AI Agent Security Scanner
Foo Guard is an AI agent security scanner for configuration artifacts. Paste JSON or YAML, point the CLI at a directory, or let a Team GitHub App read the files at a commit SHA. The scan looks for exposed credentials, risky permissions, dangerous tool access, and unsafe autonomy before that configuration reaches production.
The scanner does not watch a live agent. It does not sit in the request path, and it does not decide whether a running tool call should proceed. It answers a narrower question: does this configuration, as written, violate the security policy you set?
What an agent security scan reviews
Foo Guard normalizes a configuration into an agent model and evaluates it with deterministic rules. Scores, severities, and pass or fail results come from that rules engine. Optional AI remediation can explain a fix afterward. It does not assign the score.
A scan can surface findings in these areas when the configuration declares them:
- Exposed credentials and secret-like material embedded in the file
- Client-side credentials, shared credentials, and credentials marked long-lived
- Wildcard, administrative, or production write permissions
- Tools that run shell commands, write the filesystem, write a database, or make arbitrary HTTP requests
- Destructive operations and self-modification without an approval requirement
- Missing identity, owner, or action attribution
- Excessive or unlimited autonomy, including missing human approval where the model requires it
- Compound risk, such as a tool that can both change resources and send data over the network
Rule documentation for the production checks lives in the rule reference. The engine does not infer a vulnerability from a product name alone. A finding cites the field it evaluated, such as arbitraryHttp or permissions[].wildcard.
Deterministic scanning, not a runtime monitor
Each rule is a function over the normalized model. The same configuration produces the same findings. That is what makes the result usable as a gate: a pull request and a later CI rerun are checking the same definition of pass and fail.
Foo Guard does not execute the agent, call its tools, or verify that an API key is still accepted by a vendor. Secret detection looks for credential material in the configuration. Saved analyses store a sanitized snapshot. Values that look like secrets are redacted before that snapshot is stored.
Where a scan can run
The browser analyzer on the homepage runs without an account. The result is not saved unless you sign in and choose to save it. A saved analysis keeps the sanitized configuration, the findings, and metadata such as score and grade.
- Web analyzer for a single JSON or YAML document
- Pro and Team CLI, which exits 1 when policy fails and 2 on an operational error
- GitHub Action that wraps the same CLI behavior in a workflow
- Team GitHub App, which publishes a Foo Guard Security check on pull requests and default-branch pushes
Policy is separate from the finding list. failOn chooses the severity that fails a scan. An optional minGrade fails the scan when the letter grade is too low. Organization policy, repository .fooguard.yml, and CLI flags combine, and the strictest threshold wins.
How to read the result
The numeric score is a risk score. Each finding adds weight by severity, and the total is capped at 100. A score of 100 is grade F, the worst letter, not a perfect mark. Grade A means the deductions stayed very small. Policy then decides whether that result is allowed to merge. A repository can fail a grade B scan when minGrade is A, and it can pass a scan that still has medium findings when failOn is high.
Open a finding and follow the evidence path back to the field. Remediation guidance on the finding is deterministic. If you ask for AI remediation, Foo Guard sends the sanitized configuration and the findings to the model and returns a suggestion. Saving that suggestion is a separate step. The original score does not change because a suggestion was generated.
Anonymous runs stay on the request that produced them. Saved history requires an account. Pro accounts and Team workspaces can create a public share link. That view omits the sanitized configuration and sensitive evidence.
What this scanner is not
Foo Guard does not replace a SIEM, an identity provider, or an endpoint agent. There is no SSO or SCIM connector, no IDE plugin, and no SARIF upload. It also does not schedule scans on a timer. GitHub scans run when a pull request or default-branch push includes supported configuration changes, and CI scans run when your pipeline invokes the CLI or Action.
If the configuration describes MCP tools, read the MCP security scanner page for what is and is not inspected. For the field model itself, see AI agent configuration security.