Tool reach
Which agent can touch what?
Tools are wired to agents in source. A research agent with a code tool holds more authority than its role name suggests.
Static security assessment · Python AI agents
Understand what your agents can reach.
Inspect tool access and delegation before you ship. AxiomGate reads your agent source without running it, maps which agents can reach which tools and who can hand work to whom, and delivers source-linked findings, their limits and practical next steps.
For engineering and security teams building with LangGraph, CrewAI, AutoGen or Swarm. Coverage depends on the patterns present in your code.
- Your application is never executed
- Open questions stay open
- Bounded audits from $290
allow_delegation=True is a separate, unbounded setting. The scan does not execute the fixture. Read the fixture source. Run this fixture in live scanner What it finds
A task can travel further than its permissions should.
Agents call tools and hand work to other agents. Reviewing each prompt in isolation leaves the important question unanswered: what authority can the whole system reach? That is decided in code, and code is what AxiomGate reads.
Delegation
Who can hand work to whom?
Delegation lets input that reached one agent travel to another agent’s tools. The path matters more than any single agent.
Inherited authority
Is authority narrowed on the way?
If nothing in the code narrows what a delegate may do, the assessment says so, and says when the source could not tell.
How it works
From source to an actionable assessment.
Every finding traces back to a file and a line. Nothing is learned by running your system, and every step states what it could not settle. Read the methodology and its limits →
- Inspect sourceAn accepted Python repository snapshot is parsed into syntax trees. Nothing is imported or executed.
- Map authoritySupported agents, tool bindings and delegation relationships are extracted with file and line.
- Assess supported propertiesRecognised authority and execution patterns become findings. Unresolved questions stay visible as open.
- Deliver findings and next stepsSource-linked evidence, stated limitations and a remediation roadmap your team implements.
What is inspected
- Python
.pyfiles in the accepted source snapshot - Agents, tool bindings and delegation, with framework adapters for LangGraph, CrewAI, AutoGen and Swarm
- Other Python agent patterns through a generic adapter, with its coverage limits disclosed
- Tools whose own code reaches process execution, file or network capabilities
What it does not establish
- Runtime behaviour: your application is never run, so no external effect is observed
- Non-Python source and MCP configuration files
- General untrusted-input-to-sink dataflow
- Proof of safety: an absence of findings is not a clean bill of health
Reading a result
Six states. Only one of them is a safety claim.
Every posture-critical question in a report lands in exactly one of these states. An open question is printed as open; it never reads as a pass.
- OBSERVED_SAFEobserved — no issue found
- The detector ran and saw positive evidence of safety. The only state that supports a safety claim.
- OBSERVED_UNSAFEobserved — issue found
- The detector ran and saw positive evidence of a defect.
- UNKNOWNlooked at, not settled
- The detector ran, but the source did not settle the question. Neither safe nor unsafe.
- NOT_OBSERVEDnot reached
- The detector exists, but nothing it applies to was reached in this scan.
- UNSUPPORTEDno detector in this build
- No detector for this property exists yet. Reported so the gap is visible.
- NOT_APPLICABLEcannot arise here
- The property cannot arise in what was scanned.
Why this matters for the grade. A and B grades are safety claims. When a posture-critical property is left UNKNOWN, NOT_OBSERVED or UNSUPPORTED, those grades are withheld rather than awarded. The demo fixture below scores C on its findings, and its unsettled delegation-attenuation question is still printed as UNKNOWN next to that grade.
Public repository scan · free
See what the analysis can tell you.
- 1Pick a subject. Paste a public GitHub repository with Python agent code, or run the demo fixture, a small CrewAI system with three agents.
- 2We read, we don’t run. The public archive is fetched read-only and its Python files are parsed. Nothing in it is imported or executed. Scans are time-limited and rate-limited.
- 3Read the preview. Framework, agents and tools, selected signals with their source location, and what the scan could not cover.
Before you paste a URL: the teaser accepts public GitHub repositories and analyzes Python .py files. Do not paste private code, credentials or tokens anywhere on this site.
