Grey Panda

"Stop trying to build a model that cannot be fooled. Build the system around it, so that when the model is fooled — and it will be — nothing important breaks."

Grey Panda makes the secure path the easy path for anyone building LLM-powered, agentic, or Model Context Protocol (MCP) features — from a solo indie developer to an enterprise AppSec team.

⚡ Quick start

pip install grey-panda        # pure Python, zero dependencies
gp scan .                     # scan your repo — real findings, beautiful report

Add drop-in guardrails to an existing LLM call in under two minutes — you never rewrite the call, you wrap it:

from greypanda import PromptGuardrail, DLPScanner, OutputGuardrail

guard, dlp, out = PromptGuardrail(), DLPScanner(), OutputGuardrail()

safe   = guard.assert_safe(user_input)        # block known injection + strip invisible Unicode
clean  = dlp.redact(safe)                       # remove PII & secrets before the model sees them
reply  = call_your_llm(clean)                   # ← your existing call, unchanged
answer = out.sanitize(reply).sanitized_text     # XSS-safe by default (HTML-escapes model output)

Related MCP server: VSGuard MCP

🎯 Why this exists

Prompt injection is the #1 AI attack pattern and it needs no authentication (OWASP LLM01). Agentic systems can take an irreversible action from a single injected instruction. And MCP has opened a whole new surface — tool poisoning and rug pulls. Your existing AppSec tools don't see any of it.

🐼 The idea: one calm guardian

Grey Panda keeps two rare qualities as non-negotiable: intellectual honesty (a whole doc on what it can and cannot do) and standards-anchoring (every rule cites an OWASP ID). No neon-hacker theatre — just controls that are a joy to adopt.

📦 What's in the bundle

Five audience-facing module kits, all powered by one shared, zero-dependency engine:

⚙️ How it works

Defense in depth, not prevention theatre. Full walkthrough: HOW-TO-add-guardrails · architecture: docs/ARCHITECTURE.md.

🔐 Standards-anchored

Every rule, checklist item, and SDK control cites a specific ID. Explore any control from the CLI:

gp standards LLM01:2026      # explain a control + its Grey Panda fix
gp standards                 # list every standard and control ID

Full mapping tables: Module 5 → mappings/.

✅ Proof

See the before/after for yourself — the same app, insecure vs. rebuilt with Grey Panda controls:

gp scan examples/vulnerable_app --profile enterprise    # 🔴 findings
gp scan examples/secure_app     --profile enterprise    # ✅ clean

👥 For everyone

gp scan . --profile solo          # high-signal core, fail on CRITICAL
gp init  . --profile team         # scaffold config + GitHub Action + pre-commit
gp verify . --level 2             # AISVS Level 2 verification report

More: Module 1 → PROFILES.

🚀 Get started

pip install grey-panda           # from PyPI
pipx install grey-panda          # isolated CLI
uvx grey-panda scan .            # zero-install run

🚀 Use as a GitHub Action

Grey Panda ships as a composite GitHub Action — drop it into any workflow to gate pull requests on AI/agent/MCP findings, with SARIF rendered inline in the PR diff:

- uses: dibakshya01/grey-panda@v1
  with:
    path: .            # file or directory to scan
    profile: team      # solo | team | enterprise
    fail-on: HIGH      # CRITICAL | HIGH | MEDIUM | LOW
    format: sarif      # markdown | json | sarif
    output: grey-panda.sarif

Pair it with github/codeql-action/upload-sarif@v3 to surface findings in Security → Code scanning. All inputs are optional; the defaults above are the recommended CI baseline.

🤝 In your IDE

Grey Panda secures MCP — and ships as an MCP server, so Claude Code, Cursor, Windsurf, or VS Code can call it while you code. One command wires it into Claude Code:

claude mcp add grey-panda -- gp mcp

Cursor / Windsurf / VS Code use a tiny config file — see the how-to. The server is deterministic: the model in your IDE does the reasoning, Grey Panda hands back reproducible, OWASP-cited findings.

Then ask your assistant "review this file with grey panda", "are we AISVS Level 2 ready?", or "explain LLM01:2026". It exposes six tools — scan, review-snippet, verify, explain-risk, list-standards, checklist. Details: Module 1 → HOW-TO-use-in-your-ide and Module 4 → HOW-TO-run-the-mcp-server.

🧭 Honest about limits

Grey Panda is a strong floor, not a ceiling. Pattern matching cannot stop all prompt injection; regex DLP is language-specific; static analysis has false positives and negatives. We ship a whole document — with a confidence level and failure condition for every capability: WHAT_IT_CAN_AND_CANNOT_DO.md. Read it before you rely on the tool.

🌱 Contributing

Adding a scanner rule is editing one dataclass with a bad + good example — see CONTRIBUTING.md and Module 3 → HOW-TO-write-a-rule. Everyone is welcome under our Code of Conduct. Found a vulnerability in Grey Panda itself? See SECURITY.md.

Build from source:

git clone https://github.com/dibakshya01/grey-panda && cd grey-panda
pip install -e ".[dev]"
python -m unittest discover -s tests        # zero-dependency test suite
gp scan . --profile enterprise --fail-on HIGH   # Grey Panda scans itself, clean

📄 License

Apache-2.0. Standards cited are the property of their respective authors (see NOTICE). OWASP® is a registered trademark of the OWASP Foundation; Grey Panda is an independent, community project and is not affiliated with or endorsed by OWASP.