Agent Security Harness

Trust Score 82/100

A comprehensive, defensive test suite that runs protocol and decision-layer security checks against AI agent systems to surface vulnerabilities before deploymen

triggers:security testred teamagent securitymcp securityrun security harness

GitHub SKILL.md

What it does

This skill encapsulates an operational security harness that executes a large suite of protocol and governance tests against AI agent infrastructures. It is built to probe MCP, agent-to-agent, and payment-related wire protocols, and to evaluate decision governance and compliance mapping.

When to use it

Use when preparing an MCP server, multi-agent pipeline, or payment integration for production, during red team exercises, CI gate checks, or pre-certification work. Do not run against production without explicit authorization; prefer isolated staging environments.

What's included

Scripts: packaging and installation via PyPI, CLI commands such as agent-security test mcp --url are provided by the project.
References: linked docs, tests inventory, and CI integration examples live in the repository.
Instructions: quick start, modes of operation including stdio and optional HTTP transport, and safety guidance for credentials and telemetry.

Compatible agents

Designed for operator-focused automation, CI runners, and agent orchestrators that can call CLI tools or invoke the harness as an MCP server. Works with environments that allow local process execution or isolated containers.

Audit Summary

Agent Security Harness is a comprehensive defensive security testing tool for AI agent systems covering MCP, A2A, L402/x402 protocols, AIUC-1 compliance, and behavioral profiling. The SKILL.md is thorough with clear safety documentation. Of 14 scripts, only 2 ran successfully in isolation; 10 fail due to missing 'protocol_tests' dependency and 2 require runtime arguments. The code quality of individual scripts is good (type hints, docstrings, argparse), but tight coupling to the parent package limits standalone utility.

Watch Out

Scripts depend on 'protocol_tests' package which must be installed separately via 'pip install agent-security-harness' — they cannot run from the skill directory alone
The skill's install instruction provides a pip package that includes protocol_tests, but the scripts in the repo expect to be run from the repo root
.env.example contains a Discord bot token placeholder — not a real credential
Telemetry is opt-in only and documented in SKILL.md — no phone-home by default

Missing Dependencies

protocol_tests (parent package — scripts depend on it but it's not installable via the skill alone)

Notes

This is a legitimate, well-documented defensive security tool with real research backing (Zenodo preprints, NIST submissions). The Apache-2.0 license and public source on GitHub are verifiable. No exfiltration, telemetry is opt-in, and the safety section is unusually thorough. Main concern is that most scripts can't run standalone from the skill bundle — they need the full pip package installed. Security posture is excellent.

Information

Repository: red-team-blue-team-agent-fabric
Stars: 17

Trust Score

Overall82

Security95

Code Quality68

Architecture73

Usefulness88

Related Skills

Development Worktree

Create an isolated git worktree for feature work, auto-run project setup, and verify a clean test baseline before development.

TradeOS

Natural-language driven CEX trading and portfolio management for agents: API key vaulting, multi-exchange orders, DCA, arbitrage scanning, alerts and security r

Kickbox Automation (Composio / Rube MCP)

Automate Kickbox workflows via the Composio Kickbox toolkit on a Rube MCP server: discover tools, manage connections, and execute schema-compliant tool calls.

Beaconstac Automation

Automate Beaconstac QR code and link management using the Rube MCP (Composio) toolkit.

Java 25 & Spring Boot 4 Code Reviewer

Run focused, evidence-based code reviews for Java 25 and Spring Boot 4 projects — migration risks, architecture boundaries, null-safety (JSpecify), security, an

ArcKit — French Public Procurement (fr-marche-public)

Generates French public procurement (Dossier de Consultation des Entreprises) drafts aligned with the Code de la Commande Publique, UGAP frameworks, and DINUM d

ArcKit Architecture Conformance

Run a systematic architecture conformance assessment that compares ADRs and principles against HLD/DLD artifacts to surface drift, violations, and technical deb

Vibe Security Auditor

Audits AI-generated codebases for critical security flaws like exposed keys, broken RLS, and insecure payment flows.

Back to Skills