🛡️ AgentProof

Security scanner for AI agent deployments. Trust, verified.

AgentProof scans your AI assistant deployment (OpenClaw, MCP servers, and more) for security vulnerabilities, exposed credentials, and misconfigurations. Get a security score, actionable recommendations, and proof that your deployment is trustworthy.

Part of the Deveras AI Truth Stack.

Quick Start

npx @deveras/agentproof scan .

That's it. AgentProof scans your current directory and outputs a security report.

What It Checks

| Category | Weight | What | |----------|--------|------| | 🔒 Configuration | 25% | Auth, TLS, CORS, DM policies, heartbeats | | 🔑 Credentials | 30% | Exposed API keys, tokens, secrets in files | | 🌐 Network | 15% | HTTPS, exposed ports, security headers, containers | | 🔐 Permissions | 15% | Root access, workspace scope, tool permissions | | 🧩 Skills | 10% | Shell scripts in skills, external URLs, plugin count | | 📊 Data Flow | 5% | LLM providers, routing, voice, state storage |

Usage

# Scan local directory
agentproof scan .
agentproof scan /path/to/openclaw

# Scan remote instance
agentproof scan https://my-agent.example.com

# JSON output (for CI/CD)
agentproof scan . --format json

# Only specific checks
agentproof scan . --checks config,credentials

# Minimum severity
agentproof scan . --severity high

Output

  ╔═══════════════════════════════════════════════════╗
  ║  🔍 AgentProof Security Scan Report             ║
  ╚═══════════════════════════════════════════════════╝

  🛡️ Score: 85/100 (Grade B)
  [████████████████████████░░░░░░]

  Summary: 24 checks — 18 passed · 2 failed · 0 critical · 1 high · 3 medium · 2 low

  ┌─ Categories ─────────────────────────────────────┐
  │ ✅ Configuration Security         ▓▓▓▓▓▓▓▓▓░  90/100  │
  │ ⚠️ Credential Safety              ▓▓▓▓▓▓▓░░░  72/100  │
  │ 🛡️ Network Posture                ▓▓▓▓▓▓▓▓▓▓ 100/100  │
  │ ...                                                      │
  └─────────────────────────────────────────────────┘

  🟠 HIGH (1)
     ❌ Twilio Auth Token found in config/openclaw.json
        → Move secrets to environment variables.

Scoring

• A (90-100): Excellent — minimal attack surface
• B (80-89): Good — minor improvements possible
• C (70-79): Fair — several issues need attention
• D (50-69): Poor — significant security gaps
• F (<50): Critical — immediate action required

Exit code is 0 for scores ≥70, 1 for <70 (use in CI/CD pipelines).

Supported Platforms

• ✅ OpenClaw — Full support (config, skills, plugins, state)
• 🔜 MCP servers
• 🔜 Other AI agent frameworks

AI Truth Stack

AgentProof is part of Deveras' mission to make AI trustworthy:

• SiteProof — Verify your website works for humans
• AEO Scanner — Verify AI can find and cite your content
• AgentProof — Verify your AI agent is secure and trustworthy

License

MIT — Deveras