AgentShield is a security auditor for AI agent configurations. It scans a Claude Code setup (settings, hooks, MCP server definitions, agent and skill files, and CLAUDE.md) for hardcoded secrets, overly broad permissions, hook injection, risky MCP servers, and prompt-injection vectors, then prints a graded report. It runs as a CLI, a GitHub Action, and a GitHub App integration, and belongs to the ECC ecosystem.
The scanner applies 268 rules across 15 modules. Each category starts at 100 and only findings deduct from it (critical 25, high 15, medium 5, low 2), giving an A to F grade. Protective configuration it finds, such as deny lists, sandbox settings, and blocking PreToolUse hooks, is listed as recognized defenses but never adds points. Findings carry a runtime-confidence label that separates active runtime config from project-local settings, templates, docs examples, and plugin caches, and template findings are down-weighted so a shipped MCP catalog does not score like dozens of enabled servers.
| Module | Rules | Examples |
|---|---|---|
| Permission audit | 17 | wildcard tool access, missing deny lists, destructive git commands |
| Hook analysis | 40 | command injection, data exfiltration, reverse shells, log tampering |
| MCP server security | 49 | shell or filesystem MCPs, unpinned auto-installs, auto-approve settings |
| Agent config review | 41 | hidden instructions, prompt reflection, auto-run directives |
An optional deep-analysis mode runs a three-agent Claude Opus pipeline: a red-team attacker looks for exploitable chains, a blue-team defender evaluates existing protections, and an auditor merges both into a prioritized risk assessment. The package also bundles MiniClaw, a minimal sandboxed agent runtime that exposes a single HTTP endpoint with rate limiting, prompt sanitizing, a tiered tool whitelist, and an isolated per-session filesystem.
Features
- Secrets detection: API keys for Anthropic, OpenAI, xAI, AWS, Google, and Stripe, plus GitHub, Slack, and Linear tokens, JWTs, database connection strings, and private keys
- Auto-fix with verification: replaces hardcoded secrets with environment references and tightens wildcard permissions, then re-scans and rolls back any change that lowers the score
- Supply-chain checks: MCP package provenance (npm vs git, pinned vs unpinned) and package-manager configs for plaintext credentials and missing release-age cooldowns
- Persistence indicators: flags AI developer-tool persistence surfaces used by npm and PyPI malware campaigns, such as hook settings, editor task automation, and workflow drop-ins
- External rule packs: community or private JSON rule packs with regex patterns run alongside the built-in rules and count toward the grade
- Secure init: generates a hardened Claude configuration directory with scoped permissions and safety hooks without overwriting existing files
- Opus deep analysis: attacker, defender, and auditor agents produce a prioritized risk assessment, optionally routed through the OrcaRouter gateway
- Compliance mapping: maps findings to SOC 2, PCI DSS, and ISO 27001 control IDs with a per-control coverage table
- Output formats: terminal, JSON, SARIF, markdown, HTML reports, and portable evidence packs, plus an organization policy gate for CI
- Harness adapters: reports local marker evidence for Claude Code, OpenCode, Codex, Gemini, Zed, VS Code, and dmux setups
- MiniClaw runtime: a sandboxed agent runtime with one HTTP endpoint, injection-pattern stripping, and restricted tools disabled by default
