Skip to content
BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

183 Commits
.clusterfuzzlite
.clusterfuzzlite
 
 
.devcontainer
.devcontainer
 
 
.github
.github
 
 
docs
docs
 
 
examples
examples
 
 
fuzz
fuzz
 
 
requirements
requirements
 
 
schemas
schemas
 
 
src/agentic_security_harness
src/agentic_security_harness
 
 
tests
tests
 
 
tools
tools
 
 
.dockerignore
.dockerignore
 
 
.env.example
.env.example
 
 
.gitattributes
.gitattributes
 
 
.gitignore
.gitignore
 
 
.gitleaksignore
.gitleaksignore
 
 
AGENTS.md
AGENTS.md
 
 
CHANGELOG.md
CHANGELOG.md
 
 
CITATION.cff
CITATION.cff
 
 
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
Dockerfile
Dockerfile
 
 
GOVERNANCE.md
GOVERNANCE.md
 
 
LICENSE
LICENSE
 
 
MAINTAINERS.md
MAINTAINERS.md
 
 
NOTICE
NOTICE
 
 
README.md
README.md
 
 
SECURITY.md
SECURITY.md
 
 
SUPPORT.md
SUPPORT.md
 
 
pyproject.toml
pyproject.toml
 
 

Repository files navigation

Agentic Security Harness

OpenSSF Best Practices CI CodeQL Python License Status

Your AI coding agent reads untrusted repo text. Can it tell project data from instructions?

Agentic Security Harness gives you a local, reproducible way to test that boundary. The demo runs the same 24 synthetic patterns against a vulnerable demo agent and a protected version, then writes traces, scorecards, and a comparison report.

python -m pip install .
ash quickstart --out reports/quickstart

ash quickstart is the Linux-first, no-network first-user path. It checks the installed package and output location, compares the vulnerable and protected local demos on the same 24-pattern corpus, validates the generated evidence, and renders a self-contained HTML report. Ubuntu is the primary clean-install contour; Windows remains covered by the cross-platform test matrix.

Expected deterministic demo result:

Target Modeled findings Patterns passed
demo-agent 24 0
protected-demo-agent 0 24

Terminal comparison showing 24 findings reduced to 0

Rendered comparison report table

This is a deterministic synthetic benchmark, not a production safety certification or a claim that any deployed agent is secure. Start with the committed comparison artifact: examples/comparison-report/.

Active development is tracked as violation models, not prompt variants: docs/research-problem-map.md shows what is shipped, what is under evidence maintenance, and which boundary models are next.

Public security stack

Agentic Security Harness is the benchmark/evidence layer in a small public Agentic AI Security stack:

llm-safety-playbooks -> ai-agent-handoff -> agentic-transfer-verifier -> agentic-security-harness
  • llm-safety-playbooks captures practical boundary rules for everyday LLM and coding-agent work.
  • ai-agent-handoff stores agent task briefs, live state, and return blocks as reviewable files.
  • agentic-transfer-verifier checks provenance, trust, authority, approvals, and audit trails around handoffs.
  • agentic-security-harness measures modeled boundary failures with traces, scorecards, reports, and sanitized evidence.

These repositories are related, but not interchangeable. Prompts and playbooks do not replace runtime controls, handoff files are not a sandbox, and a clean benchmark run is not a production safety certification.

Portfolio-level documentation hierarchy and public/private storage rules are defined in the Documentation Contract. This repository remains the benchmark/evidence layer; repo-local docs define the ash CLI, artifacts, examples, and evidence boundaries.

The merged portfolio integration contract is intentionally authority-free:

The 24 seed patterns below remain the deterministic baseline corpus. The 127 units are a larger provisional builder inventory, not 127 canonical attacks, not a repository-wide total, and not independent effectiveness evidence. The merged integration contract has no allow receipt, executor, provider, device, deployment, or production authority.

OWASP LLM 2025 quick map:

OWASP risk Harness coverage
LLM01 Prompt Injection Indirect instructions in repo/tool/perception text treated as data, not authority.
LLM02 Sensitive Information Disclosure Data labels, forwarding limits, recipient boundaries, and cross-user memory scope.
LLM04 Data and Model Poisoning Memory poisoning and untrusted persistent context governance.
LLM06 Excessive Agency Tool permission, MCP schema, delegation, approval, and ambient-authority checks.
LLM07 System Prompt Leakage Not claimed as a protected boundary; documented as a non-primary control surface.
LLM08 Vector and Embedding Weaknesses RAG-like untrusted retrieval boundaries; not a vector-store security claim.

