AgentSeal

AgentSeal is an open-source security scanner and toolkit for checking AI agent prompts, MCP servers, and related systems. Its scan command sends adversarial probes to system prompts to identify extraction and instruction-injection vulnerabilities. Guard scans agent configurations and skill files on a machine, while Watch monitors those files and MCP configurations for changes. Scan-MCP tests server tools in a sandbox and supports OAuth for authenticated remote servers. The CLI supports the listed LLM providers, including local options, and can run offline with a local Ollama model without network calls or telemetry, according to the site. The dashboard provides scan results, prompt management, security monitoring, and GitHub integration settings. For development workflows, AgentSeal supports SARIF 2.1.0, JUnit XML, GitHub Actions summaries, and policy rules for pull-request gating. The Free plan costs nothing and includes 30 basic probes, the MCP registry, Guard, and Watch. CLI installation requires Python 3.10 or higher; an npm wrapper is also available.

AgentSeal combines prompt, agent-configuration, and MCP-server checks with monitoring and CI-oriented outputs. The Free plan includes 30 basic probes, while the listed Pro features include 311 probes and runtime MCP scanning with OAuth; no Pro price is listed.

AgentSeal suits teams developing AI agents or managing MCP servers that need prompt and configuration scanning. Its offline CLI and CI outputs may fit workflows using local models or pull-request checks.

Overview

AgentSeal is an open-source security toolkit for probing AI prompts, agent setups and MCP servers. It suits developers and security teams that need to assess agent risks in a CLI or CI workflow, especially when local or continuous checks matter. Its breadth is a strength, but the free plan’s 30 basic probes make it a starting point rather than the full-coverage option.

Its workflow spans adversarial prompt scans, machine-level configuration checks and MCP server testing, with monitoring and dashboard features alongside the CLI. That combination is useful for teams that want more than a one-off prompt test; it may be more than needed for readers focused only on LLM evaluation or a single narrow check. For a wider category comparison, browse AI Red Teaming Tools.

Key features

Prompt and configuration checks

The scan command sends adversarial probes at system prompts to detect extraction and instruction-injection weaknesses. Coverage spans extraction, injection, data exfiltration, MCP tool poisoning, RAG poisoning and multimodal attacks. The 311-probe scope gives security-conscious teams a broader assessment, while the Free plan’s 30 basic probes limits how much can be covered without moving to Pro.

Guard scans agent configurations and skill files on a machine, while Watch monitors those files and MCP configurations for changes. Continuous monitoring can help teams catch configuration drift between scheduled assessments; those who only need a single manual scan may not benefit as much from this ongoing layer.

MCP testing and registry

Scan-MCP runs MCP servers in a sandbox and tests tool behavior with adversarial payloads. OAuth support allows testing authenticated remote servers, a practical fit for teams whose MCP services are not public. The MCP registry applies a seven-stage security pipeline, including sandboxing and probing, before listing a server; that adds a curated discovery component alongside direct scanning.

Workflow, integrations and privacy

AgentSeal supports SARIF 2.1.0, JUnit XML, PDF reports, GitHub Actions summaries and policy-as-code rules for pull-request gates. Those outputs make it more applicable to CI and security review processes than a scanner that stops at interactive results. The dashboard provides scan results, prompt management, security monitoring and GitHub integration settings.

The CLI supports Ollama, OpenAI, Anthropic Claude, OpenRouter, Google Gemini, DeepSeek, Groq, Together AI, LM Studio, llama.cpp, vLLM and compatible OpenAI chat API endpoints. Prompts go directly from the CLI to the user's LLM provider; dashboard-synced prompts and model configurations are encrypted at rest with Fernet (AES-256). The CLI can also run fully offline with a local Ollama model, with zero network calls and zero telemetry, which suits users who prioritize keeping scans local.

Installation is through pip, with an npm wrapper for Node projects and CI pipelines. The CLI requires Python 3.10 or higher, and the npm wrapper shells out to that Python CLI, so Node users still need to account for the Python dependency. AgentSeal supports API, Linux, macOS, web and Windows platforms. The team typically responds within 24 hours and provides an email address for urgent matters.

Pricing

AgentSeal is freemium. The Free plan costs free and includes 30 basic probes, the MCP registry, Guard and Watch. It is a useful entry point for basic checks and monitoring, but gives up the 311-probe coverage, runtime MCP scanning with OAuth, PDF export and dashboard included in Pro.

The Pro plan has custom pricing. Its 311 probes and runtime MCP scanning with OAuth are better suited to teams needing fuller testing, while PDF export and dashboard access support reporting and ongoing management. No seat limits, quotas, trial terms or renewal conditions are given.

Platforms

AgentSeal is available across API, Linux, macOS, web and Windows. Its CLI and pip installation make it a natural fit for developers working in Python-based environments; Node projects can use the npm wrapper, but it depends on the Python CLI.

Who it's for

AgentSeal is a strong fit for teams building or operating AI agents and MCP servers that need adversarial checks, configuration monitoring and CI-oriented results in one toolkit. It is especially relevant when local Ollama-based offline scanning or authenticated remote MCP testing matters. Readers who need broad probe coverage should budget for Pro; those seeking only a small number of basic checks can start with Free.

Pros and cons

• Pro: Prompt, configuration and MCP checks span multiple agent risks, rather than focusing on prompts alone.
• Pro: Offline local scanning with Ollama and stated zero telemetry supports workflows that avoid network calls.
• Pro: SARIF, JUnit, GitHub summaries and pull-request policies support CI integration and gating.
• Con: Free is capped at 30 basic probes, well short of the 311-probe Pro coverage.
• Con: The CLI requires Python 3.10 or higher, including when the npm wrapper is used.
• Con: Pro uses custom pricing, so teams cannot weigh its cost against their coverage needs in advance.

Alternatives

Promptfoo is worth choosing instead when a reader wants 10k red-team probes per month on a free plan, all LLM evaluation features and local or self-hosted operation.

ProofLayer may suit teams prioritizing a CLI-and-MCP scanner with 1,700+ detection rules and a community rule library under an MIT license.

Darkhunt AI Security is another freemium option for readers comparing AI security platforms.

Giskard is a relevant alternative for users seeking an open-source library, local deployment and basic LLM vulnerability scanning with adversarial techniques from 2024.

Confident AI may fit teams that prefer a platform with defined seats and test-run limits: its free plan has 2 user seats, 1 project and 5 test runs per week.

Rogue is another freemium alternative for readers considering a self-hosted option.

NVADER offers a web-based freemium alternative.

OpenSecureAI Scanner may be preferable when a reader needs a published Pro price and a defined API allowance: its Pro plan is $49 a month for 50,000 API requests per month.

Verdict

Choose AgentSeal if you need a broad AI-agent security workflow that combines prompt and MCP testing, configuration monitoring and CI-ready outputs, particularly with offline or authenticated-server scanning. Its chief drawback is the gap between 30 basic free probes and Pro’s broader coverage, compounded by custom pricing. Readers who need predictable costs or a more specialized evaluation workflow should compare alternatives before committing.