Keep your agent under control.
Describe your agent. See what can go wrong, and what we block before it happens.
- Files are read, never run
- Secrets masked
- Files not kept after the scan
Built on the standards your auditor already reads.
Every finding carries its OWASP ID, so your CISO, your SOC and your auditor read the same report.
- Microsoft Copilot Studio
- Microsoft Entra Agent ID
- Microsoft Agent 365
- Microsoft Agent Framework
- Agent Governance Toolkit
- LangGraph and LangChain
- Custom Python agents
- MCP servers
- Splunk
- Microsoft Sentinel
Agents ship faster than anyone can secure them.
Security teams are asked to approve agents they have no method to review. So they block the launch, or they sign off blind, and neither leaves a record an auditor can check.
of agentic AI projects are still stuck in pilot or proof of concept, held back by governance and validation.
Dynatrace, The Pulse of Agentic AI 2026, 919 leadersfindings on a test agent that had just blocked a poisoned tool, 8 of them flagged for review before go-live.
Ex-Guardian lab review, October 2026changed sentence in an MCP tool description was enough to make a test agent open a file nobody asked for.
Ex-Guardian lab, October 2026The controls you trust say where they stop.
Read the documentation of the controls you already run. Each one names a gap that someone has to test on your agent.
“it is unclear if there are fool-proof methods of prevention for prompt injection.”
We test indirect injection through the emails, tickets and files your agent really reads.
“clients MUST consider tool annotations to be untrusted unless they come from trusted servers.”
We test every tool's description, schema and readOnlyHint against what the server really does.
“does not correlate sequences of individually-allowed actions that form a malicious workflow”
We test chains of allowed calls: read the customer table, then post it to a channel.
“The Guardian's default failure posture is proceed.”
We test that your guard fails closed when it crashes, hangs or cannot be reached.
Quoted from the public documentation, read on 25 October 2026.
What keeps security teams up, and what we do about it.
It acts with someone else's identity.
Agents often run on the builder's account or a shared service account with far more rights than the task needs.
We map the identity it really uses.
Account, groups, tokens and scopes, with the least-privilege fix. inventory.json · ASI03
Its tools can change after you approved them.
An MCP server can rewrite a tool's description at runtime, and the model follows it.
We check the drift guard is on, then try to get past it.
Every description and schema is fingerprinted. We confirm a changed tool is blocked before the model call, then run a rug-pull on your real server. tool-baseline.json · ASI04
A document can give it orders.
Instructions hidden in an email, a ticket or a file reach the model as if they were yours.
We attack it with those documents first.
Indirect prompt injection scenarios on the agent's real tools, each finding with its proof. findings.md · ASI01
Each call is allowed. The chain is a leak.
Read the customer table, then post to a channel: two permitted calls, one exfiltration. A per-call policy never sees the pair.
We attack the whole chain.
We map which tools combine into a path out of your data, then try it with the agent's own rights. findings.md · ASI02
It can reach data nobody mapped.
One connector too many and the agent reads, or sends, what it was never meant to see.
We draw its data perimeter.
Every source it can read or write, flagged when it falls outside scope. risk-map.json · ASI03
Nobody watches it after launch.
The review is a snapshot; the agent, its tools and its rights keep changing.
We hand you the alerts.
Detection rules for your SIEM that fire when the agent drifts. rules/ · ASI10
This is what an agent under control looks like.
Every call goes through a known identity, to pinned tools, inside a mapped perimeter. When something changes, the call stops and your SIEM hears about it.
- Calls to reviewed tools pass, logged.
- A tool whose description changed is blocked before the model sees it.
- The block raises an alert in your SIEM.
One agent, secured end to end.
From the first risk map to the alerts that keep watching it after launch. Each step leaves a file you can read, diff and keep.
Risk
What the agent can do, as whom, on which data and tools.
risk-map.jsonAudit
Identity, permissions, MCP tools with a fingerprint of each description, data reach.
inventory.jsonPentest
Poisoned tools, indirect prompt injection, chains of allowed actions, exfiltration, each mapped to OWASP.
findings.mdHarden
The configuration fix for every finding, highest risk first.
fixes.mdMonitor
Alerting rules for your SIEM, ready to deploy after launch.
rules/It keeps watching after launch.
