Your agent has tool access.
What can it be talked into?
Most AI security reviews check the model. The damage comes from the tools — the agent that can send email, read files, move money or call an API, doing it for someone who wasn’t supposed to be able to ask.
Our security tooling is open source. You can audit us before you hire us — github.com/ojackson08
Three ways agents go wrong,
and none of them are the model.
Every one of these is an architecture problem. That matters, because architecture problems don’t get fixed by switching providers.
Injected instructions
Your agent reads a document, a web page or a support ticket. Inside it is text written for the model, not the human. The agent follows it — using a tool it was legitimately given, for a purpose nobody authorised.
Scope that creeps
No single step looks wrong. The agent has every tool it uses. But across a conversation it is walked from one lookup to a bulk export, or from a small refund to a large one, with plausible reasoning at every turn.
Authority that leaks downhill
A planner hands work to a sub-agent and passes its whole grant instead of the slice needed. The breach happens one hop down, where nobody is watching, and the log shows the planner’s name rather than the worker’s.
You shipped it in a weekend.
Nobody checked the locks.
AI coding tools write working code quickly. Working and safe are different things, and nothing in the loop asks for the second one — so the gaps are consistent, and they are the same handful every time.
What we find most
API keys shipped in the browser bundle, where anyone can read them. Database rules left open so one URL returns every row. Endpoints with no permission check because the happy path worked. No rate limit, so a single script runs up a bill overnight. Secrets committed to the repo. Validation that only exists in the front end.
What you get back
A written list of what’s exposed, ordered by what we’d fix first, with the file and line for each one and the exact change to make. Plain English, not a scanner dump. If something is fine, we say it’s fine — the point is a short list you can actually work through, not three hundred findings you ignore.
Read access to the repo, or a zip, plus the URL if it’s live. We never ask for production credentials.
This is not a judgement on how the thing was built. Shipping fast is the right call, and most of what we find was never a decision anyone made — it’s what the tool did by default when nobody asked about security. Cursor, Claude Code, Lovable, Replit, v0, Bolt, or hand-written and rushed: same review either way.
Priced up front,
so you know before you ask.
Fixed where the scope is fixed, and a range where it honestly depends on how many agents you are running. No discovery call required to find out what it costs.
Vibe-Coded App Audit
One app or codebase, checked for what’s exposed
Back in two to three days
- Exposed API keys and committed secrets
- Database rules that let anyone read or write
- Endpoints and admin routes with no permission check
- Missing rate limits that turn into a bill
- A written fix list — file, line, and the change to make
Secure checkout on Stripe · questions first?
Agent Security Snapshot
One agent or workflow, reviewed properly
Typically back within a week
- What tools it can call, and what each one can reach
- Where injected instructions could redirect it
- Authority and scope boundaries, mapped
- A written fix list, ordered by what we’d do first
- A 30-minute walkthrough of the findings
Secure checkout on Stripe · questions first?
Full AgentCap Audit
Every agent you have in production
Range depends on agent count and tool surface
- Everything in the Snapshot, across every agent
- Capability contracts written for your tool calls
- Signed authority and allow / deny / approve rules
- Tamper-evident ledger, installed and running
- Incident-lab testing against your own configuration
- Remediation done with your engineers, not handed over
Payable in two — half to start, half on delivery
Ongoing Monitoring
Because agents drift and nobody gets told
Month to month, no contract
- Monthly review of agent activity and policy drift
- Alerts when a denial pattern changes
- Re-run of the incident labs against your config
- A written report a non-engineer can read
- Priority response when something looks wrong
The $1,500 Snapshot is the one thing you can pay for online, through Stripe’s own secure checkout — we never see or store your card. The audit and monitoring tiers are scoped first and invoiced directly; nothing else on this site takes a payment. A full audit can be paid in two: half to start, half on delivery, with no interest and no fee. Scope and price are confirmed in writing before any work starts. If a Snapshot shows your setup is already sound, we will tell you that rather than find something to sell — and you keep the report either way.
Read the code
before you hire us.
The tooling we audit with is public. That is deliberate — security work you cannot inspect is a claim, not a credential.
AgentCap
Open sourceCapability-contract enforcement for agent tool calls: signed authority, an allow / deny / approve mediator, and a tamper-evident ledger.
View on GitHub →AI Codebase Audit Engine
Open sourceAn event-driven pipeline that audits codebases for AI-specific weaknesses — the automated first pass before anything is reviewed by hand.
