AI Agent Security Scanner
See what your AI agent setup exposes to the internet, from gateways and MCP endpoints to leaked keys, before someone else finds it.
Next you confirm you own the host, add your email and, if you like, your agent dashboard or MCP address. Open the full scan form.
- Passive & read-only
- No passwords, no logins
- Never runs your agent's tools
- Results in under a minute
AI agents now read inboxes, call APIs and run commands on your behalf. The computer they live on, and the keys they hold, become a prize. The Pro Logica AI agent security scanner looks at your own site and agent host from the outside, the way a stranger or a bot would, and reports what is reachable that shouldn't be. It is passive and read-only.
Why AI agents became an attack surface in 2026
OpenClaw instances exposed to the internet. 63% were vulnerable, and 12,812 could be taken over remotely.
of 7,973 live remote MCP servers exposed tools with no authentication.
MCP services reachable from the internet, including 687 offering system-control features such as command execution.
Most of these cases share one pattern: a dashboard or tool server meant for one person ends up on a public address with weak or no login. Hunt.io (Feb 3, 2026) found more than 17,500 exposed instances affected by CVE-2026-25253, which let anyone read the AI provider keys stored in the control panel.
What the AI agent security scanner looks for
Open agent dashboards
We fingerprint public control panels for self-hosted agents and report whether one loads without a login.
Open MCP endpoints
On an MCP address you give us, we ask the server to list its tools. If it answers without credentials, anyone can see those tools. We never run a tool.
Leaked AI keys
We search public pages and JavaScript for OpenAI, Anthropic, xAI, Google, GitHub, Slack, Telegram and Discord token patterns. Matches are masked and never stored in full.
Public config and debug files
Exposed .env files, Git folders and source maps.
Headers and HTTPS
CSP, HSTS, clickjacking protection and certificate health.
The full report includes evidence, why it matters, numbered fixes and a copy-paste prompt for your AI builder. Related: exposed API keys in front-end code and exposed .env files.
Self-hosted vs hosted agents: what can be scanned
| Agent type | Examples | Where it runs | What our scan can check |
|---|---|---|---|
| Self-hosted | OpenClaw, Hermes Agent, your own MCP servers, local model servers | A host you control | Open dashboards, open MCP tools, leaked keys, public config, headers |
| Hosted | Meta Muse, ChatGPT dots, Grok Bot, Manus | The vendor's cloud | Nothing on the vendor's side. We check what your site exposes. Use the checklist below for permissions. |
AI agent security risks to know
- Indirect prompt injection. Hidden instructions in an email or web page that the agent follows. Salt Security hijacked Manus with a single email (Oct 5, 2026).
- Poisoned add-ons. Trend Micro (Feb 23, 2026) found malicious OpenClaw skills installing a Mac password stealer.
- Leaked provider keys in control panels and front-end code.
- Too many permissions. An agent connected to email, payments and files can do everything a thief with those logins can.
Is it safe to give an AI agent access to your email?
It can be, if you limit what the agent can do and check what it did. Email holds password resets, invoices and client files, so a hijacked agent with inbox access is worse than a hijacked chatbot. Use this for Meta Muse, ChatGPT dots, Grok Bot, Manus or any hosted agent:
- 1Connect the fewest apps possible. Start with read-only access where the app offers it.
- 2Require approval before sending, paying or deleting. OpenAI and Meta both say you choose what the agent can do alone. Keep those prompts on.
- 3Use a separate inbox or account for agent work when you can.
- 4Never let the agent read or forward login codes or password-reset emails.
- 5Review connected apps monthly and revoke tokens you no longer use.
- 6Check training and privacy settings. Muse users must opt out of training use, per CNBC (Sep 8, 2026).
MCP server security, in plain terms
An MCP server gives an AI agent tools: query a database, read files, run a command. The protocol doesn't force a login, so a public address often answers anyone. Guard0's passive sweep (July 2026) found 53% of registry MCP servers answered an unauthenticated request. Fix: bind local servers to localhost, put remote ones behind OAuth or a gateway, allow-list the IPs that need access, and never return secrets in tool output.
Hermes Agent security
Hermes Agent from Nous Research has 44 published vulnerabilities in 2026 (NVD, as of Oct 20, 2026), including CVE-2026-71963 (Sep 3, 2026), where a malicious repository could run commands and expose provider API keys. Keep the dashboard off the public internet, update to the latest release (v0.21.6 notes cover dashboard login fixes), and only open repositories you trust.
Sample report
Standard report format from a real, anonymized scan. Agent findings appear in the same cards.
From free check to ongoing protection
- Free scan. Paste your URL and get a score and your top finding in under a minute. Run free agent check
- Unlock full report. Every finding with masked evidence, impact, numbered fixes, AI fix prompts and a PDF.
- App Guard early access. Ongoing re-checks that alert you when something new becomes exposed. Join App Guard early access
Questions people ask
Is the AI agent security scanner safe to run?
Yes. It sends ordinary requests to the site you own and confirm, at a limited rate. It never logs in, never sends attack payloads, never runs MCP tools and never reads stored credentials.
Do you need my agent's password or API key?
No. We only look at what is already public. If we find a key, we show a masked version so you can rotate it.
Is OpenClaw safe?
It can be, but many installs were not. Researchers found tens of thousands of instances open to the internet in 2026, and several serious flaws were patched, including four fixed on Apr 23, 2026 (Cyera, May 15, 2026). Keep it updated, keep the gateway private, require a login and install only skills you trust.
Can you scan Meta Muse, ChatGPT dots or Grok Bot?
Those run on the vendor's cloud, so there is nothing of yours there to scan. We check your own site and endpoints, and the checklist above covers permissions.
What is an exposed MCP server?
An MCP server that answers a tool-list request from anyone on the internet, without a token or login.
How often should I re-check?
After every new agent, add-on or deploy, and at least monthly. App Guard early access automates this.
Methods and limits
- Passive and owner-only. We scan only the domain you enter and confirm you own or are authorized to test, plus its
wwwand any agent or MCP address you list on that same domain. - Read-only. Plain page requests and, for MCP, only the
initializeandtools/listdiscovery messages. We never run an MCP tool. - No credentials. We never log in, guess passwords or call endpoints that return stored keys or configuration.
- Capped. About 40 requests, a 45-second limit and spacing between requests. Secrets are stored only in masked form.
- Not a penetration test. We cannot test prompt injection, installed skills, anything behind a login, or what a hosted agent has been allowed to do.
Related guides
- AI App Security Check
- Exposed API key in front-end code
- Exposed .env file
- Source maps exposed in production
- Missing security headers
By Pro Logica · Last reviewed Oct 20, 2026