The kit writes detection rules for the agent it inspected. Deploy them in your SIEM and get an alert when something changes under the agent.
- A tool description changed since review
- The guard was disabled by configuration
- An unknown tool appears on an MCP server
- A tool call falls outside the agent's normal set
- A data source is read outside scope
- The agent's identity is used by another process
rules/splunk/tool_description_drift.splSplunkindex=agents sourcetype=agent:trace kind="mcp.tools_list" | spath path=tools{} output=tool | mvexpand tool | spath input=tool | eventstats earliest(description_sha256) as baseline by name | where description_sha256 != baseline | table _time agent name baseline description_sha256
Not ready to talk? Take the checklist.
The 30 checks we run before an agent goes live, with the evidence to keep. Free PDF, 9 pages.
The kit is free. The proof is signed.
Start with the open-source kit. When you need an independent verdict for your CISO or your auditor, we review the agent ourselves.
Open-source kit
Free, Apache-2.0
- Inventory of identity, permissions, tools and data reach
- Tool description pinning and drift detection
- Posture check of the guards you already run: policy mode, loaded rules, fail-closed
- Raw findings in JSON and Markdown
- Alerting rules for Splunk and Sentinel
Signed review
Fixed price, quoted per agent
- Attacks on the agent's real configuration
- Every finding mapped to OWASP ASI01–ASI10, with its proof level and verdict
- Configuration fixes and an evidence pack
- A signed go/no-go for your go-live board
Who runs the review.
Every review is run and signed by the same CISSP-certified security engineer, with eight years in critical environments, most of them on the Microsoft security stack. We never name a client or an employer.
- 147,000users under data loss prevention, export-controlled data included
- 7,000endpoints under EDR, run from a level-3 SOC
- CopilotMicrosoft 365 Copilot secured for a regulated asset manager
- Laba simulated company with Active Directory, SSO, business apps, MCP servers and a SIEM, where each attack scenario is built and rehearsed
Questions security teams ask.
What is AI agent security?
AI agent security is the practice of controlling what an AI agent can do: the identity it acts with, its permissions, the tools and MCP servers it calls, the data it can reach, and the alerts that watch it after launch. It goes beyond model safety, because an agent takes actions with real access.
What does Ex-Guardian check on an AI agent?
The identity the agent runs as, its permissions and tokens, every MCP tool with a fingerprint of its description, the data sources it can reach, and the alerting rules needed to watch it after launch. The signed review adds attacks on the real configuration: poisoned tools, indirect prompt injection, over-broad permissions and exfiltration.
What is MCP tool poisoning?
An MCP server sends each tool description to the agent at runtime, and the model reads it as instructions. If the description changes after your review, the agent can follow hidden instructions. Pinning each description to the hash of its reviewed version and blocking any change stops it before the model call.
How is an agent review different from a pentest?
A classic pentest tests the application. An agent review also checks whose identity the agent uses, which tools it trusts, what data it can reach and whether anyone is alerted when that changes, and it delivers a go/no-go with the evidence behind each finding.
Which standards does Ex-Guardian map to?
Every finding carries its ID in the OWASP Top 10 for Agentic Applications (2026 edition, ASI01 to ASI10). Skills, hooks and agent config files are checked against the OWASP Agentic Skills Top 10, and MCP servers against the security considerations of the MCP specification.
Do you review agents that already run behind Microsoft's Agent Governance Toolkit?
Yes. The review checks that the toolkit or your MCP gateway runs in strict mode, that its policies are loaded and that it fails closed, then attacks what its own documentation says it does not cover, such as indirect prompt injection and chains of individually allowed actions. Ex-Guardian is independent and not affiliated with Microsoft.
Is the kit open source?
Yes. The inspection kit will be released under Apache-2.0, read-only, with no telemetry, and runs on your own machine. It is in development and early access is open.
What does the signed review cost?
A fixed price per agent, quoted after a short description of the agent: its platform, tools and data. Nothing is accessed until you approve the scope.
Be first to run the kit.
The kit is in development. Leave your work email and we will send the first release and its documentation.
That did not go through. Check the email address and try again.