What is AIM (Agent Identity Management)?

AIM is an open-source platform for securing AI agents and agentic AI. It provides identity management, MCP security, agent bill of materials (ABOM), trust scoring, supply chain protection, and comprehensive audit logging for AI agent deployments.

How do I secure my AI agents?

You can secure your AI agents with AIM using a single line of code: agent = secure('my-agent'). AIM automatically registers the agent, assigns a cryptographic identity (Ed25519), and begins monitoring for security threats. It works with LangChain, LangChain4j, CrewAI, and other frameworks.

What is MCP security?

MCP security refers to securing Model Context Protocol (MCP) servers that AI agents connect to. AIM provides MCP attestation, which creates cryptographic verification that ensures MCP servers are authentic and haven't been tampered with. It detects drift, unauthorized changes, and supply chain attacks.

What is an Agent Bill of Materials (ABOM)?

Agent Bill of Materials (ABOM) is a comprehensive inventory of all components in your AI agent ecosystem - similar to SBOM for software. AIM generates ABOMs that include all agents, MCP servers, capabilities, and their trust relationships, enabling supply chain security compliance and vulnerability tracking.

What is agentic AI security?

Agentic AI security focuses on protecting autonomous AI agents that can take actions, use tools, and interact with external systems. AIM provides identity management for agentic AI, including capability enforcement, trust scoring, Just-In-Time (JIT) access controls, and automated threat detection.

What frameworks does AIM support for AI agent security?

AIM supports popular AI agent frameworks including LangChain (Python), LangChain4j (Java), CrewAI, AutoGen, and any framework using MCP servers. Python SDK uses @perform_action decorators, while Java SDK uses @SecureAction annotations. Integration requires minimal code changes.

Yes, AIM is open source under the Apache-2.0 license. Organizations can self-host AIM or use AIM Cloud for managed infrastructure.

Part of the security infrastructure for AI agents

The AI agent you're supposed to break.

DVAA is an intentionally vulnerable platform for learning AI agent security, red teaming, and validating security tools. 21 agents across 3 protocol tiers, 12 vulnerability categories, and 22 capture the flag challenges. Run it locally. Break it. Then break it again.

$docker run -p 9000:9000 -p 7001-7023:7001-7023 opena2a/dvaa:0.9.3

Dashboard on :9000. Agents on :7001 to :7023. Full port map below.

View on GitHub Docker Hub Full documentation

A safe place to break things.

DVAA is the equivalent of DVWA for AI agents. A deliberately insecure platform for security professionals, researchers, and developers to practice attacking and defending AI agent systems in a safe, legal environment.

Practice attacks safely

Run prompt injection, jailbreak, and exfiltration techniques against intentionally weak agents. No production systems involved.

Validate security tools

Use DVAA as a known vulnerable target to verify HackMyAgent, OASB benchmark runners, and your own scanners produce expected findings.

Study defense in depth

Compare LegacyBot against SecureBot side by side to see which controls block which attack classes.

Capture flags

Work through 22 challenges across four difficulty levels. Each challenge has a specific objective, target agent, and flag to capture.

Attack classes mapped to OASB.

Eight of the 12 DVAA vulnerability categories, each cross referenced with the Open Agent Security Benchmark. The remaining four (memory injection, context overflow, tool registry poisoning, and tool MITM) are documented in the DVAA README. Use them as a study path or as a checklist when validating your own scanner.

Prompt Injection

OASB 3.1

Inject instructions into agent prompts to override behavior, extract system prompts, or bypass safety filters.

Jailbreak

OASB 3.3

Bypass alignment and safety constraints to make agents perform restricted actions or reveal hidden instructions.

Data Exfiltration

OASB 4.3

Extract sensitive data from agent memory, RAG stores, or connected databases through indirect channels.

Capability Abuse

OASB 2.2

Exploit legitimate agent capabilities beyond intended scope. File access, code execution, or API calls.

Context Manipulation

OASB 8.1

Poison or manipulate the context window to alter agent reasoning, inject false data, or cause hallucinations.

MCP Exploitation

OASB 2.3

Attack Model Context Protocol servers. Tool poisoning, schema injection, and cross server escalation.

A2A Attacks

OASB 1.4

Exploit agent to agent communication. Identity spoofing, message tampering, and delegation chain abuse.

Supply Chain

OASB 6.1

Compromise agent dependencies. Malicious tools, poisoned embeddings, and compromised model endpoints.

21 agents across the posture spectrum.

Start with LegacyBot at the Critical level to learn the basics. Work your way up to SecureBot at the Hardened level to see what proper input validation, output filtering, and capability boundaries actually buy you.

