Correctover · AI Reliability™ — Agent Runtime Assurance

Free AI Agent Security Scanner

Scan an MCP configuration or an entire agent codebase / npm package for critical security patterns — hardcoded secrets, plaintext endpoints, SSRF/metadata access, shell injection, dynamic eval, missing permission gates, timeouts and kill switches. Findings map to OWASP AISVS 1.0.

🔒 Runs 100% in your browser — your files never leave your machine. No upload, no account, no telemetry. Safe for closed-source and unreleased code.

The automated scan is a free signal check, not an audit or certification — see the notice in every report. OWASP® and AISVS are trademarks of the OWASP Foundation; Correctover is not affiliated with or endorsed by OWASP.

① MCP config scanpaste JSON / .mcp.json
② Codebase / package scandrag a project folder or .js/.tgz

Paste your MCP client config (mcp.json, .cursor/mcp.json, Claude/Cline/Vscode-style):

📁
Drop your project folder here or click to choose
Accepts a folder, one or more .js / .mjs / .cjs / .ts files, or an unpacked npm package.
node_modules and dot-files are skipped. Tip: npm pack <pkg> && tar xzf to audit any published package.

Your report is ready.

Free report, no gate: download or open in a new tab the full findings, or use the 🖨 Print / Save as PDF button in the report — no email needed.

Shipping for a vendor, client, or compliance review? Leave a work email and we reply with the three artifacts this automated scan cannot produce:
① Officially delivered report from a manual deep audit under a signed engagement (the printable free report is a signal check, not a certification — it must not be filed as vendor-acceptance evidence);
② AISVS mapping workbook — how each finding maps to OWASP AISVS 1.0 control families, with the chapters this scanner does not cover (training data, model lifecycle, adversarial robustness, human oversight);
③ Version-provenance setup guide — signed manifests anchored to the Sigstore Rekor transparency log for tamper-evident release records (anchor proves existence of a snapshot, not safety).

No spam, no mailing list — one human reply, usually within one business day.