Background Check for AI Agents

Discover, assess, red-team, and enforce security across your AI agents — and the MCP supply chain behind them. Local-first. No account required.

You wouldn't hire someone without a background check. Why would you deploy an AI agent without one?

npx @guard0/g0 check        # is anything on this machine known-malicious?
npx @guard0/g0 scan .       # background-check an agent codebase

One command. Sixty seconds. It finds every AI tool, MCP server, and installed skill on your machine — including the Claude supply chain: skills, plugins, subagents, hook commands, Desktop extensions — checks them against the known-malicious database (ClawHavoc campaign IOCs, malicious MCP servers, infostealer artifacts) and injection/dropper heuristics, and hands you a grade — capped at F with exit code 1 if anything known-bad is found.

AI agents — and the tools, MCP servers, and models behind them — ship faster than anyone can track. g0 background-checks the whole estate: it discovers every component on a laptop, in a repo, in CI, and across a fleet, grades it against 1,128 rules in 12 domains, red-teams behavior with 1,200+ payloads, enforces policy on live MCP traffic, and hands you a signed, standards-mapped record you can give an auditor.

The report card

Every scan ends in a grade you can act on — not a wall of findings:

  ./my-banking-agent  ·  langchain (+mcp)  ·  14 files  ·  1.2s

  CRITICAL  Shared memory between users            main.py:8   [AA-DL-046]
            Fix: isolate memory per user_id/session.  OWASP:ASI07
  HIGH      System prompt has no scope boundaries   main.py:21  [AA-GI-001]
            Fix: add role, task boundaries, output constraints.
  HIGH      Database tool without input validation  tools.py:34 [AA-TS-002]
  + 18 more across 12 domains

  CRIT 2   HIGH 5   MED 6   LOW 6   INFO 2         Total: 21

  Goal Integrity   ██████████████████░░░░░░░░░░  60
  Code Execution   ████████████████░░░░░░░░░░░░  52
  Data Leakage     █████████████████████████░░  82

  ─────────────────────────────────────────────────────
  C   ████████████████████████████░░░░░░░░  68
  ⚠  Grade capped: 2 critical findings present

The grade is capped when criticals are present, so a project with serious issues can never read as healthy — no matter how clean the rest looks. Every finding carries a one-line fix and maps to OWASP, NIST, ISO 42001, and the EU AI Act.

What a background check covers

Point scanners check one repo. g0 covers the surfaces attackers actually use — the developer endpoint, the MCP supply chain, and the whole fleet — and keeps re-validating as things change.

	Surface	What it does
🖥️	Endpoint	Discover the 19 AI dev tools & MCP servers on a machine — plus agentic browsers (--agentic-browser) and known-malicious servers (endpoint quarantine, dry-run by default). No server-side scanner can see this.
🔬	Scan	1,128 rules across 12 domains, taint tracking, cross-file exfil analysis, and an A–F grade — for Python, TS/JS, Java, and Go.
🧪	Red-team	1,200+ adversarial payloads, a 4-level judge cascade, and CVSS scoring against a live agent, HTTP endpoint, or MCP server.
🔌	MCP supply chain	Assess MCP servers from config + source, score per-skill trust, detect rug-pulls, and verify a package before you install it.
🛡️	Runtime proxy	Sit in the live path with a confidence-scored engine: checksum-validated secret detection, Exact-Data-Match, dataflow provenance — deny, redact, coach, or alert on every tool call.
🔒	Protect	One command that installs the guardrails — MCP proxy routing, known-malicious quarantine, and Claude Code hook enforcement covering built-in Bash/file-write tools no MCP proxy can see. Dry-run first, fully undoable with protect off — plus a resident watcher that keeps re-checking after the terminal closes.
📦	Inventory	A signed CycloneDX 1.6 AI-BOM of every model, tool, agent, and MCP server — content-addressed so it diffs across releases.
🛰️	Fleet	Estate roll-up and drift across every repo and machine you track, with signed attestation packs for audit.
🛰️	Sentinel (preview)	Push g0 to every machine through your MDM (g0 sentinel scan): unattended AI-footprint snapshots for fleet inventory, PII-exposure, and governance. → solution brief
🧩	Inside your IDE	Run g0 as an MCP server (g0 mcp serve) so Claude Code, Cursor, and Windsurf can scan and vet servers from the chat.

60-second tour

g0 check                                 # the background check: estate + skills vs known-malicious DB
g0 protect --apply                       # install the guardrails: proxy routing + quarantine, undoable
g0 endpoint                              # audit AI tools & MCP configs on this machine
g0 scan ./my-agent                       # graded security assessment (1,128 rules)
g0 proxy install                         # route your IDE's MCP servers through g0
g0 test --target http://localhost:3000/api/chat   # red-team a live agent
g0 inventory . --cyclonedx --sign-key k  # signed AI Bill of Materials
g0 gate . --min-score 80                 # fail CI on policy violations

🛡️ Runtime enforcement — g0 proxy

Static scanning tells you a server looks risky. The proxy sits on the live stdio traffic between your IDE/agent and the real MCP server, and makes a confidence-scored decision on every request and response — not shallow regex matching:

