NewEvery ASGO detection rule is now mapped to the OWASP Agentic Security Initiative.Read the mapping
Try it · Review anything
Scan any agent, skill or MCP server.
Paste a GitHub URL, a skill link, a package, an install command, an MCP endpoint or an mcpServers config. The engine works out what it is, reads every agent manifest and server it finds, and shows what it would do to your machine and cloud.
Auto-detects GitHub repos, SKILL.md and ClawHub links, npm and PyPI packages, install commands, MCP endpoints, mcpServers JSON, images and registry names.Scan as
Or drop a folder, a .zip or single manifestsStaged in an isolated directory · archives unpacked with traversal and bomb guards. A folder sends only what agents read — AGENTS.md, CLAUDE.md, .cursor/, .claude/, MCP configs, skills and Markdown. Source code and .env files stay on your machine.
Private repositories
A private repo is read through the GitHub App on your account. Nothing is executed and nothing is deployed.