The preview shows
- Recognised agents, tools and signal counts
- Selected signals, each with its location and what it cannot claim
- Coverage limitations and unsettled questions
It does not establish
- That the repository is safe
- Anything about runtime behaviour
- The full finding set: the preview is a selection
A paid assessment adds
- Every finding with its delegation path
- The property assessment record and a remediation roadmap
- Executive Security Report and Audit Vault ZIP
What you receive
A decision brief backed by source evidence.
A point-in-time assessment of the agreed source snapshot, written for the people who decide what ships and for the engineers who fix it.
- Executive Security Report (PDF): assessed scope, findings and outstanding questions
- Posture score (0–100), an architectural heuristic, with an OWASP LLM Top 10 mapping
- Audit Vault ZIP with machine-readable evidence: JSON, SARIF, CSV, Markdown and an HTML topology view
- Actionable remediation roadmap and engineering next steps
- Property assessment record: every open question listed as open
- SHA-256 manifest protected by an HMAC, so you can check the files were not altered
- One re-scan within 30 days for Multi-Agent System, Agent Fleet and Enterprise Bounded
A synthetic four-page example of the report format, with no client information. Its simplified score is not a current customer assessment. The integrity manifest supports tamper checks; it is not a certification.
AXIOMGATE EXECUTIVE AUDIT / SAMPLE
SECURITY & GOVERNANCE
Know your
agent’s boundaries.
85/100
B / ACCEPTABLE
Deterministic posture
Deterministic posture
Lead AuditorRobin Svensson
ScopeMulti-agent architecture
DeliverableEvidence + remediation
- 01 · SCOPEChoose a tierBy agent count and tool surface. The recommendation comes from your answers, not from a scan.
- 02 · CHECKOUTVerified paymentStripe Checkout, or an invoice handled by an operator.
- 03 · INTAKEBounded sourceA sanitized snapshot or a read-only repository connection, inside the published limits.
- 04 · DELIVERYReport and evidenceExecutive report and Audit Vault ZIP, with the integrity manifest.
Automated fulfillment path: bounded tiers run automatically after verified card checkout and available source. Enterprise Custom is reviewed by a person before delivery, and invoice orders are handled by an operator. The assessment never changes your code or installs anything in your system.
Trust and limitations
Know what the evidence can support.
An audit is a point-in-time assessment of an agreed source snapshot. Its limits are stated as plainly as its findings. Methodology and limitations →
Source-linked
Every finding points to source
Each finding names its rule, its file and line, its evidence state and what it cannot claim. You can check every one against your own code.
Open questions
Unknown stays unknown
Unresolved relationships and unsupported properties are reported as gaps, and A and B grades are withheld while posture-critical questions are open. Paying for a larger tier does not remove these limits.
Source handling
Explicit source handling
No credentials are needed and none should be sent. Source access and retention are agreed for the engagement; source snapshots, reports and order records are separate data classes. Read the privacy notice.
Public components
Separate, inspectable components
AxiomGate Lint (MIT) discovers a narrow CrewAI delegation pattern in CI. The private AxiomGate analyzer performs the assessment you buy. AxiomGate Kernel (source-available) governs execution paths explicitly integrated with it. An audit does not install the Kernel or any runtime control in your system.
How to read the claims on this site
These labels are not synonyms. Each claim on this site belongs to exactly one of them, and a weaker class is never presented as a stronger one. They describe how a claim was established — they are not a ranking.
- TESTED
- An automated test in the published suite exercises this behaviour and fails if it regresses.
- OBSERVED
- A specific scan of a specific named subject produced this result. It is one observation, not a general property.
- BENCHMARKED
- Measured against a held-out benchmark whose answers were not visible to the analyzer during the run.
- MODEL CHECKED (bounded)
- A TLA+ specification was exhaustively checked over a deliberately small configuration. It is evidence about the model, not about the running code.
- FORMAL PROOF
- A machine-checked proof over an unbounded domain. No AxiomGate claim falls in this class.
- INFERRED
- Derived from static structure rather than directly witnessed. Each such finding states what it cannot conclude.
- NOT ASSESSED
- The analyzer did not settle this question. It does not mean safe, and it does not mean unsafe.