Agent	Port	Protocol	Posture	Description
SecureBot	`:7001`	API	Hardened	Reference implementation with a minimal attack surface.
HelperBot	`:7002`	API	Weak	Prompt injection, data leaks, context manipulation.
LegacyBot	`:7003`	API	Critical	All vulnerabilities enabled, credential leaks.
CodeBot	`:7004`	API	Vulnerable	Capability abuse, command injection.
RAGBot	`:7005`	API	Weak	RAG poisoning, document exfiltration.
VisionBot	`:7006`	API	Weak	Image based prompt injection.
MemoryBot	`:7007`	API	Vulnerable	Memory injection, cross session persistence.
LongwindBot	`:7008`	API	Weak	Context overflow, safety displacement.
RAGBot-AIM	`:7014`	API	AIM-protected	Same code as RAGBot, capability grant enforced by AIM.
ResearchBot	`:7015`	API	Weak	Web content prompt injection during research and browsing.
ResearchBot-AIM	`:7016`	API	AIM-protected	Same code as ResearchBot, outbound tool calls gated by AIM.
FlightBot	`:7017`	API	Weak	Indirect injection via web fetch, wallet exfiltration.
FlightBot-AIM	`:7018`	API	AIM-protected	Same code as FlightBot, egress gated by AIM capability grant.
RepoBot	`:7022`	API	Weak	Repo local agent config injection (AGENTS.md), credential exfiltration.
RepoBot-AIM	`:7023`	API	AIM-protected	Same code as RepoBot, shell, file, and egress gated by AIM capability grant.
ToolBot	`:7010`	MCP	Vulnerable	Path traversal, SSRF, command injection.
DataBot	`:7011`	MCP	Weak	SQL injection, data exposure.
PluginBot	`:7012`	MCP	Vulnerable	Tool registry poisoning, supply chain.
ProxyBot	`:7013`	MCP	Vulnerable	Tool MITM, no TLS pinning.
Orchestrator	`:7020`	A2A	Standard	A2A delegation abuse.
Worker	`:7021`	A2A	Weak	A2A command execution.

22 challenges. Four levels.

Each challenge ships with a specific objective, target agent, and flag to capture. Total available is 5,900 points across the full challenge set.

Beginner

3challenges

100 pts each

300 pts total

Intermediate

9challenges

200 to 250 pts each

2,050 pts total

Advanced

8challenges

300 to 350 pts each

2,550 pts total

Expert

2challenges

500 pts each

1,000 pts total

5,900 points total

22 challenges, one flag each

12 vulnerability categories

Three protocol tiers. Clear port ranges.

Agents are grouped into three protocol tiers, each on its own port range. The dashboard runs separately on port 9000 for orchestration and CTF tracking.

API Agents

:7001 to 7008

OpenAI API

SecureBot, HelperBot, LegacyBot, CodeBot, RAGBot, VisionBot, MemoryBot, LongwindBot

MCP Servers

:7010 to 7013

MCP JSON-RPC

ToolBot, DataBot, PluginBot, ProxyBot

AIM-protected, research, flight, and repo API Agents

:7014 to 7018, 7022 to 7023

OpenAI API

RAGBot-AIM, ResearchBot, ResearchBot-AIM, FlightBot, FlightBot-AIM, RepoBot, RepoBot-AIM

A2A Agents

:7020 to 7021

A2A Message

Orchestrator, Worker

Dashboard

:9000

HTTP

Web UI

Four ways to get running.

Pick whichever fits your workflow. Docker Hub is the fastest path. The Node.js path is best when you want to read the agent source while you attack it.

Docker Hub

Fastest path. No clone, no build.

$ docker run -p 9000:9000 \

-p 7001-7023:7001-7023 opena2a/dvaa:0.9.3

# Open the dashboard

$ open http://localhost:9000

Docker Compose

Reproducible local stack with one command.

$ git clone https://github.com/opena2a-org/damn-vulnerable-ai-agent.git

$ cd damn-vulnerable-ai-agent

$ docker compose up

# Open the dashboard

$ open http://localhost:9000

Node.js

Read the agent source while you attack.

$ git clone https://github.com/opena2a-org/damn-vulnerable-ai-agent.git

$ cd damn-vulnerable-ai-agent

$ npm start

# Probe LegacyBot with HackMyAgent

$ npx hackmyagent attack \

http://localhost:7003/v1/chat/completions \

--api-format openai

OpenA2A CLI

One verb. Pulls, maps ports, starts.

# Pulls image, maps ports, starts DVAA

$ opena2a train start

# Stop and clean up

$ opena2a train stop

Validate your security tools.

DVAA is the reference target the OpenA2A toolchain regression tests against. Use it to ground truth your own scanners. If a scanner gives LegacyBot a clean bill of health, the scanner is wrong.

Run HackMyAgent 0.32.0 against LegacyBot to confirm the 310 static checks, 29 NanoMind semantic checks, and 164 adversarial payloads fire as expected.
Use opena2a-cli 0.10.13 with benchmark to run the OASB suite against the full agent fleet.
Compare findings between SecureBot and LegacyBot to verify your scanner discriminates between hardened and vulnerable postures.
Treat any false negative on LegacyBot as a regression. Treat any false positive on SecureBot as a precision bug.

HackMyAgent

310 static checks across 69 categories, 29 NanoMind semantic checks across 7 analyzers, 164 adversarial payloads across 16 categories.

OASB Benchmark

222 standardized attack scenarios at three levels.

Agents

Vulnerability categories

CTF challenges

Protocols

Start breaking AI agents.

Pull the image. Open the dashboard. Pick a target. The whole stack runs locally with no signup, no account, and no telemetry.

$docker run -p 9000:9000 -p 7001-7023:7001-7023 opena2a/dvaa:0.9.3

Star on GitHub Docker Hub