AgentShield: Security scanner for AI agent tools and MCP servers

[elliotllliu]

Built AgentShield to scan AI agent tools and MCP servers for security vulnerabilities before loading them.

Relevant for Vercel AI SDK users who use tool calling — third-party tools can contain backdoors, data exfiltration, or prompt injection.

Features:

• 30 security rules with AST taint tracking
• Cross-file data flow analysis + kill chain detection
• Multi-language prompt injection (8 languages, 55+ patterns)
• JSON output for CI/CD integration
• 100% offline, zero install, MIT licensed

Results: Scanned 493 Dify plugins — found 6 real backdoors, 0 false positives.

npx @elliotllliu/agent-shield scan ./my-tool/ --json

Integration guide for platforms: https://github.com/elliotllliu/agent-shield/blob/main/docs/integration-guide.md

📦 https://www.npmjs.com/package/@elliotllliu/agent-shield

[github-actions[bot]]

This discussion was automatically closed because the community moved to community.vercel.com/ai-sdk