Open sourceAgentSec · AgentAuth
Agents read private data, invoke tools, delegate work, talk to other agents and take actions with real consequences. Application security and identity systems weren't designed for software that decides what to do at runtime.
Invaris Labs builds the infrastructure to test how agents behave, and to identify and authorize what they do.
pip install invaris-agentsecReads
Agent
autonomous
did:agent:QmfJZCnu…GjQmDRiMxux
Ed25519 · signs every request
Acts
Products
One tests how an agent behaves under attack. The other gives it a verifiable identity and bounds what it is allowed to do.
01
Does the agent behave safely?
Open-source adversarial security and reliability testing. Runs stateful attack scenarios against complete agent workflows and verifies your policy holds throughout.
02
Who is the agent, and what may it do?
Cryptographic identity and delegated authority. Self-certifying DIDs, signed requests instead of API keys, and scoped grants that only narrow as they're delegated.
01AgentSec
AgentSec is an open-source framework for adversarial security and reliability testing. It runs stateful attack scenarios against complete agent workflows (LLMs, retrieval, memory, MCP servers, tools and sensitive actions), records the full execution trace, and checks that your security policy holds from the first step to the last.
pip install invaris-agentsec$ agentsec test Invaris AgentSec 42 scenarios executed 36 passed 6 findings CRITICAL Indirect prompt injection triggered send_email HIGH Retrieved confidential content appeared in the response HIGH Agent attempted a forbidden payment action MEDIUM Tool-call budget exceeded Report written to .agentsec/report.json Report written to .agentsec/report.html
Commands and output from the AgentSec README. Lines starting with # describe documented behaviour.
version: "1"agent: name: support-agent endpoint: http://localhost:8000/agentallowed_tools: - search_documents - create_draftforbidden_actions: - send_email - reveal_credentials - execute_paymentlimits: max_steps: 12 max_tool_calls: 10 max_cost_usd: 0.50tests: - prompt_injection - indirect_prompt_injection - secret_extraction - unauthorized_tool_use - tool_output_poisoning - unsafe_retrieved_documents - loop_and_budget_limitsfrom agentsec import AgentTarget, SecuritySuitetarget = AgentTarget( endpoint="http://localhost:8000/agent", allowed_tools={"search_documents", "create_draft"}, forbidden_tools={"send_email", "execute_payment"},)suite = SecuritySuite(target)result = suite.run("indirect_prompt_injection")assert result.secret_leaks == []assert result.forbidden_tool_calls == []assert result.total_tool_calls <= 10import pytestfrom agentsec import CATEGORIES@pytest.mark.parametrize("category", CATEGORIES)def test_agent_resists(category, agentsec_run): agentsec_run(category, fail_on="high")# Run it with: pytest --agentsec-policy agentsec.yamlPolicies declare what the agent may do. Tests assert behaviour, not a particular model response.
Coverage
Every check is deterministic and opt-in by declaration. Findings are mapped to the OWASP Top 10 for Agentic Applications (opens in a new tab) (ASI01–ASI10).
Untrusted content that tries to steer the agent.
Direct & indirect prompt injection
prompt_injection · indirect_prompt_injection
Instructions arriving from the user, or hidden in documents and tool results.
Tool-output & MCP-server poisoning
tool_output_poisoning
Adversarial content delivered through the results of the tools the agent calls.
Unsafe retrieved documents
unsafe_retrieved_documents
Retrieval pipelines that hand the agent hostile or confidential content.
Memory poisoning
memory_poisoning
Malicious instructions persisted to memory and acted on in a later session.
What the agent does, and whether anyone authorised it.
Unauthorized tool use
unauthorized_tool_use
Calls to tools outside the policy's allowed set, including forbidden decoys.
Action without authorization
action_without_authorization
Effects a tool may perform globally but the current task never authorised.
Dangerous compositions
dangerous_composition
Individually allowed calls chained into exfiltration or command execution, tracked as data flow.
Identity & session confusion
identity_and_session_confusion
Acting on another user's resource or reusing a permission from another session.
Multi-agent privilege abuse
multi_agent_delegation
Sub-agents exceeding their role, confused-deputy escalation, unauthorized delegation.
Leaks, runaway behaviour and drift.
Secret & sensitive-data leakage
secret_extraction
Synthetic credentials and confidential data appearing where they shouldn't.