Full conservative mapping: docs/standards-mapping.md.

Agentic Security Harness is a trace-first benchmark for defensive testing of agentic AI boundary failures. It gives security engineers, AI platform teams, and researchers a safe way to reproduce synthetic agent failures, compare vulnerable and protected targets, and inspect the evidence as traces, scorecards, remediation, static reports, and sanitized campaign artifacts.

In plain English: this repo answers three practical questions.

  1. Can an agent-like system preserve data labels, authority limits, memory provenance, approval context, audit trails, and tool boundaries?
  2. If it fails, can the failure be shown as a replayable trace instead of a prompt anecdote?
  3. If a protected version passes, can the before/after improvement be validated from committed artifacts?

Evidence snapshot

Status: public research release. This is a working defensive benchmark, not a production certification system, model leaderboard, CVE claim, or proof that any deployed agent is secure.

Tracks below are either deterministic artifact checks or sanitized local-model evidence-quality snapshots. None are certification, vendor benchmark, CVE, or production-safety claims. The private/public split for local empirical evidence is defined in docs/private-public-evidence-boundary.md. The distinction between executable specifications, local empirical observations, and independently labeled evaluations is defined in docs/evidence-classes.md. That local evidence rule narrows, but does not weaken, the portfolio Documentation Contract.

Evidence track Current public result Inspect
Deterministic corpus 24 synthetic boundary patterns; deterministic conformance evidence, not independent attack measurement docs/corpus.md
Baseline vs protected replay 24 modeled findings -> 0 modeled findings; evaluator-coupled synthetic replay examples/comparison-report/
Bounded local swarm 15 modeled swarm failures accepted by naive mode, 0 by bounded mode; rule-derived control attribution examples/local-swarm-report/
Attack variation matrix 43 rows, 9 families, 10 executable deep probes, bounded failures 0 examples/local-swarm-attack-matrix/
Evidence executable specification 24 scenario-author-labelled cases / 72 rule-derived observations; bounded declared-safe block consistency 0% examples/evidence-campaign-sanitized/
Synthetic secret-egress campaign 4 topologies / 23 observations; naive leaks 4/4, bounded leaks 0/4 examples/secret-leak-campaign-sanitized/
Semantic drift probes Legacy schema-0.1 structural summary: 80 declared detector rows, drift detections 13, canary leaks 4, verifier blocks 15; current schema 0.2 has no committed execution examples/semantic-drift-sanitized/
Semantic propagation defense Legacy schema-0.2 rows: 8 declared worker-to-chief observations; separately, deterministic rows record 6 controls, bounded acceptances 0, and 20 rule-derived ablation acceptances examples/semantic-propagation-sanitized/ / model
Local swarm defense contour 4 failure families, 15 combination topologies; bounded acceptances 0, naive acceptances 15 examples/swarm-defense-contour-sanitized/ / model
Historical loopback-endpoint mini-swarm campaign Pre-0.5 examples retained as structural historical evidence; canary-zero and causal-reopening claims are withdrawn, and the current contract has no committed execution examples/swarm-defense-live-sanitized/ / model
Marketing web-injection swarm controlled offline web-like corpus; naive leaks 5/5, bounded leaks 0/5, ablation leaks 21/21, benign runs 5/5 allowed examples/marketing-web-injection-sanitized/ / model
Historical loopback-endpoint marketing web-injection Schema-0.2 owned-local-page observations; rule-derived verifier/ablation behavior, while current schema 0.3 remains unexecuted examples/marketing-web-live-sanitized/ / model
Swarm resilience/stability model 7 degradation families / 46 observations; naive unsafe 7, bounded unsafe 0, ablation unsafe 18, benign false blocks 0 examples/swarm-resilience-sanitized/ / model
Context consent boundary 5 consent-boundary cases / 45 deterministic rows; naive risky-action acceptances 5, bounded acceptances 0, ablation acceptances 18, benign false blocks 0 examples/context-consent-sanitized/ / model
Tool-output authority boundary 6 tool-output authority cases / 66 deterministic rows; naive risky-action acceptances 6, bounded acceptances 0, ablation acceptances 23, benign false blocks 0 examples/tool-authority-sanitized/ / model
RAG context authority boundary 7 retrieved-context propagation cases / 91 deterministic rows; naive unsafe-chain acceptances 7, bounded acceptances 0, ablation acceptances 30, benign false blocks 0 examples/rag-context-sanitized/ / model
Planner task authority boundary 7 planner/task-decomposition cases / 91 deterministic rows; naive unsafe-chain acceptances 7, bounded acceptances 0, ablation acceptances 32, benign false blocks 0 examples/planner-task-sanitized/ / model
Memory rehydration authority boundary 7 cross-agent memory rehydration cases / 91 deterministic rows; naive unsafe-chain acceptances 7, bounded acceptances 0, ablation acceptances 32, benign false blocks 0 examples/memory-rehydration-sanitized/ / model

