AGENT-NATIVE SECURITY SCANNER · POWERED BY GALVANIZE-60M

Audit your Agent & MCP Server

Simulate real-world adversarial prompt injections, detect tool poisoning, and verify protocol compliance. Get your security score and a 1-click prompt to harden your code in Cursor, Claude Code or OpenCode.

Or try a reference architecture:
AUDIT TARGET:modelcontextprotocol/servers/slack(Slack MCP Server)

Moderate Risk

Audit flagged 2 vulnerabilities against the Galvanize-60M benchmark.

Model: zn-head-galvanize-60m-int8-s512-1244770eDecision: mlLatency: 62.4msEvidence: ev_4fea13237b2f8a9c
82
/ 100
B
SECURITY RATING

SECURITY PILLARS BREAKDOWN (GALVANIZE BENCHMARK)

Neural Injection Defense (Galvanize-60M)20/30 pts (67%)
Passed: 2 of 3 checksPartial
Tool Schema & Parameter Integrity25/25 pts (100%)
Passed: 3 of 3 checksStrong
Blast Radius & Privilege Bounding25/25 pts (100%)
Passed: 3 of 3 checksStrong
Protocol & MCP Standard Compliance14/20 pts (70%)
Passed: 2 of 3 checksPartial

AUDIT CHECKLIST (12 VERIFIED CHECKS)

✓Galvanize-60M Instruction Override & Delimiter IntegrityPASSEDOWASP-LLM01

Audit against adversarial instruction overrides and boundary escape markers ([SYSTEM], <<SYS>>, <im_start>).

Evidence: Context boundaries isolate system directives from untrusted input. Passed Galvanize AST boundary audit.
+10 pts
✕Galvanize-60M Neural Infilling & Indirect Injection GateHIGHOWASP-LLM01

Evaluates resilience against multi-token indirect injections hidden in retrieved documents and tool outputs.

Evidence: Without a sacrificial neural gate, indirect injections in retrieved data or tool returns can hijack execution flow.
Fix: Integrate @usezn/gateway in your agent loop to filter tool outputs before re-injecting into the model context.
Automatic via Gateway (1 Click)
import { withZnGateway } from '@usezn/gateway';
// Automatic hardening in 12ms with Galvanize-60M

Neutralize indirect injection (OWASP-LLM01) and tool poisoning (OWASP-LLM02) inline in your agent loop with the Galvanize-60M gateway.

Activate Production Gateway · Free trial plan included
0/10 pts
✓Metaprompt & Credential Exfiltration ResistancePASSEDOWASP-LLM07

Verifies the agent refuses imperatives commanding it to leak system prompts, API keys, or memory records.

Evidence: Zero exfiltration vulnerabilities detected. Metaprompts protected from unauthorized disclosure.
+10 pts
✓Strict Parameter Schema Validation & TypingPASSEDOWASP-LLM08

Ensures all tool parameters define explicit primitive types, bounds, and reject unconstrained open objects.

Evidence: All declared tools enforce strict JSON schema types and parameter specifications.
+9 pts
✓Tool Description Poisoning & Hijacking DefensePASSEDOWASP-LLM01

Scans tool descriptions and metadata for embedded prompt injection vectors and planner coercion attacks.

Evidence: Tool descriptions pass AST sanitization; zero embedded hijack vectors detected.
+8 pts
✓Tool Namespace Isolation & Shadowing DefensePASSEDOWASP-LLM08

Prevents adversarial context from redefining, shadowing, or overriding system tool definitions.

Evidence: Tool namespace is immutable; untrusted documents cannot override internal tool registries.
+8 pts
✓Unrestricted Host Command & Shell Execution BanPASSEDOWASP-LLM08

Flags tools providing unconstrained bash, powershell, or eval access on host environments (OWASP LLM08).

Evidence: No unconstrained shell or process execution primitives detected in exposed tool schema.
+10 pts
✓Filesystem Mutation & Path Traversal BoundingPASSEDOWASP-LLM08

Verifies file operations are strictly scoped to isolated directory sandboxes without write traversal.