Loops, budgets & cost
loop_and_budget_limits
Excessive steps, tool calls, tokens or cost, and missing termination.
Deceptive action reports
deceptive_action_report
Agents denying a side effect the trace shows, or claiming work that never happened.
Behavioural regressions
agentsec compare
New, fixed and worse findings across model, prompt and tool updates.
Categories that need tool_effects or agent_roles build no scenarios without them, and a multi-agent scenario run against a system that reports no agent attribution is reported as not observable, never as passed. Unauthorized financial and on-chain actions are covered by a bundled attack pack and the policy's spend_limits / address_allowlist. What a passing test does and doesn't prove (opens in a new tab).
MCP security
MCP servers hand agents tool descriptions and tool results, both of which can carry instructions. AgentSec tests the server definitions statically and delivers adversarial scenarios through MCP itself.
MCP testing docs (opens in a new tab)agentsec mcp scan
Lists a server's tools, resources and prompts without calling, reading or fetching any of them, and flags:
agentsec test --mcp-listen
AgentSec becomes the MCP server your agent connects to, delivering the same adversarial scenarios through MCP tool results.
# agent ⇄ MCP ⇄ AgentSec
agentsec test --mcp-listen 127.0.0.1:8765
The MCP attack host has been run against a real LLM-backed agent (the Claude Code CLI, built-in tools disabled, every MCP tool simulated), with results checked into the repo.
Workflow
AgentSec is CI-first. Exit codes gate the job (1 on findings, 2 on configuration errors), --seed makes runs reproducible, and reports compare across pull requests.
Build agent
agentsec init
Declare allowed tools, forbidden actions and limits.
Run AgentSec
agentsec test
Stateful adversarial scenarios against the full workflow.
Detect failures
.agentsec/report.html
Input, trace, violated policy and observed action.
Fix
agentsec replay
Re-run findings with the recorded seed to confirm the fix.
Regression test
agentsec compare
Diff reports on every pull request; exit 1 on regressions.
Ship
uses: invarislabs/invaris-agentsec@main
The packaged GitHub Action gates the job.
Evidence over scores
Every finding includes the input, trace, violated policy and observed action.
Stateful testing
Tests cover complete workflows rather than isolated prompts.
Local by default
Test locally without sending private traces to a hosted service.
Reproducible
A failed scenario is replayable with the same configuration and evidence.
02AgentAuth
AgentAuth gives each agent a self-certifying DID backed by an Ed25519 keypair. The agent proves who it is by signing every request. Capability grants say what it may do, and anyone can verify all of it without trusting the registry.
did:agent:QmfJZCnucexGhSZqdsAcKnFcv4RxyhPFMUiGjQmDRiMxux
└─ sha2-256 multihash of the agent's signed inception event
Authorization: AgentSig did="…",kid="…#key-1",aud="api.example.com",ts="…",nonce="…",sig="…"
Agent identity
did:agent:Qm…
A self-certifying DID derived from the agent's own Ed25519 key material and signed inception event. The registry can't mint or reassign it.
Signed request
Authorization: AgentSig …
Every request is signed over method, path, body, audience, timestamp and a single-use nonce. No API key or bearer token crosses the wire.
Scoped authority
AgentGrant
A short-lived capability grant: iss lets sub do scope at aud until exp. Default 15 minutes, maximum 24 hours.
Delegation
scope ⊆ parent · depth − 1
An agent can pass a narrower slice to a sub-agent. Scopes, audiences, validity windows and limits only shrink.
Verification
root_policy
The service checks every link, that the leaf signed the request, that the root is a principal it trusts, and that nothing is revoked.
Delegation
A person issues an agent a short-lived, scoped grant. The agent can pass a narrower slice to a sub-agent, and every action traces back to the human who authorized it.
Scopes, audiences and validity windows only shrink, and depth strictly decreases. Limits on resources, spend, rate and uses can only tighten, and a hand-crafted grant that loosens one is rejected by the service.
Counters are shared across the chain. Give an agent a 50 USD budget and let it hand two sub-agents 30 USD each: together they still can't spend more than 50 USD.
Scopes
tools.* covers tools.search
Lifetimes
15 min default · 24 h max
Depth
strictly decreases
Expiry
clamped to the parent's
payments.*
payments.buy
Refused: a child grant can't exceed its parent on any limit.