View on GitHub →AWS Compliance Automation
Open sourceAuto-remediation of security misconfigurations in AI infrastructure, using AWS Config and Lambda.
View on GitHub →AgentHandoff
Core infraSecure context transfer between agents, so a sub-agent receives the slice of authority it needs rather than everything its parent held.
View on GitHub →AgentLedger
Core infraReal-time cost and security metering for production multi-agent systems, with a record of which identity made which call.
View on GitHub →Everything else
RepositoriesThe rest of the security work, including what is still in progress. We would rather you saw the unfinished parts than a curated shelf.
Browse the repos →We publish the attacks
and the fixes that stop them.
Each lab is a reproducible demonstration: an agent with ordinary permissions, talked into doing something nobody authorised — then the same agent, with a capability contract, refusing. Run them yourself.
Four steps,
and you see everything.
Threat modelling
We map what your agents can actually reach — tools, data, money, and the humans who can prompt them. Most of what we find at this stage surprises the team that built it.
Automated, then by hand
The audit engine runs first across code, prompts, configuration and runtime behaviour. Then every finding is reviewed by hand, because the interesting ones are never the ones a scanner flags.
Capability contracts
Findings become policy: what each agent may call, with what parameters, under whose authority. Written as code you own, not a PDF of recommendations.
Keep watching
Agents drift. Prompts change, models update, a tool gets a new permission. Optional monthly review so the gap between what was agreed and what is running stays visible.
The Agent Risk Checklist
The questions to ask before you give an AI agent access to your tools, your data and your money. One page, plain English, no sales follow-up.
That doesn’t look like a working email address.
No spam, and you can unsubscribe at any time. We don’t pass your address to anyone.
Tell us what you’re running.
We reply within 24 hours with scope and a price. Or skip the email and put 30 minutes in the calendar.
Your email app should be opening
Send the message that’s been drafted for you and we’ll reply within 24 hours. If nothing opened, write to ojack@merkabacreatives.org.
Rather just talk? Book 30 minutesBefore you ask.
Is this the same as the free AI visibility audit?
No, and they aren’t related. The free audit measures whether AI engines recommend your business — it’s a marketing service. This measures whether the AI systems you run can be made to do something you didn’t authorise. Different problem, different buyer, and this one isn’t free.
We’re not running agents yet. Should we talk now or later?
Before you ship is much cheaper than after. A Snapshot on a design is quick, and the fixes are configuration rather than rework. If you’re still deciding whether to give an agent tool access at all, the free checklist above covers most of what you need to ask yourself.
My app was built with AI tools. Is that a problem?
Not at all, and we use the same tools. The issue isn’t the code quality — AI writes perfectly reasonable code. It’s that nothing in the loop asks “who is allowed to call this?” unless you do, so the same few gaps turn up again and again: keys in the browser, database rules left open, endpoints with no permission check. A Snapshot finds them in a day or two and tells you what to change.
What’s the difference between the $297 app audit and the $1,500 Snapshot?
The app audit looks for things that are exposed — keys, open data rules, routes with no permission check. Those have known shapes, so our audit engine does the first pass and a person verifies and prioritises what it found. Two or three days, written report.
The Snapshot answers a harder question: what can this agent be talked into doing. There’s no scanner for that — it means reading what the agent can call, what each tool reaches, and where content it reads could redirect it. That’s reasoning work, it takes about a week, and it includes a call to walk you through the findings. If your app has an agent with tool access in it, you want both, and we’ll say so.
What do you need to audit an app?
Read access to the repository, or a zip of it, plus the URL if it’s deployed. We don’t need production credentials and we won’t ask for them. If the repo is private, a read-only collaborator invite is the cleanest way, and you can remove it the moment we’re done.
Do you need access to our systems?
For a Snapshot, usually not — your agent configuration, tool definitions and prompts are enough. A full audit normally needs read access to a non-production environment. We never ask for production credentials, and anything you send is covered by a mutual NDA if you want one.
What if you find nothing?
Then the report says so and you’ve bought a clean bill of health you can show a customer or an insurer. We’d rather write that than invent findings — a security consultancy that always finds something is telling you about its business model, not your systems.
Why is your tooling open source if that’s your product?
Because the product is the judgement, not the code. AgentCap enforces a policy; knowing which policy your system needs is the work. And a security vendor asking you to trust a closed box has the argument backwards.
Which models and frameworks do you cover?
All of them, because the failures we audit for aren’t model-specific. Injected instructions, scope creep and leaked authority are architectural problems — they show up behind every provider and every orchestration framework. Switching vendors doesn’t fix any of them.