Single-prompt scanners miss the attacks that matter for agents — the ones composed across tools. AgenticAssurance (AAL) is the framework-neutral offensive core of the Agent Assurance Layer: you describe your agent in a capability manifest — its tools and their side-effect classes, data scopes, untrusted-ingress points and declared mitigations — plug in a runner adapter, and it attacks an isolated copy of the agent. It runs an attack library mapped to the OWASP Top 10 for Agentic Applications and MITRE ATLAS, builds a toxic-flow graph over declared tools to find lethal-trifecta and untrusted-content-to-code-execution paths, and catches execution-layer divergences where the agent refuses in text but a side-effecting tool still fires. Findings ship as SARIF 2.1.0 for code scanning plus a human-readable report, and a failing verdict exits non-zero — so red-teaming gates CI like any other test.
Offensive security for agents, built for CI — not a runtime guardrail, not a generic code scanner.
Attacks mapped to the OWASP Top 10 for Agentic Applications and MITRE ATLAS, run against an isolated copy of the target — never your live agent.
A graph over the agent's declared tools that surfaces lethal-trifecta and untrusted-content → code-execution composition paths that single-prompt scanners structurally cannot see.
Catches the most dangerous failure mode: the agent refuses in text while a side-effecting tool fires anyway — verified at the execution layer, with stability re-runs.
One JSON document declares the agent's tools and their side-effect classes, data scopes, untrusted-ingress points, identity and mitigations — the contract every attack and graph is derived from.
Findings emit as SARIF 2.1.0 for code-scanning dashboards plus a Markdown report, and a failing verdict exits with code 1 — red-teaming becomes a CI gate, not a yearly audit.
Every finding references its attack inputs by sha256 — reproducible evidence with no raw attack payloads written to disk.
To help you with any questions that are not listed here, we offer free, no-obligation consultations
No. It's pre-deployment offensive testing — a red team in your CI — not a runtime filter and not a generic code scanner. Runtime guardrails are a different layer; AAL tells you where you actually need them.
It's published on npm — npx agent-assurance scan your-manifest.json --sarif out.sarif — no install required. A bundled, deliberately vulnerable fixture agent lets you watch a full scan in one command.
MIT, on GitHub (Moai-Team-LLC/AgenticAssurance). Free to use, self-host and build on, including commercially.
The taxonomy, schema and toxic-flow graph cover the full OWASP ASI01–ASI10 range; the seed attack corpus currently exercises ASI01, ASI02, ASI03 and ASI05, and is growing.
It's the assurance plane: it red-teams any agent in the run → remember → measure → heal loop, whatever framework it's built on — and the whole AgenticProduct stack is designed to pass it.
More from our agentic practice — the standard we build to, the open-source layers that implement it, and the team that ships it.
Want to know how your agent holds up against the OWASP Agentic Top 10? Tell us about your product and we'll set up a red-team scan.