OWASP Agentic AI Scanner

Static analysis tool for detecting security risks from the OWASP Top 10 for Agentic AI Applications.

Installation

pip install owasp-agentic-scanner

Usage

# Scan a directory
owasp-scan scan src/

# Filter by severity
owasp-scan scan src --min-severity high

# Output as SARIF (for CI/CD)
owasp-scan scan src --format sarif --output results.sarif

# List available rules
owasp-scan list-rules

OWASP Top 10 Coverage

ID	Risk
AA01	Agent Goal Hijack
AA02	Tool Misuse & Exploitation
AA03	Identity & Privilege Abuse
AA04	Agentic Supply Chain
AA05	Unexpected Code Execution
AA06	Memory Poisoning
AA07	Excessive Agency
AA08	Insecure Plugin Design
AA09	Overreliance on Outputs
AA10	Model Theft

Inline Suppression

eval(expression)  # noqa: AA05

Documentation

• Usage Guide
• CI/CD Integration
• Configuration
• Detection Rules
• Architecture

Contributing

See CONTRIBUTING.md.

License

MIT - see LICENSE.