Is your AI agent open to strangers?

A security scanner for AI agents. It checks whether your MCP server or agent endpoint answers strangers with no login, whether AI or payment keys are visible in your site's code or public GitHub repo, and whether your agent config files have risky settings.

An MCP server gives an AI agent tools, such as reading files, sending email or querying a database. If it answers anyone who knows its address, strangers can list and use those tools too. Many servers are left open because the quick-start examples don't add a login.

No, they do different jobs. Antivirus checks the files on your computer for known viruses. These problems aren't viruses. They're settings on servers you run on the internet, such as an MCP server with no login, a chat page anyone can use, or an AI key sitting in public code. Nothing on your computer looks wrong, so antivirus has nothing to catch. Keep your antivirus, and check your agent's setup too.

You can ask any AI for advice, and it's often useful. But a chatbot reads your site the way a person reads a web page. We test it. Our scanner connects to your agent the way other software would, and checks whether your MCP server (the connection that lets your AI use tools) lets anyone in without a password. It also searches your site's code and your GitHub repo for leaked keys. We run the same checks the same way every time, so results don't depend on how you word the question. With daily monitoring, we compare each day's results with the day before and only email you when something new goes wrong. And we never ask for your keys, so there's nothing sensitive to paste anywhere.

Yes. The free scan only reads what any browser or GitHub visitor can already see. The two checks that talk to your agent send at most a handful of tiny requests, never call a tool, and only run after you prove you own it.

So nobody can use us to find holes in someone else's agent. You add a short token to your site or repo, which takes about a minute. We show the details of a problem only to the proven owner.

Every problem we found, exactly where it is (the URL, or the file and line), how serious it is, and a ready-to-paste prompt that fixes it in Claude Code, Cursor or Lovable.

No. Any key we find is masked before it's saved, so we only keep the first and last few characters. Scan results are deleted after 30 days.

No. A grade tells you how your agent did on our four checks on the day we ran them. We don't scan for viruses or every kind of bug, so no scanner, including ours, can promise code is completely safe. Daily monitoring re-runs the checks every day so you hear about new problems quickly.

Then you don't need to pay for anything. The free scan tells you how many problems there are before you decide.