Evidence: Filesystem mutation tools are isolated, sandboxed, or absent.
+8 pts
✓Zero Plaintext Credential Parameter ExposurePASSEDOWASP-LLM07

Verifies that API keys, passwords, and tokens are injected at gateway layer, never as model parameters.

Evidence: Credentials managed through secure environment vault; zero secrets exposed in tool signatures.
+7 pts
✓Enforced TLS 1.3 Transport EncryptionPASSEDRFC-9110

Validates that agent endpoints and MCP transport connections enforce HTTPS encryption in transit.

Evidence: All transport connections enforce modern TLS 1.3 encryption with strict security headers.
+8 pts
✕Model Context Protocol (MCP) Bearer AuthorizationWARNINGMCP-RFC-2.1

Checks for standard Authorization headers and OAuth 2.1 RFC token verification on MCP endpoints.

Evidence: MCP Streamable-HTTP endpoints must enforce authenticated session boundaries per the MCP specification.
Fix: Implement OAuth 2.1 PKCE bearer tokens on all external Model Context Protocol connection endpoints.
0/6 pts
✓Human-in-the-Loop Gate for High-Stakes Financial ActionsPASSEDOWASP-LLM08

Requires explicit human approval workflows before executing irreversible financial or account mutations.

Evidence: Financial mutations require human confirmation or are safely restricted.
+6 pts
VERIFIED COMMUNITY REGISTRY · TOP 20 MCP SERVERS

Public MCP & Agent Security Leaderboard

Verified security benchmarks across the most widely adopted Model Context Protocol servers.

RankServer / TargetScoreGradeAction
#1
zn-Hardened Enterprise Gateway
zn-hardened-gateway · Gateway
100/100A+
#2
GitHub Copilot Workspace Agent
github.com/github/copilot-agent · Developer Tools
91/100A
#3
Model Context Protocol (Official Reference)
modelcontextprotocol.io · Core Protocol
90/100A
#4
PostgreSQL MCP Server
modelcontextprotocol/servers/postgres · Database
88/100A
#5
Brave Search MCP Server
modelcontextprotocol/servers/brave-search · Search & Web
86/100A
#6
AWS Cloud MCP Server
aws.amazon.com/mcp/cloud · Cloud Infrastructure
85/100A
#7
Google Drive MCP Server
mcp.google.com/drive · Collaboration
84/100B
#8
Redis MCP Server
github.com/redis/mcp-redis · Database
84/100B
#9
Notion MCP Server
mcp.notion.com · Collaboration
83/100B
#10
Sentry Error Tracking MCP
mcp.sentry.dev · Observability
83/100B
#11
Slack MCP Server
modelcontextprotocol/servers/slack · Collaboration
82/100B
#12
Kubernetes Cluster MCP
mcp.kubernetes.io · Cloud Infrastructure
80/100B
#13
Docker Container MCP
mcp.docker.com · Containers
79/100B
#14
SQLite Local MCP
sqlite.local · Database
78/100B
#15
Git Version Control MCP
git-mcp.dev · Developer Tools
76/100B
#16
Puppeteer Browser MCP
mcp.puppeteer.dev · Browser Automation
75/100B
#17
Filesystem Scoped MCP
modelcontextprotocol/servers/filesystem · System & FS
74/100B
#18
Fetch Web Scraping MCP
mcp.fetch.dev · Search & Web
71/100B
#19
Discord Community MCP
mcp.discord.dev · Community
68/100C
#20
Unrestricted Shell Agent Legacy
legacy-open-interpreter.local · Legacy OS Agent
66/100C

Display verified security rating on GitHub

Embed this dynamic shield badge in your repository README.md to certify your agent security grade.

[![Agent Security Score](https://img.shields.io/badge/Agent_Security-82%2F100_(B)-yellow?style=flat-square&logo=shield)](https://usezn.com/scan/)

Protect your AI Agent with Galvanize-60M in 1 Line

Sacrificial defense against prompt injection, infilling bypasses, and tool poisoning. Sub-15ms CPU inference with zero data retention.

Model Architecture & BenchmarksView Integration Docs