Formal scope: The governance model has undergone bounded TLA+ model checking (373,933 states generated; 345,322 distinct; depth 11; invariants I1–I10 held in the checked run, published configuration). This is model evidence about a specification, not a proof that any application is secure, and no refinement relation to the implementation has been established. The specification, configuration and run log are published. The kernel is source-available under PolyForm Noncommercial 1.0.0; commercial audits use dedicated enterprise licenses. The AST linter is open-source under MIT.
Commercial terms — price, delivery, re-scan and fulfillment — are contractual statements. They are not analyzer output and carry none of the classes above.
Pricing and scope
Choose the scope that fits your system.
Agent count sets the starting tier. The range is shown before checkout, checkout charges the published starting amount, and you confirm the scope before you pay. Ongoing engagements are on Services.
- EVERY TIER
- Executive Security Report
- Audit Vault ZIP
- Remediation roadmap
- Scope confirmed before you pay
- Your code is never executed
01 · Dual-Agent
Dual-Agent
$290–$490 USD
1–2 agents · limited tool surface
- For
- A single agent pair, or a first agent feature before launch.
- Assessed
- Tool access, capabilities and any delegation between the agents.
- You receive
- Executive Security Report, Audit Vault ZIP and remediation roadmap.
- Delivery
- Automated, under 3 minutes target*. Optional 24h human fast-path for +$190.
- Re-scan
- Not included.
02 · For multi-agent teams
Multi-Agent System
$590–$990 USD
3–5 agents · delegation and routing
- For
- Crews and graphs where agents hand work to each other.
- Assessed
- The same analysis, across the delegation graph between agents.
- You receive
- Executive Security Report, Audit Vault ZIP and remediation roadmap.
- Delivery
- Automated, under 3 minutes target*, within published bounds.
- Re-scan
- One within 30 days.
03 · Fleet
Agent Fleet
$990–$1,990 USD
6–9 agents · broader tool access
- For
- Larger Python agent systems with many agents and tools.
- Assessed
- The same analysis, applied to a larger source and tool surface.
- You receive
- Executive Security Report, Audit Vault ZIP and remediation roadmap.
- Delivery
- Automated, under 3 minutes target*, within published bounds.
- Re-scan
- One within 30 days.
04 · Bounded enterprise
Enterprise Bounded
$2,490 USD
Exactly 10 agents · defined source boundary
- For
- A ten-agent system with a clear source boundary and a fixed price.
- Assessed
- The same analysis, across a ten-agent topology.
- You receive
- Executive Security Report, Audit Vault ZIP and remediation roadmap.
- Delivery
- Automated, under 3 minutes target*, within published bounds.
- Re-scan
- One within 30 days.
What changes the scope or price
The number of agents sets the tier. A tool whose code can execute commands or processes raises the recommendation one step, up to Agent Fleet. More agents or repositories after checkout require a separately confirmed scope.
When a system cannot be assessed confidently
Open questions are printed as UNKNOWN or UNSUPPORTED and positive grades are withheld. If a scan establishes too little to scope the work, no price is quoted. A higher tier never turns an unsupported structure into a safe one.
Enterprise Custom
More than 10 agents, several repositories or a bespoke scope. A person confirms the scope and reviews the report before delivery.
Request Enterprise Custom review ↗Specialist and ongoing services
Architecture remediation advice, continuous re-assessment and fast-path delivery, by email inquiry.
See Services ↗Delivery and payment: *Timing is a target, not a guaranteed service level. The automated path targets under 3 minutes after verified checkout and available source; larger sources may take longer within the published limits. Private GitHub repositories use a read-only connection and the same automated path when source and scope fit the published bounds. Stripe Checkout shows the payment methods eligible for your country, currency and device. Invoice orders through Frilans Finans are handled manually by an operator: [email protected]; invoice currency, tax and terms via [email protected]. Prices in USD, before applicable tax.
Open research
See authority boundaries in real systems.
Our public teardowns apply the same static method to open-source agent frameworks and publish the numbers that make the result look weaker, such as files no framework adapter recognised. Manual source review is identified separately, and the teardowns do not expand what the automated audit covers.
