Free & open-source

GuardScan

Scan any AI agent for prompt-injection + financial risk — offline, in milliseconds, free.

GuardScan is the free tier of AgentGuard. Point it at an agent's prompt or config and get an A–F risk grade with concrete findings — no LLM, no network, no cost, no data leaving your machine. Every rule is open source.

Get full AgentGuard →How the full protocol works

Free & open-source. Runs fully offline today; crates.io, npm, and prebuilt binaries ship with the $GUARD launch.

What it checks

The attack class that is actually draining agents.

Built for the exploit that hit Bankr in May 2026: an agent tricked, via untrusted input, into signing a transaction it never should have.

Prompt-injection exposure

Untrusted-content intake with no injection defense, no privilege separation between reading input and signing, unconditional instruction-following, encoded-payload execution.

Custody & financial risk

Autonomous signing with no human-approval gate, no spend caps, and over-broad wallet or tool permissions.

Secret leakage

Private keys, API keys, or seed phrases embedded directly in the prompt.

Category-aware risk surface

A six-axis financial-risk surface reweighted by the agent's inferred behavior category — a leverage trader and an NFT minter are scored differently.

One command, a real verdict

An A–F grade with findings you can act on.

No LLM, no API key, no network — every rule is deterministic and open source, so the same input always gives the same answer. Non-zero exit on any High/Critical finding means it drops straight into CI.

guardscan leverage-agent.txt

🛡️  GuardScan — free agent-security scan
────────────────────────────────────────
Grade:      F   (88/100 risk)
Category:   LeverageTrader (confidence 84%)
Protocols:  Avantis, Base
Financial:  71/100 (dominant axis: leverage)

  [CRITICAL] Signs/broadcasts transactions with no human-approval gate
    → Require explicit approval before any signing; simulate-then-confirm.
  [HIGH] Untrusted input can reach transaction-signing (no privilege separation)
    → The component that reads untrusted content must not hold signing authority.

exit code: 1   # non-zero on any High/Critical — drops straight into CI

Install

Run it wherever your agents live.

Rust (crates.io)

terminal

cargo install guardscan

Node / any repo

terminal

npx guardscan agent.txt

CI gate

terminal

guardscan agent-prompt.txt   # fails the build on a High/Critical finding

Free & open-source. Runs fully offline today; crates.io, npm, and prebuilt binaries ship with the $GUARD launch.

GuardScan tells you the risk. AgentGuard defends against it.

The free scan is a static snapshot. The full protocol adds a multi-model evaluation, live transaction monitoring with auto-pause, a semantic LLM-cost cache, a public trust oracle, and a bug-bounty corpus that hardens every agent from each caught exploit.

Open the dashboard See the proof →