Aguara Watch

Scan Any AI Agent Security Vulnerabilities

The same engine monitoring 58,000+ skills and MCP servers daily.

Runs locally in your browser via WebAssembly. Nothing is uploaded.

Supports repositories, directories, single files, and raw.githubusercontent.com URLs

100% client-side via WASM · Open source — Apache-2.0 · Nothing is uploaded
Works on Chrome Firefox Safari Edge

58K+

Skills & MCP servers scanned

7

Registries monitored daily

188+

Detection rules

15

Security categories

What the scanner detects

Every scan checks for vulnerabilities across 15 security categories

Prompt Injection Credential Leaks Command Execution Data Exfiltration Indirect Injection MCP Attacks MCP Config SSRF / Cloud Supply Chain Third-Party Content Toxic Flow External Downloads

How it works

Three steps to find security vulnerabilities in any AI agent skill, MCP server, or configuration file.

Step 1

Provide a source

Enter a GitHub URL, paste content directly, or drag and drop a file.

Step 2

Scan locally in your browser

Aguara runs via WebAssembly. No server, no uploads. Your code stays in your browser.

Step 3

Get your security report

A-F grade, severity breakdown, and downloadable JSON or HTML reports.

Why scan your AI agent tools?

AI agents can execute code, access files, and make network requests on your behalf. A malicious or poorly written skill can leak credentials, exfiltrate data, or run arbitrary commands on your system. Scanning before installing catches these risks before they become incidents.

Prompt injection

Hidden instructions can hijack your AI agent and override its behavior.

Credential theft

Skills can contain or request API keys, tokens, and secrets from your environment.

Code execution

Malicious tools can run shell commands or download scripts on your system.