The deterministic rows measure declared synthetic situations. The local-model rows are sanitized evidence-quality snapshots. Public artifacts may expose model names, roles, observation counts, response hashes, aggregate labels, verifier attribution, and replay-ablation metrics; raw prompts, responses, canonical state hashes, and synthetic canaries stay private under .internal/.

External OpenAI-compatible runs are prompt-only self-report checks. A stable_pass there means repeated coherent structured answers to a synthetic safety-evaluation prompt; it is not an agent-host/tool-execution result or independently labelled evidence.

Visual evidence snapshot

Evidence flow

Quick demo

python -m pip install .
ash quickstart --out reports/quickstart

Expected output: 24 modeled findings -> 0, reports/quickstart/report.html, and validated JSON/Markdown evidence. The command is deterministic, local, and does not call a model or the network.

Expected public demo: the vulnerable demo-agent records 24 modeled findings; the protected-demo-agent records 0 modeled findings on the same corpus. The committed before/after example is examples/comparison-report/README.md.

If you only have one minute:

What this is / is not

This project is This project is not
A trace-first benchmark for defensive agentic AI boundary evaluation. A production safety certification.
A synthetic, authorized, reproducible test lab. A hacking manual or live exploitation toolkit.
A way to compare vulnerable vs protected local targets with portable artifacts. A claim that a real provider, model, or deployed agent is secure.
A research spine for local swarm, memory, authority, audit, and semantic-drift probes. A model leaderboard or CVE-grade vulnerability database.

Built-in/local targets are synthetic, deterministic, and offline. The experimental run-external --execute calls an OpenAI-compatible endpoint only on explicit opt-in (prompt-only, no tool execution); native provider and agent-host adapters are future. The benchmark focuses on agent operating-environment boundaries, not just standalone model answers. See docs/benchmark-semantics.md.

Read by role:

Do not read a clean run as "the system is secure." A clean run only means the target handled the modeled synthetic patterns under the declared run configuration.

Mission

Make agentic AI failure modes visible, reproducible, measurable, and teachable - a defensive education + measurement lab, not an offensive toolkit. Full mission: docs/mission.md.

Safe research rules

Authorized / mock / demo targets only - synthetic secrets only - no real exfiltration - deterministic tests - honest residual risk. Full rules: docs/research-rules.md.

How to read this repository

Status

Public research release. The harness runs a 24-pattern local corpus centered on agentic operating-environment boundary failures - data-boundary, authority, perception, memory governance, approval, and audit integrity - against deterministic local targets, with baseline-vs-protected replay (see What exists today). Cross-app contamination, real target adapters, live MCP adapters, richer live multi-agent tests, full multimodal adapters, and the reference gateway come later. See docs/roadmap.md.