Example from the AgentAuth README. Amounts are integer USD-cents; floats are never signed.
Control
Revocation that cascades
POST /v1/revocations
An issuer revokes one of its grants by id. Revoking a grant, or switching off any agent in the chain, cuts off everything below it.
Kill switch
agentauth deactivate did:agent:… --as arunima
An agent can be killed by itself, or by the human or org controller that countersigned its creation.
Rotation with pre-rotation
agentauth rotate researcher
The next key is committed in advance, so the current key alone can't rotate the identity. Relying parties pick up the new key automatically.
| Limit | Meaning | Enforced |
|---|---|---|
| resources | What the call may touch: an exact pattern, or a prefix ending in *Enforced: Per call | Per call |
| spend.per_call | Max amount for one callEnforced: Per call | Per call |
| spend.total | Max amount across all calls under this grantEnforced: Shared ledger | Shared ledger |
| rate | Max count calls per per seconds (sliding window)Enforced: Shared ledger | Shared ledger |
| uses | Max total callsEnforced: Shared ledger | Shared ledger |
Fail-closed: a resource-limited grant is refused at any endpoint that doesn't declare a resource, an unknown limit field invalidates the grant, and a mismatched spend unit is refused.
In practice
agentauth serve & # registry :8000agentauth init arunimaagentauth init researcher --controller arunimaagentauth init summarizer --controller researcher# arunima → researcher (may delegate once) → summarizer (search only)agentauth grant arunima researcher --scope 'tools.*' --aud 127.0.0.1:9000 --depth 1 -o researcher.grantagentauth grant researcher summarizer --scope tools.search --aud 127.0.0.1:9000 \ --parent researcher.grant -o summarizer.grantagentauth inspect summarizer.grant# Revoke the root grant; the summarizer loses access tooagentauth revoke arunima <grant-id-from-inspect># Limits: a 50 USD budget (max 20 USD per call, 10 calls/min) that can be split onceagentauth grant arunima shopper --scope 'payments.*' --aud 127.0.0.1:9000 --depth 1 \ --budget 5000 --per-call 2000 --rate 10/60 -o pay.grantagentauth grant shopper helper --scope payments.buy --aud 127.0.0.1:9000 \ --budget 3000 --parent pay.grant -o helper.grant # --budget 9000 would be refusedagentauth serve --db agentauth.db & # registry on 127.0.0.1:8000agentauth init arunima --meta kind=human # a human principalagentauth init researcher --controller arunima \ --meta model=claude # an agent she ownsagentauth whoami researcher # authenticated call, signed with the agent's keyagentauth rotate researcher # move to the pre-committed keyagentauth resolve did:agent:… --verify # replay the full log locallyagentauth agents arunima # everything arunima controlsagentauth deactivate did:agent:… --as arunima # kill switchfrom agentauth import Limitsroot = human.grant(researcher.did, ["tools.*"], ["tools.example.com"], ttl=900, depth=1, limits=Limits.build(resources=["repo:acme/*"], rate=(30, 60)))chain = researcher.grant(summarizer.did, ["tools.search"], ["tools.example.com"], parent=root, limits=Limits.build(resources=["repo:acme/website"], uses=20))httpx.post("https://tools.example.com/search", json={"q": "…"}, auth=summarizer.httpx_auth(chain))reg.revoke_grant(human, root.leaf.id) # summarizer is cut off toofrom agentauth import GrantVerifier, RegistryRevocationChecker, trust_principalsfrom agentauth.integrations import fastapi_authorizerreg = RegistryClient("https://registry.example.com")keys = RegistryKeyResolver(reg, ttl=30)require = fastapi_authorizer( RequestVerifier(keys, audiences={"tools.example.com"}), GrantVerifier(keys, root_policy=trust_principals({ORG_DID: ["tools.*"]}), revoked=RegistryRevocationChecker(reg, ttl=5)),)@app.post("/search")def search(body: dict, agent = Depends(require("tools.search"))): return {"caller": agent.did, "on_behalf_of": agent.principal, "chain": agent.via}"limits": { "resources": ["/reports/*", "repo:acme/website"], "spend": {"unit": "USD-cents", "per_call": 2000, "total": 5000}, "rate": {"count": 10, "per": 60}, "uses": 100}Snippets from the AgentAuth README.