• Validator-gated secrets — Luhn/IBAN/vendor-key checksums (AWS, OpenAI, GitHub, Slack, JWT). A candidate that fails its checksum produces no finding.
• Exact-Data-Match — fingerprint real secrets once (g0 proxy fingerprint, salted hashes only); the proxy then catches that exact data anywhere in traffic, including exfil attempts.
• Provenance / dataflow — flags sensitive data that leaves one tool's response and reappears in a different tool's request — the confused-deputy pattern — including reads of ~/.ssh and .env.
• Graduated outcomes — every signal fuses into one calibrated score, mapped via deny > redact > coach > alert > allow. coach warns loudly but never blocks — built for corroborated-but-not-certain signal.

g0 proxy install                                   # route an IDE's MCP servers through g0 (backs up configs)
g0 proxy fingerprint prod-secrets.txt --name prod  # EDM index — plaintext never persists
g0 proxy status                                    # proxied servers + denied / redacted / coached (24h)

Fail-open by design — it never bricks your IDE. version: 1 policies keep working byte-identically. → docs/runtime-proxy.md

Coverage

12 Security Domains Goal Integrity · Tool Safety · Identity & Access · Supply Chain · Code Execution · Memory & Context · Data Leakage · Cascading Failures · Human Oversight · Inter-Agent · Reliability Bounds · Rogue Agent	10 Compliance Standards OWASP Agentic Top 10 · NIST AI RMF · ISO 42001 · ISO 23894 · OWASP AIVSS · OWASP Agentic AI Top 10 · AIUC-1 · EU AI Act · MITRE ATLAS · OWASP LLM Top 10
10 Framework Parsers (+ generic fallback) LangChain/LangGraph · CrewAI · OpenAI Agents SDK · MCP · Vercel AI SDK · Amazon Bedrock · AutoGen · LangChain4j · Spring AI · Go AI	Deep analysis Pipeline taint tracking · cross-tool correlation · cross-file exfiltration · analyzability scoring · description-behavior alignment · multi-ecosystem threat feed

1,128 Security Rules

1,200+ Attack Payloads

25 Attack Categories

19 Dev Tools Detected

5 Languages

Use it in CI & your IDE

GitHub Actions — scan, gate, upload SARIF, and post a sticky PR comment with a severity table and score delta:

- uses: guard0-ai/g0@v2
  with:
    path: '.'
    min-score: '70'
    fail-on: 'high'

Any CI — g0 scan . --junit results.xml emits JUnit XML that Jenkins, GitLab, and CircleCI render natively. g0 gate . --baseline fails only on findings new since your baseline — adopt g0 without drowning in pre-existing debt.

Pre-commit — g0 init --hooks generates the hook for your setup (husky, lefthook, or standalone .git/hooks), auto-detected.

Claude Code / Cursor / Windsurf — let your agent run g0 directly:

claude mcp add g0 -- npx -y @guard0/g0 mcp serve

See docs/ci-cd.md and docs/mcp-server.md.

Connect to the Guard0 Platform

g0 is offline-first — everything above runs locally with no account. Signing in is optional (g0 login) and unlocks a premium real-time threat feed plus org-wide dashboards on the Guard0 Platform. It never uploads your scans and never blocks a scan. → docs/platform.md

Commands

Command	Purpose
g0 check [path]	One-command background check — endpoint estate + installed skills vs the known-malicious DB, graded; exit 1 on malicious
g0 endpoint	Discover AI dev tools & MCP server configs — --agentic-browser, quarantine [--apply/--undo]
g0 scan [path]	Security assessment with A–F grading — --json, --sarif, --junit, --ci
g0 test	Adversarial red-teaming — 1,200+ payloads, CVSS scoring
g0 proxy install/status/fingerprint	Runtime enforcement on live MCP traffic — deny/redact/coach/alert
g0 mcp [path] / mcp serve / mcp audit-skills	Assess MCP servers · run g0 as an MCP server · per-skill trust audit
g0 inventory [path]	AI-BOM — signed CycloneDX 1.6, content-addressed
g0 fleet scan/status/drift/list	Estate roll-up and drift across repos & machines
g0 attest [path]	Signed, standards-mapped attestation pack
g0 flows [path]	Execution-path mapping and toxic-flow detection
g0 gate [path]	CI/CD gate — thresholds + diff-based regression mode
g0 rules list/describe	Browse all 1,128 rules; inspect any rule's checks & standards
g0 daemon	Background monitoring — running-agent watcher, cognitive-file drift checks
g0 detect	MDM enrollment, running AI agents, host hardening posture
g0 init [--hooks]	Create .g0.yaml · generate pre-commit hooks (husky/lefthook/standalone)
g0 config validate	Validate .g0.yaml / policy config before CI does
g0 login / logout / whoami	Connect the CLI to your guard0.ai account (optional)

Every command supports --json. Full reference in the docs.

Documentation

Getting Started	Runtime Proxy
Rules Reference · Custom Rules	MCP Security · g0 as an MCP Server
Scoring · Findings	Endpoint Assessment
AI Inventory · Attestation	Fleet Control Plane · Fleet Sentinel
Dynamic Testing	CI/CD Integration
Compliance Mapping	Platform & Authentication
Frameworks · Architecture	OpenClaw Security · Deployment
Programmatic API	Enforcement Integrations
Validation Report	FAQ · Glossary

Contributing

See CONTRIBUTING.md for adding rules, framework parsers, and submitting PRs.

git clone https://github.com/guard0-ai/g0.git && cd g0
npm install && npm test && npm run build

---

_{An open-source project by Guard0. The background check is just the beginning — for complete accountability across your fleet, see the Guard0 Platform.}