status ci python license

What exists today

  • Pydantic v2 models - DataEnvelope (a policy label, not encryption), Finding, TraceStep, TargetDescriptor, ExploitTrace, DefensivePattern.
  • Twenty-four sanitized seed patterns - indirect prompt injection, data-boundary recipient confusion, memory poisoning, classification mutation, handoff label stripping, tool-permission abuse, provider-boundary leakage, missing-envelope recovery, sleeping-prompt delayed activation, audit spam-label abuse, budget loop abuse, capability delegation drift, mock tool-schema deception, audit hash-chain tampering, perception-boundary sensor-command confusion, ambient authority escalation, approval laundering, and memory governance.
  • Deterministic mock target - vulnerable-by-design demo target; no LLM, no network.
  • Local demo agent (demo-agent) - a deterministic, synthetic agent (in-memory memory, mock tool calls, data-envelope propagation, recipient-control checks); intentionally vulnerable for the seed patterns. No network, no LLM.
  • Protected demo agent (protected-demo-agent) - the same agent with simple deterministic controls authored in the same repository with knowledge of the public corpus and evaluator; records 0 modeled findings on that 24-pattern synthetic corpus. ash compare reproduces the fixture-defined difference; it is not an independent estimate of real-world effectiveness.
  • Runner - pattern -> target -> trace (mock or demo-agent).
  • Scorecard - a deterministic aggregate derived from traces.
  • Demo CLI (ash) - ash run --target {mock,demo-agent,protected-demo-agent}, ash compare --baseline ... --protected ..., and ash validate <path> write/validate deterministic reports (see Quickstart). Committed examples under examples/.
  • Adapter registry - ash targets lists built-in targets; ash scenarios lists scenario families with variant counts. Target lookup is centralized through make_target().
  • Scenario matrix - ash run-matrix --target <target> --scenario <scenario> runs multiple safe variants for a scenario, aggregates results, and produces stability analysis (matrix.json + matrix.md). Variants test different benchmark conditions (step depth, memory mode, tool mode, etc.) against the same pattern subset.
  • External adapter (experimental) - ash run-external --adapter openai-compatible --base-url URL --model MODEL --scenario SCENARIO evaluates an authorized OpenAI-compatible endpoint with safe synthetic prompts. Supports repeats, dry-run, and variant selection. Network calls require --execute. Variant knobs are passed to the external prompt as scenario context, but do not yet mutate the underlying pattern content; for the local run-matrix path they remain replay metadata only.
  • Toy adapters - toy-rag, toy-tools, and toy-multi-agent (plus the trivial pass-all toy-local-function): deterministic local stand-ins for agentic systems that exercise different surfaces (retrieval/memory, tool/authority, and coordinator/worker handoff) and so legitimately PASS some patterns and FAIL others. They show the harness can evaluate arbitrary systems, not only the demo agents. No network, no dependencies.
  • Static HTML reports - ash report --root <dir> renders a self-contained report.html (no JS, no CDN, no network) with an executive summary, severity distribution, pattern table, and a coverage heatmap for matrix runs. The source artifact tree must pass integrity validation before the HTML is written; behavioral expectation mismatches remain visible as non-clean results. JSON/Markdown remain authoritative.
  • Onboarding doctor - ash doctor [--json] [--live-local] checks the environment and prints next steps. Run history - ash list-runs reads the run_index.json manifest written by every run; ash stats summarizes run history; ash retention plans local report cleanup with dry-run by default.
  • Run and model comparisons - ash diff-runs compares two validated, manifested run directories of the same kind and emits source-manifest commitments plus a content-bound diff bundle; ash compare-models is the external-run-only wrapper for comparing two recorded model/runtime checks without making provider calls.
  • Validation (ash validate examples/) - checks committed benchmark artifacts (traces, scorecards, summaries, comparison, external-run reports, and run manifests), corpus and standards-mapping consistency, and scans for forbidden markers. Current-schema outputs receive their declared semantic and content-integrity checks; accepted legacy examples are explicitly structural snapshots and are not equivalent to current, private-evidence-reconciled executions.
  • Unit tests - models, runner, scorecard, reporting, validation, CLI, HTML report, doctor, toy adapters, and standards mapping.

No gateway, real payloads, or implicit provider calls. External model/runtime calls exist only in the experimental run-external path and require an explicit command.

Project tracks

This repository ships the benchmark/evidence side of the work today: synthetic targets, traces, scorecards, validators, and sanitized public evidence for agentic boundary failures.

A related but separate future track is an internal LLM Safety Gateway / Runtime Verifier: an organizational control layer for observing LLM traffic, tool calls, provenance, consent boundaries, and privacy-preserving evidence. It is not shipped behavior in this release, and should not be described as a production gateway. See docs/project-tracks.md. The sanitized R5 sealed synthetic result is public and validator-backed: one frozen common-control run reached terminal scientific FAIL; independence, promotion, production protection, and operational authority are not claimed.

