Agent Security Audit Kit: 35 controls for auditing AI agents, plus an MCP OAuth audience-claim pitfall
alvelda · x · 2026-11-05
The author of Agent Field Kit shares an open Agent Security Audit Kit and flags a common MCP pitfall: when running an MCP server over HTTP with OAuth, checking that a token is valid isn't enough — verify the audience claim, or tokens minted for other apps on the same identity provider will get in.
The kit bundles:
- A 5-phase audit methodology with 35 controls mapped to OWASP Top 10 for LLM Applications 2026 and NIST AI RMF
- Evidence templates, an audit report template, and a scoring script (scoreaudit.py)
- A read-only MCP config scanner (scanmcpconfig.py) that never prints secret values
- Cyber watch updates from Oct 23–28, 2026, plus a printable PDF
Runs on Python 3.9+ with no installs; both scripts include selftests, so you can audit a real MCP client config today.
Related event: MCP over HTTP exposes OAuth audience validation flaw(2 posts)→
More from coding & agent
- Revolut cut AI coding inference costs ~90% by self-hosting GLM on 56 B200s instead of Claude — sebkrier · 2026-11-05
- VibeCoding a 3D fishing game in 4 days with Kimi K3.1 Pro and DeepSeek: full workflow breakdown — lxfater · 2026-11-05
- Sentry founder says AI agent 'junior' handles hardest coding tasks well — zeeg · 2026-11-05
- How Codex Happened: Inside OpenAI's coding comeback from failed launch to ChatGPT centerpiece — danshipper · 2026-11-05
- Tencent Hunyuan Hy4 lands in OpenClaw with vision, 1M-token context, agent gains — TencentHunyuan · 2026-11-05
- Dev shows Claude Code workflow that builds sites with no obvious 'AI slop' — randomname11111_ · 2026-11-05