OWASP AISVS v1.0 (released 24 June 2026) defines 12 requirement chapters across the AI lifecycle, with requirements at verification levels 1–3. The free scanner runs 31 static checks (14 for MCP configurations, 17 for code/bundles). This page states honestly which chapters those checks touch, and which they do not.
| Chapter | AISVS v1.0 requirement chapter | Free scanner |
|---|---|---|
C1 | Training Data Integrity & Traceability | ○ Not covered |
C2 | Input Validation (prompt-injection defenses, content screening) | ● Static signals |
C3 | Model Lifecycle Management & Change Control | ○ Not covered |
C4 | Infrastructure, Configuration & Deployment Security | ● Static signals |
C5 | Access Control & Identity | ● Static signals |
C6 | Supply Chain Security for Models, Frameworks & Data | ◐ Partial signals |
C7 | Model Behavior, Output Control & Safety Assurance | ◐ Partial signals |
C8 | Memory, Embeddings & Vector Database Security | ○ Not covered |
C9 | Autonomous Orchestration & Agentic Action Security | ● Static signals |
C10 | Model Context Protocol (MCP) Security | ● Static signals |
C11 | Adversarial Robustness & Attack Resistance | ○ Not covered |
C12 | Monitoring, Logging & Anomaly Detection | ◐ Partial signals |
| Chapter | Checks (static patterns, with file/line locations) |
|---|---|
C10 MCP Security | TLS / plaintext HTTP endpoints MCP transport authentication SSRF: cloud metadata & internal addresses (169.254.169.254, RFC1918 ranges) |
C9 Agentic Action | Timeout / interruption signals Tool allowlists & permission gates Kill switch / AbortController Token / cost budgets (semi-automated) |
C5 Access Control | Hardcoded credentials & API keys Credential flow via environment variables |
C4 Infrastructure | Subprocess execution (shell:true, exec) Dynamic code execution (eval / Function / vm) Sandbox / isolation mechanisms |
C2 Input Validation | Input validation & schema enforcement |
C7 Output Control | Output truncation / filtering (semi-automated) |
C6 Supply Chain | Dependency version pinning / vendor SBOM signals (semi-automated) |
C12 Monitoring | Audit logging / telemetry (semi-automated) Error handling & retry policy (semi-automated) |
C1 (training data), C3 (model lifecycle/change control), C8 (memory, embeddings, vector databases) and C11 (adversarial robustness) cannot be assessed by static pattern matching on client code and MCP configs — they concern data provenance, model artifacts, embedding pipelines and runtime attack resistance. Even within the 8 chapters touched, the scanner sees surface signals only: it does not prove reachability, exploitability, or whether a flagged pattern is a real vulnerability versus a safe/legitimate use. Library code (including this scanner itself) contains patterns like child_process and credential-matching regular expressions that are detection logic, not vulnerabilities — expect false positives, and false negatives.
The 116-check manual deep audit works from the scanner's raw signals and traces each one through real call paths — reachability, exploitability, semantic intent, prioritized remediation — under a signed engagement. It still does not certify AISVS; it delivers an opinion scoped to the code and timeframe agreed.
Not an audit or certification. The free scanner's output is automated static analysis. It is not a security audit, penetration test, certification, or statement of compliance with AISVS or any other standard. No score — including a clean scan — constitutes evidence that a system is secure, vulnerability-free, or compliant.
OWASP trademarks. OWASP® and AISVS are trademarks of the OWASP Foundation. Correctover is an independent project, not affiliated with or endorsed by OWASP. OWASP does not certify products or vendors. The chapter mappings on this page are Correctover's own, provided for navigation only.
Use at your own risk. The scanner and reports are provided "as is", without warranty of any kind. To the maximum extent permitted by law, Correctover shall not be liable for damages arising from their use. Do not rely on a free scan as the sole basis for acceptance, procurement, release, insurance, or regulatory decisions.