Current vs planned

Area Current release Planned / future track
Benchmark 24-pattern deterministic local corpus, traces, scorecards, validation. Larger corpus via invariant-based expansion, mappings, report quality.
Targets mock, demo-agent, protected-demo-agent, toy-local-function, toy-rag, toy-tools, toy-multi-agent, plus experimental OpenAI-compatible external model checks. Native provider adapters and agent-host / tool-use adapters.
Runtime CLI-only (run, compare, validate, targets, scenarios, run-matrix, run-external, external-check, external-presets, diff-runs, compare-models, list-runs, index-runs, stats, retention, report, doctor). Optional HTTP reference gateway and a web report viewer after the benchmark stabilizes.
Network / providers Off by default; run-external makes OpenAI-compatible calls only with --execute. More provider presets, config files, and verified local-runtime guides.
Storage Local report files and committed examples. Optional persistent trace store after v1.0.

Verify locally

pip install -e ".[dev]"
python -m pytest
python -m ruff check .
python -m mypy src tests tools
ash validate examples/        # validate committed benchmark artifacts

Core capabilities

  • Portable defensive traces - machine-readable, replayable records of a test run.
  • Agentic operating-environment boundary testing - verifies whether data envelopes, authority scopes, perception trust boundaries, memory governance, approval context, and audit integrity survive agent handoffs, memory writes, tool calls, and provider routing.
  • Label-propagation measurement - a conformance-oriented view of whether data-envelope fields survive known handoff, memory, tool, and provider-boundary failure shapes.
  • Practical attack graph - target -> exposed inputs -> agents -> tools -> permissions -> memory -> external data -> attack chain -> observed behavior -> finding -> mitigation.
  • Reproducible cross-target comparison - replay the same traces against different targets / defenses.
  • Authority and schema-boundary checks - synthetic capability delegation and mock tool-schema provenance tests for the tools / permissions layer of the graph.
  • Perception-boundary checks - synthetic OCR / ASR / HTML transcript fixtures test whether observed content is treated as authority. Full multimodal adapters are planned.
  • Cross-app and multi-agent contamination - current local coverage includes a toy coordinator/worker handoff for label stripping and capability drift; richer live cross-app / multi-agent workflows remain planned.
  • Scorecard from traces - a derived, deterministic aggregate.
  • Reference gateway (planned) - an optional defense target design for future replay.

Full design: docs/harness.md (flagship document).

What it helps you test

Agentic failure modes, as sanitized defensive test patterns: indirect prompt injection via tool output - data-boundary / recipient-control failures - memory poisoning and memory-governance failures - tool-permission abuse - provider-boundary leakage - delayed stored-content activation - audit suppression and audit tampering - budget / loop abuse - capability delegation drift - mock MCP / tool-schema deception - perception-boundary confusion - ambient authority use - approval-context laundering.

Twenty-four local seed patterns are implemented today across data-boundary, instruction integrity, provenance, tool/permission, provider-boundary, delayed activation, audit, budget, capability, perception, ambient authority, approval, memory-governance, and multi-turn escalation families. The exact current corpus is the machine-readable source of truth in corpus.py and the reviewer-facing table in corpus.md. Future families are on the roadmap.

Reference defense (planned optional component)

The repository's original component is an OpenAI-compatible gateway - now positioned as a planned reference defense implementation and a future defense target for replay. It is not shipped in the current release; the current release is CLI-only. When implemented in the request path, it is expected to produce one of five decisions:

Status Meaning
ALLOW Clean; forward unchanged.
WARN Forward, but annotate / flag for review.
REDACT Mask PII/secrets and forward the sanitized version.
QUARANTINE Hold; return a quarantine_id; await approve/reject (async).
BLOCK Reject; return a provider-shaped error.

See docs/architecture.md and the planned reference-gateway API design.

Quickstart - one-command demo

pip install -e .