OPEN SECURITY RESEARCH / TEARDOWN #02
Independent boundary review
PUBLIC · READ-ONLY
browser-use
autonomous browser agent framework
Hardening priorities
5
BU-01 – BU-05 · manual source review
Engine findings
408
3 medium · 161 low · 244 info
Scope reviewed
274
Python files · 0 syntax errors
Posture signal
0/100
D · AT RISK · heuristic, 273 parser limits disclosed
BU-01 · capability broker
BU-02 · prompt injection
BU-03 · egress policy
BU-04 · authenticated state
BU-05 · fail-closed recovery
Deterministic review of snapshot 6e1977d. 273 generic parser limitations remain disclosed: 273 of the 274 files had no framework-specific adapter matched and were analysed by the generic heuristic adapter. Every file parsed, with 0 syntax errors — uncovered means unrecognised, not unread. The score is not an exploitability finding or legal-compliance certification.
Frequently asked questions
Before you order.
What we inspect, what the evidence means, and how scope, delivery and payment work.
Is the free public scan the same as an audit?
No. The public scan returns a bounded preview: counts, a few signals with their limits, and the scan’s coverage limitations. A completed paid audit provides a separate Executive Security PDF and an Audit Vault ZIP containing PDF, JSON, Markdown, SARIF, CSV, standalone HTML, bounded AxiomGate formal-model files and an HMAC-protected SHA-256 manifest. The formal files describe AxiomGate’s model, not your application. Delivery links are issued only after artifact verification.
What does UNKNOWN mean in a result?
The analyzer looked at the question but the source did not settle it. UNKNOWN is neither safe nor unsafe, and it never counts as a pass. When a posture-critical property is left open, A and B grades are withheld.
Do we need to provide API keys or credentials?
Never. The analysis is static and does not require credentials. Submit a sanitized codebase or repository snapshot; secrets, tokens, API keys, and environment variables must be removed before submission. OWASP GenAI Standard ↗
How is our proprietary source code protected?
Provide a sanitized repository snapshot without credentials or production data. The scanner analyzes source statically without executing your application. Source access and retention must be agreed for the engagement; audit reports, order records and correspondence are separate records. A mutual NDA is available in the intake flow. Privacy Notice ↗
What multi-agent frameworks do you audit?
The paid automated scan analyzes Python .py files in an accepted repository snapshot. Framework-specific adapters currently cover LangGraph, CrewAI, Microsoft AutoGen and OpenAI Swarm. Other Python agent patterns may be processed generically, with coverage limitations shown in the report. Non-Python files and MCP server configuration files are not analyzed; LlamaIndex-specific patterns do not have a dedicated adapter. Public teardowns are separate research examples and do not expand automated scan coverage.
What does the 30-day re-scan include?
Multi-Agent System ($590–$990), Agent Fleet ($990–$1,990) and Enterprise Bounded ($2,490) engagements include one complimentary re-scan within 30 days of report delivery. Send the revised snapshot for the same agreed scope to [email protected]. You receive an updated findings report; this is not a certification of security or legal compliance. Expanded scope requires a new agreement.
How does payment and invoicing work?
The four bounded audit packages are priced in USD. The request receipt offers Stripe checkout; available payment methods appear at checkout. For B2B invoicing through Frilans Finans, contact [email protected]. Currency, applicable tax, payment method and due date are confirmed on the issued invoice before payment.
What does the integrity manifest prove?
Evidence digests and HMAC-protected audit records support integrity checks against trusted verification material. They do not prove that every vulnerability was found. TLA+ results concern the bounded AxiomGate governance model, not a formal proof of your application. The report states the verification scope and limitations.
VERIFIABLE SECURITY FOUNDATIONFor technical reviewers: how AxiomGate itself is verified
Published packages
axiomgate-kernel v0.12.1 · axiomgate-lint v0.2.2, with public metadata and source
No Target Execution
Your audit: static AST analysis; submitted code is never run
AxiomGate verifies itself with a regression suite and a bounded TLA+ model check; that verifies AxiomGate, not your repository. A customer audit is the static analysis described above, with its own evidence per finding. The governance model claim is bounded model-checking evidence, not a proof that any application is secure. Pricing, delivery, re-scan and fulfillment are contractual terms; they are not analyzer output and not model evidence. Formal specification and run log.
Next step
Start with a scan, or scope an audit.
Answer a few questions about your agents, see the recommended tier and its price, then decide. Nothing is charged until you confirm the scope at checkout. Not sure yet? Run the public scan on a repository first.