no visible rate limiting.

Scan a single file for Unbounded Consumption / denial-of-wallet anti-patterns

Recursively scan a directory of LLM/agent application source for Unbounded Consumption / denial-of-wallet anti-patterns

List every Unbounded Consumption / denial-of-wallet pattern this auditor detects, grouped by category

Probe a vector-database (or vector-index-capable) endpoint for unauthenticated exposure — Weaviate, Qdrant, Chroma, Elasticsearch/OpenSearch (HTTP fingerprinting, escalating from instance info → collection/schema listing → actual stored data), Redis (RESP PING without AUTH), and Postgres/pgvector (wire-protocol SSLRequest + StartupMessage handshake, no real credentials sent). Read-only — never writes or authenticates with real credentials.

List the vector-store types this scanner can fingerprint, and what unauthenticated-access checks it runs for each

Start a GuardBee security scan on a URL. Returns a scan ID you can use to check status and get findings.

Get the current status and summary of a GuardBee scan by ID

List recent GuardBee scans in your workspace

Get vulnerability findings from a GuardBee scan with optional severity filter. Includes title, description, and remediation recommendation per finding.

Run a full GuardBee scan and immediately return all critical and high findings with remediation guidance. Best for quick security assessments.