AAL Core (agent-assurance)

The framework-neutral offensive core of the Agent Assurance Layer (AAL). Given a Capability Manifest and a runner adapter, it red-teams any agent:

• runs an attack library — mapped to the OWASP Top 10 for Agentic Applications taxonomy and MITRE ATLAS — against an isolated copy of the target (the seed corpus currently exercises ASI01/02/03/05; the schema and graph cover the full ASI01–ASI10 range);
• builds a toxic-flow graph over the agent's declared tools to find lethal-trifecta and RCE composition paths that single-prompt scanners miss;
• detects execution-layer side-effect divergences — the agent refuses in text but a side-effecting tool still fires;
• emits SARIF (for CI/code-scanning) and a human-readable report.

It is not a runtime guardrail and not a generic code scanner. The AgenticMind-native compliance/evidence layer (AIUC-1 gap analysis, auditor bundle) is a separate package.

Install

# one-off, no install (once published):
npx agent-assurance scan path/to/manifest.json --sarif out.sarif

# or from source (contributors):
git clone https://github.com/Moai-Team-LLC/agent-assurance && cd agent-assurance
nvm use            # Node >= 22.18 (for oxlint)
bun install
bun run check      # lint + typecheck + tests

Quickstart

Red-team the bundled reference agent — a deliberately vulnerable fixture (a lethal trifecta, an RCE path, and a refuse-in-text-but-fire divergence):

bun run cli -- scan fixtures/vulnerable-agent/manifest.json \
  --sarif out.sarif --report out.md -n 1

aal scan — vulnerable-support-agent
8/8 attacks conclusively evaluated (100%), 0 not_verified — dynamic suite ran
findings: 6 critical · 4 high · 0 medium · 0 low · 0 info
  [CRITICAL] Lethal trifecta — OWASP ASI01
  [CRITICAL] Untrusted-content → code-execution path — OWASP ASI05
  [CRITICAL] Refuse-in-text but fired a side-effecting tool (data-exfil) — OWASP ASI03 (stability 1/1)
  ...
verdict: FAIL — 6 critical      # exit code 1 → gates CI (FR-12.1)

It writes SARIF 2.1.0 (out.sarif) for code-scanning dashboards and a Markdown report (out.md). Findings reference every attack input by sha256 — no raw payloads on disk.

Point it at your own agent

1. Write a Capability Manifest describing your agent's tools (and their side-effect class), data scopes, untrusted-ingress points, identity, and declared mitigations — see fixtures/vulnerable-agent/manifest.json.
2. Drop a target.json ({ "command": ..., "args": [...] }) next to it so the exec adapter can run your agent. Your agent reads {"input": "..."} on stdin and replies with {"text": "...", "toolCalls": [...]} on stdout.
3. bun run cli -- scan path/to/manifest.json --sarif out.sarif.

Without a target.json the scan runs static-only (toxic-flow graph) and honestly marks every dynamic attack not_verified.

Cycle-of-Trust policy pack

Where AAL Core detects boundary violations offensively, policy-pack/ prevents the most direct one — an agent editing its own tools, permissions, or hooks — and streams a hash-not-text evidence event for every attempt (→ AgenticMind /hooks/audit). It layers a PreToolUse guard hook + permissions.deny + a managed-settings fragment that disables bypassPermissions. A live spike (Claude Code v2.1.201) showed the hook blocks in every mode, including bypassPermissions and --dangerously-skip-permissions — so the hook is the load-bearing layer and managed settings are org-level defense-in-depth. See policy-pack/README.md and ADR-0001; the offline gate is bun x vitest run src/policy/.

Hard invariants

• No AgenticMind dependency (framework-neutral core).
• Fail-closed: inconclusive ⇒ not_verified, never safe.
• Hash-not-text: never write a raw secret or attack payload to a log/report/fixture.
• Read/report-only: this core never remediates and never fires a real side effect.

License

MIT © Moai Team LLC