Security Preflight
AI Security Scanner
Scan AI agent instructions before they run.
Local scan · No upload · No execution
What this scanner checks
- External instructions and remote download-then-execute patterns (KT-EXT-*)
- Credential access and secret exfiltration (KT-SEC-*)
- Privilege escalation, destructive commands, dynamic execution (KT-EXEC-*)
- Persistent config mutation and hook behaviors (KT-PERSIST-*, KT-HOOK-*)
- Obfuscation via bidi, zero-width and encoded blocks (KT-OBF-*)
- MCP server configuration and cross-file policy contradictions (KT-MCP-*, KT-XFILE-*)
Supported files
.md, .mdc, .json, .yaml, .yml — up to 10 files, 256 KiB each, 1 MiB total. Content is classified by format and parsed with bounded depth (32) and node count (5k).
Local processing boundary
Files and pasted text stay in browser memory, are parsed locally, evaluated by deterministic rules, and visualized with escaped output. No upload, execution, or reputation fetch.
What it does not check
- Network reputation or remote blocklists
- Full program analysis or runtime execution
- Non-textual ZIP/repository scanning
- Policy enforcement or overall security score
FAQ
Where is my content processed?
Completely in your browser. Nothing is sent to servers or third-party APIs.
What happens to my files?
They are read via the File API into memory, classified and parsed locally, then discarded when you leave the page.
Is a clean result a guarantee?
No. The scanner is a local heuristic aid with bounded parsers and explicit coverage. Always review findings and coverage manually.