# simple deterministic mock target
ash run --target mock --out reports/demo

# local demo agent: synthetic, closer to real agent mechanics
ash run --target demo-agent --out reports/demo-agent

# protected variant: same agent with simple deterministic controls
ash run --target protected-demo-agent --out reports/protected-demo-agent

# list registered targets and scenario families
ash targets
ash scenarios --verbose

# run a scenario matrix (multiple variants, aggregated results)
ash run-matrix --target demo-agent --scenario data-boundary --out reports/matrix-demo

# limit variants or run a specific one
ash run-matrix --target mock --scenario all --max-variants 2 --out reports/matrix-small
ash run-matrix --target mock --scenario all --variant baseline-all --out reports/matrix-one

# validate the committed benchmark artifacts (or your own runs)
ash validate examples/

# external adapter: test an authorized OpenAI-compatible endpoint
# (dry-run first - no network calls)
ash run-external --adapter openai-compatible \
  --base-url http://localhost:8000/v1 \
  --model deepseek-chat \
  --scenario data-boundary \
  --dry-run

# check configuration before a real run
ash external-check --adapter openai-compatible \
  --base-url http://localhost:8000/v1 \
  --model deepseek-chat \
  --scenario data-boundary

# actual run (makes network calls; keep raw responses in ignored/private storage)
export ASH_EXTERNAL_API_KEY=REDACTED_VALUE
ash run-external --adapter openai-compatible \
  --base-url http://localhost:8000/v1 \
  --model deepseek-chat \
  --scenario data-boundary \
  --repeats 3 \
  --execute \
  --credential-env ASH_EXTERNAL_API_KEY \
  --out .internal/external-demo/latest

For the shortest operator path that covers deterministic demo, one local/remote OpenAI-compatible model, and a local mini-swarm on both Windows and Linux/macOS, use docs/run-your-model.md.

The commands above are bash. On Windows PowerShell, set the key with $env:ASH_EXTERNAL_API_KEY = "REDACTED_VALUE" and use a backtick ` for line continuation. Full per-stack PowerShell recipes: docs/connect-models.md. Full walkthrough: docs/user-journey.md.

Each run writes these artifacts:

reports/demo/
+-- traces.json       # portable, machine-readable traces (one per pattern)
+-- scorecard.json    # deterministic aggregate
+-- summary.md        # human-readable summary table
+-- executive.md      # concise scope, severity, top-failure, and residual-risk view
+-- remediation.json  # structured control recommendations (only when findings exist)
+-- remediation.md    # human-readable remediation report (only when findings exist)
+-- run_index.json    # execution id, config fingerprint, kind, outcomes, artifacts

Render any run directory as a static HTML page with ash report --root reports/demo.

Every run records a run_index.json manifest, so you can review run history:

ash list-runs --root reports
ash stats --root reports --out reports/stats
ash retention --root reports --keep-last 20
ash validate reports/demo --format json

ash retention is a dry-run unless --apply is passed. Applying deletion also requires --accept-unsigned-chronology, because manifest created_at is operator-declared metadata rather than authenticated time. Normal text/JSON output uses <run-root> and relative candidate paths; canonical absolute paths stay inside the apply model.

run-matrix additionally writes matrix.json (variant metadata) and matrix.md (scenario-specific summary).

run-external writes:

  • run_config.json - run configuration incl. request_count and a fixed credential-configured marker (neither the variable name nor its value)
  • external_results.json - per-pattern evaluation results with structured errors, pattern-level assertion status, raw-response path, and sha256
  • external_summary.json - aggregated repeat summaries + findings_by_control_family
  • external_report.md - human-readable report; when findings exist it adds a control-family table and control recommendations (quick / engineering / architecture fix, verification, residual risk), plus a "how to reproduce / validate" section
  • raw_responses/ - full raw model response text per request; --raw-response-limit controls only the preview stored inside external_results.json (0 = full preview)

For real or local model runs, publish only sanitized summaries: model names, roles, observation counts, response hashes, aggregate metrics, and ablation metrics. Do not commit raw_responses/. Raw responses are public only in the deterministic fake-server demo under examples/external-demo-report/.

run-external refuses to start if the estimated request count (patterns x variants x repeats) exceeds --max-requests (default 50); raise it explicitly for larger runs. ash validate checks external artifacts too.

External runs are experimental. They evaluate model decision boundaries with synthetic prompts, not full agent execution. No tools are called.

demo-agent is a deterministic local, synthetic agent (in-memory memory, mock tool calls, data-envelope propagation, recipient-control checks) - still no network, no LLM, and no real targets - but closer to real agent behavior than mock.

Committed example outputs (no install needed to view): examples/demo-report/ (mock) and examples/demo-agent-report/ (demo-agent). The main before/after example is explained in examples/comparison-report/README.md.