Verification
Every link is signed by its issuer's current key
No forged or stale grants
Each issuer is the previous link's subject
The chain is unbroken
Scopes, audiences and validity only shrink; depth strictly decreases
Delegation can't escalate
The leaf's subject is the agent that signed the request
A stolen grant is useless to anyone else
The request signature covers the AgentGrant header
The agent asserts which authority it's using
The root issuer is a principal the service trusts
The service decides whose word counts
Nothing in the chain is deactivated or revoked
Revocation and kill switches cascade
Why not API keys?
API keys for agents
AgentAuth
Shared secrets leak through logs, prompts and tool output
Private key never leaves the agent; requests carry signatures
A leaked key can be replayed anywhere, forever
Signatures are bound to method, path, body, audience (host), a timestamp and a single-use nonce
Identity = whatever the issuer's database says
DID is derived from the agent's own key material; the registry can't mint or reassign it
Rotation means coordinating a new secret everywhere
Rotate with one call; relying parties pick up the new key automatically
Stolen key = full takeover
Pre-rotation: the next key is committed in advance, so the current key alone can't rotate the identity
No link between an agent and who's responsible for it
Optional controller (a human or org DID) countersigns the agent's creation and holds a kill switch
v0.3Shipped: identity (v0.1), delegated grants (v0.2), limits (v0.3). Known gaps, like registry equivocation and the in-memory nonce cache, are documented in the threat model.
The Invaris agent security stack
AgentSec determines whether an agent behaves safely. AgentAuth determines who the agent is and what it is allowed to do. Together they're the beginning of the Invaris agent security stack.
Does the agent behave safely?
Adversarial scenarios against the whole workflow. Evidence for every failure: input, trace, violated policy, observed action.
Who is the agent, and what is it allowed to do?
A verifiable DID, signed requests, and scoped grants that narrow with delegation and cascade on revocation.
Research & writing
Technical writing and research notes by Arunima Chaudhuri on how agents fail, how to test for it, and what a test result actually proves.
Research
A research note on what an AgentSec pass is made of. Runs against seven frameworks, two memory stores and the Claude Code CLI show five ways to pass without the agent resisting anything, and why passes need the same evidence findings get.
Arunima Chaudhuri · Hashnode
Guide
A hands-on guide to AgentSec 0.7's authority checks: did the task authorize this effect, where did private data go, did the agent's report match its trace, whose resource did it touch, and which agent acted on whose authority.
Arunima Chaudhuri · Hashnode
Guide
A hands-on walkthrough from installing AgentSec and attacking a deliberately vulnerable practice agent, to writing a policy for your own agent, then on to replay, regression comparison, GitHub Actions, model-assisted judging and MCP server scanning.
Arunima Chaudhuri · Hashnode
Essay
I asked a coding agent whether something was right or wrong. Instead of a yes or no, it made the changes and committed them. On the boundary between what an agent is asked to do and what it is able to do, why a document should never be able to grant an agent permission it didn't have, and how that led to AgentSec.
Arunima Chaudhuri · Hashnode
About Invaris Labs
Traditional software follows execution paths someone wrote down. Agents interpret untrusted input, choose their own tools, retain memory and make decisions at runtime. A single poisoned document or tool response can change what they do.
Invaris Labs is building security infrastructure for that model: open, testable and verifiable without asking anyone to trust a black box.
Founder
Arunima founded Invaris Labs and builds AgentSec and AgentAuth. She is a Research Engineer at Status, previously interned at Status, Hyperledger and Solana Labs, and holds an M.Tech in Computer Science and Engineering from NIT Warangal (2025).
Open source
Security infrastructure should be inspectable. Explore the code, try the tools against your own agents, open issues, contribute, and star the repositories if they're useful.
Adversarial security testing for AI agents: prompt injection, tool misuse, memory poisoning and MCP scanning, with CI-ready regression testing and reports.
pip install invaris-agentsecCryptographic identity and delegated authority for autonomous AI agents: self-certifying DIDs, signed requests instead of API keys, and scoped delegation chains with budgets and cascading revocation.
pip install -e ".[dev]"Both projects are under active development. If you're building an agent and want to be an early design partner, open a discussion or get in touch.