Agent Attack Surface Management.

What is an agent attack surface?

An agent attack surface is everything an AI agent can be made to do that it should not: the set of tools an agent exposes, the systems each tool can reach (a shell, a database, the filesystem, the network, secrets), the tool descriptions the model reads as instructions, and the host the agent is deployed on. Because the model is steerable, any one of those is a path an attacker can walk through a prompt injection. Agent attack surface management is finding and shrinking that surface continuously. It is the agent-layer complement to MCP security and agentic security, made concrete: a scan of your actual code.

What Pinaka detects

Eighteen rules across eight classes. The injection rules are real intra-procedural taint analysis, not keyword grep, so a sanitized or parameterized path does not fire.

• Tool poisoning and hidden instructions (AS-GI-001/002/003): instruction-shaped language and injection markers in a tool description, plus invisible carriers a human cannot see: zero-width joiners, bidi overrides, the Unicode Tags block, and ANSI escapes used to smuggle hidden instructions.
• Code execution, traced by taint (AS-TS-004/005/006/007/008): a tool parameter followed to its sink and named by class: shell or eval command injection, SQL injection, path traversal, server-side template injection, and unsafe deserialization.
• Lethal trifecta (AS-DL-001): a sensitive-data reader and an external-send tool on the same server. One prompt injection turns that into an exfiltration channel.
• Excessive agency (AS-EA-001): destructive or external-send tools that ship without a consent gate.
• Secrets and credential handling (AS-SE-001, AS-IA-001): hardcoded keys, tokens, and private keys, and tools that accept or store credential material.
• Insecure transport (AS-TR-001): HTTP or SSE transport without DNS-rebinding or Origin protection.
• Supply chain (AS-SC-001): external hosts an agent calls out to, reputation-checked offline; raw IPs and abuse-prone TLDs are flagged.
• Rug pull and drift over time (AS-RP-001): a tool that was benign when approved and mutated later. Pinaka keeps a per-project history of redacted snapshots and diffs each tool against the previous one, which a single-shot scanner cannot do.

Blast radius: what one compromised agent reaches

Inventory is not enough. For each agent, Pinaka follows the graph to its worst attacker path and scores it 0 to 100: if this agent is compromised, what does an attacker reach, and how far does it propagate. Two paths are called out by name: the exfiltration path (a tool that reads sensitive data and a tool that sends externally, reachable from the same agent) and the takeover path (an agent deployed on a host that recon shows is dangling).

The cross-surface bridge

The part no pure-EASM or pure-AI-security tool can produce, because it needs both surfaces in one graph. Pinaka correlates the hosts an agent is deployed on, pulled from your code and infra config, against the subdomains it has discovered on your perimeter. When an agent runs on a host that recon shows is dangling, that is a subdomain takeover an attacker can use to impersonate your agent. The bridge is the perimeter half of the blast-radius view.

Run it in your CI

Add the Pinaka Agent Surface GitHub Action and every push re-maps your agent surface. The scan runs inside your runner, only a secrets-redacted graph is uploaded, and Pinaka never holds a GitHub token. Set fail-on to break the build on a finding at or above a severity, and findings can be commented on the pull request. Once you have access, store your pk_live key as the PINAKA_API_KEY repo secret. The same engine also ships in the Pinaka MCP server for Claude Code and Cursor, and the public security check needs no signup at all.

Proof, not hype

We ran the same engine across 39 public Python MCP servers, 1,939 tools in total, and reported the honest result: zero command or SQL injection in the real servers, and 34 of 39 clean of any injection finding. The popular ecosystem is mostly careful, which is exactly why a precise scanner that produces zero false positives matters, and why the rare real issue is worth catching. Read the full State of MCP Security survey.

Questions people ask

What is agent attack surface management?

Agent attack surface management (AASM) is the practice of finding and reducing the security exposure created by the AI agents and MCP servers an organization builds and runs: the tools each agent can call, what those tools can reach, the instructions hidden in tool descriptions, and the perimeter the agent is deployed on. Pinaka maps that surface from your source code and scores the risk.

How is it different from EASM?

External attack surface management maps the hosts, ports, and services exposed on your perimeter. AASM maps the agent layer: MCP servers, tools, and what they can do. Pinaka does both and connects them, correlating an agent deploy host against your owned subdomains to catch a dangling host an attacker could take over to impersonate your agent.

Does my source code leave my machine?

No. The scanner runs static analysis locally or inside your own CI runner. Only a secrets-redacted graph is uploaded, hostnames and secrets are stripped before anything is sent, and Pinaka never holds a GitHub token.

How accurate is it?

The product thesis is precision over volume: clean code produces zero findings, which is why the HIGH findings are trustworthy. Across a survey of 39 public Python MCP servers and 1,939 tools the engine produced zero false positives, and every rule ships only after it is proven against both a true-positive and a benign corpus.