Local / synthetic, deterministic, no network or LLM calls.

Test your own model/runtime (experimental)

The external adapter evaluates any authorized OpenAI-compatible endpoint (cloud API, local server, or gateway) with safe synthetic prompts. Network calls only happen with run-external --execute or external-check --live. The API key is read from an env var by name and never logged or stored. HTTP redirects are refused, and ambient OS/environment proxy discovery is disabled, so the endpoint cannot silently expand one authorized request to another URL or route.

# 0) free local demo - start the bundled fake server (second terminal on Windows)
python examples/fake_openai_server.py &

# 1) preflight: config + request estimate + cost cap (no network)
ash external-check --base-url http://127.0.0.1:8766/v1 --model fake-model --scenario data-boundary

# 2) dry-run: exact request count (no network, no files)
ash run-external --base-url http://127.0.0.1:8766/v1 --model fake-model --scenario data-boundary --dry-run

# 3) minimal live run against the endpoint
ash run-external --base-url http://127.0.0.1:8766/v1 --model fake-model --scenario perception-boundary --execute --out .internal/external-demo

# 4) validate + read the report (with control recommendations)
ash validate .internal/external-demo
cat .internal/external-demo/external_report.md

request_count = patterns x variants x repeats; run-external refuses to exceed --max-requests (default 50). On PowerShell, start the fake server in a second terminal (no trailing &) and use ` for line continuation.

External verdicts are not accepted from model prose alone. New runs require the model to echo pattern_id and boundary_assertion; the harness cross-checks these against the pattern and canonical control family before recording PASS/FINDING. Incomplete or contradictory model JSON is recorded as inconclusive.

Experimental. Prompt-based evaluation only. No tool execution. Not a benchmark-grade vendor comparison. Connector recipes (fake server, vLLM, DeepSeek, Alibaba/Qwen, Ollama, LM Studio, generic gateway) with Windows/Linux/macOS commands: docs/connect-models.md. Full path reference and troubleshooting: docs/test-your-model.md.

Reproduce deterministic conformance differences

demo-agent is vulnerable by design; protected-demo-agent is the same agent with simple deterministic controls across the current boundary families, including provenance, data envelopes, tool/schema checks, memory governance, audit, budget, capability, perception, and approval context. The compare command runs both against the same patterns and writes a side-by-side report:

ash compare --baseline demo-agent --protected protected-demo-agent --out reports/comparison
reports/comparison/
  baseline/      traces.json, scorecard.json, summary.md, executive.md
  protected/     traces.json, scorecard.json, summary.md, executive.md
  comparison.md

In the committed example (examples/comparison-report/comparison.md) the baseline fails all 24 patterns (24 findings) and the protected agent passes all 24 (0 findings).

Educational and synthetic: this is evaluator-coupled conformance evidence from deterministic mock traces, not an independent risk-reduction estimate or guarantee of real-world protection.

Prior art

This project does not claim to be the first or only tool in the category. Prior art exists - BotGuard (open-source red-teaming + firewall for AI agents) is the closest combined work; garak, PyRIT, and promptfoo are established red-team / eval tools; Trylon Gateway is the closest gateway. Its focus is an opinionated, trace-first benchmark for agentic operating-environment boundary failures, with portable traces and deterministic baseline-vs-protected replay. Honest comparison: docs/competitors.md.

Documentation

Responsible use

The harness ships sanitized defensive test content. Use it only against systems you own or are authorized to test. Payloads are sanitized; "sensitive" data in tests are synthetic markers. Full policy: SECURITY.md.

Brand and attribution

The project is Agentic Security Harness (repository agentic-security-harness).

  • Code is licensed under Apache-2.0.
  • The project name, logos, and branding are not granted as trademarks.
  • Please preserve attribution when referencing the project or its corpus - see NOTICE.

Contributing & security

License

Apache-2.0.

About

Test whether AI agents keep repo text, tools, memory, and audit trails inside their authority boundaries; outputs traces, scorecards, and remediation reports.

Topics

agent-securityagentic-aiai-securitybenchmarkdefensive-securityevaluationllm-securityopenai-compatibleowasp-llmprompt-injectionpythonsafety

Resources

Readme
Apache-2.0 license

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

1 watching

Forks

0 forks
Report repository

Releases

Packages

Used by

Contributors

Languages