Manual MCP security audits take hours and miss configuration gaps. HackMyAgent runs 147 automated checks in seconds, catches what humans skip, and provides auto-remediation with rollback.
by OpenA2A
Automated security toolkit for AI agents. 147 checks across 30 categories including credential exposure, prompt injection, MCP server misconfigurations, and supply chain risks. Runs in seconds with auto-remediation and rollback.
Human-led review
A security engineer manually reviews configurations, code, and dependencies for vulnerabilities. Thoroughness depends on the reviewer's knowledge of AI-specific attack vectors, which is a new and rapidly evolving domain.
Manual audits depend on the reviewer knowing every attack vector. AI agent security is a new field — most security engineers haven't encountered MCP server poisoning, prompt injection via tool descriptions, or Claude Code hook exploitation. HackMyAgent encodes these attack patterns into automated checks.
| Feature | HackMyAgent | Manual Audit |
|---|---|---|
| Time to complete | Seconds | Hours to days |
| Security checks | 147 across 30 categories | Depends on reviewer |
| Attack payloads | 55 built-in | Requires custom scripts |
| Credential scanning | Automated (4 checks) | Manual file review |
| MCP server security | 10 dedicated checks | Often overlooked |
| Prompt injection testing | 4 checks + attack mode | Rarely tested |
| Claude Code configuration | 7 specific checks | Requires deep knowledge |
| Supply chain / dependencies | Automated (DEP category) | npm audit + manual review |
| Network security | 6 checks | Varies |
| Auto-remediation | With rollback | Manual fixes |
| OASB benchmark mapping | Built-in compliance | No standard benchmark |
| CVE detection | Automated (4 checks) | Depends on tooling |
| Repeatable | Every commit / CI | Point-in-time |
| Output formats | Text, JSON, SARIF, HTML | PDF report (custom) |
| Cost | Free (Apache-2.0) | $5K – $50K per engagement |
with HackMyAgent
with Manual Audit
One command covers 147 checks. Manual checklists cover what the reviewer remembers.
$ npx hackmyagent secure
HackMyAgent v0.7.2 - Security Toolkit for AI Agents
Scanning: /Users/dev/my-agent
[CRED] Credential Security 4/4 PASS
[MCP] MCP Server Security 8/10 WARN
MCP-003: Server has no TLS pinning
MCP-007: Tool description allows prompt injection
[CLAUDE] Claude Code Config 7/7 PASS
[NET] Network Security 5/6 WARN
NET-004: No egress filtering configured
[PROMPT] Prompt Injection 3/4 FAIL
PROMPT-002: System prompt extractable via reflection
Score: 82/100 | 2 warnings, 1 critical
Auto-fix available for 2 findings (--fix)# Manual MCP Security Audit Checklist
# Time estimate: 2-5 days
[ ] Review all .env files for exposed credentials
[ ] Check MCP server configurations
[ ] Test each tool description for injection vectors
[ ] Audit Claude Code settings.json
[ ] Review network egress rules
[ ] Check dependency versions for CVEs
[ ] Test prompt injection resistance
[ ] Verify sandbox configuration
[ ] Review file permission model
[ ] Check authentication mechanisms
[ ] Audit logging configuration
[ ] Test session management
[ ] Review rate limiting
[ ] Check API security headers
# ...27 more categories
# Common gaps in manual audits:
# - MCP tool description injection (new attack vector)
# - Claude Code hook exploitation
# - Gateway credential exposure
# - Missing OASB benchmark mapping147 checks. 55 attack payloads. Auto-remediation with rollback. Open source, Apache-2.0.
Apache-2.0 license — Scans Claude Code, Cursor, VS Code, and any MCP server