01Safety
30.0 / 30
What changed in the harness
Selection accuracy 98→100, token cost up 12%, unconfirmed writes 100%→100%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
24.6 / 30
03Economics
19.7 / 20
04Discoverability
19.3 / 20
Highest-impact fix
Estimated gain +1 pointRewrite 10 underspecified tool descriptions
State each tool's behavior, explain every parameter, and declare return semantics, prioritizing tools exercised by failed selection tasks.
Description evidence
Defects and rewrites.
10 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
inkog_scan |
no_return_description |
Security co-pilot for AI agent development. Scans a file or directory at the given path for prompt injection, infinite loops, token bombing, SQL injection via LLM, and missing guardrails, supporting LangChain, CrewAI, LangGraph, AutoGen, n8n, and 20+ agent frameworks. Use this whenever building, reviewing, or deploying AI agents to catch security issues before they reach production. Returns a scan report containing detected security findings (use the output parameter to choose a summary, detailed, or SARIF report for CI/CD). |
inkog_deep_scan |
params_unexplained no_return_description |
Runs an Inkog Deep scan on AI agent code that uses advanced analysis to detect complex vulnerabilities, logic flaws, and security issues that pattern-based scanning may miss. Requires the Inkog Deep role. Scan the file or directory at the given path; agent_name is an optional identifier for the agent under scan. IMPORTANT: Deep scans typically take around 10 minutes — inform the user before starting and let them know the scan is running. Returns a report of detected vulnerabilities, logic flaws, and other security issues. |
inkog_verify_governance |
no_return_description |
Validate that AGENTS.md declarations match actual code behavior in the directory at the given path. Detects governance mismatches like 'read-only declared but code writes data' or 'human approval required but no approval gates in code'. Essential for EU AI Act Article 14 compliance. Use this whenever an AI agent project has an AGENTS.md file, or to verify governance compliance before deployment. Returns a validation report listing any governance mismatches found between declarations and code. |
inkog_compliance_report |
no_return_description |
Generate a compliance report for EU AI Act, NIST AI RMF, ISO 42001, or OWASP LLM Top 10 by analyzing the agent code at the given path and mapping findings to regulatory requirements. Use this when preparing AI agents for regulatory compliance or audit. Returns a compliance report in the requested format (markdown, json, or pdf) with findings mapped to the selected framework. |
inkog_explain_finding |
no_return_description |
Get detailed explanation and remediation guidance for a security finding or pattern, identified by finding_id from scan results or by pattern name. Includes what the issue is, why it's dangerous, step-by-step fixes, and code examples. Use this after scanning to understand how to fix security findings. Returns an explanation with remediation steps for the specified finding or pattern. |
inkog_audit_mcp_server |
no_return_description |
Security audit an MCP server identified by server_name from the registry or a direct GitHub repository_url. Analyzes tool permissions, data flow risks, input validation, and potential vulnerabilities. Use this before installing any new MCP server to verify it is safe. Returns an audit report describing the server's risks and any vulnerabilities found. |
inkog_generate_mlbom |
no_return_description |
Generate a Machine Learning Bill of Materials (MLBOM) for the AI agent codebase at the given path. Lists all models, tools, data sources, frameworks, and dependencies, with support for CycloneDX, SPDX, and JSON formats and optional known-vulnerability reporting. Use this when documenting AI agent dependencies for supply chain compliance. Returns the MLBOM document in the selected format. |
inkog_audit_a2a |
no_return_description |
Audit Agent-to-Agent (A2A) communications in the multi-agent system at the given path. Detects infinite delegation loops, privilege escalation, data leakage between agents, and unauthorized handoffs, with support for Google A2A protocol, CrewAI, LangGraph, and AutoGen. Use this when building or reviewing multi-agent systems to detect delegation vulnerabilities. Returns an audit report of delegation and communication findings. |
inkog_skill_scan |
no_return_description |
Scan a SKILL.md package (from a GitHub repository_url or a local path) and agent tool definitions for security vulnerabilities. Detects tool poisoning, command injection, data exfiltration, prompt injection, excessive permissions, obfuscation, supply chain risks, and more, mapping findings to OWASP Agentic Top 10 and OWASP MCP Top 10. Set deep=true for AI-powered deep analysis (~10 min, catches novel threats). For MCP server scanning, use inkog_mcp_scan instead. Returns a list of detected vulnerabilities mapped to OWASP categories. |
inkog_mcp_scan |
no_return_description |
Scan an MCP server from the registry (server_name) or by GitHub repository_url for security vulnerabilities. Detects tool poisoning, command injection, data exfiltration, prompt injection, excessive permissions, obfuscation, supply chain risks, and more, mapping findings to OWASP Agentic Top 10 and OWASP MCP Top 10. Set deep=true for AI-powered deep analysis (~10 min, catches novel threats). For skill package scanning, use inkog_skill_scan instead. Returns a list of detected vulnerabilities mapped to OWASP categories. |
Selection evidence
Confusable tool pairs.
7 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
inkog_skill_scan |
inkog_mcp_scan |
high | Their descriptions are nearly identical (tool poisoning, command injection, data exfiltration, OWASP Top 10 mappings) and each explicitly tells the user to use the other for the alternate target, so a task phrased as 'scan this repo/tool for vulnerabilities' is ambiguous without knowing whether the target is a skill package or MCP server. |
inkog_audit_mcp_server |
inkog_mcp_scan |
high | Both operate specifically on MCP servers (registry name or GitHub URL) and detect overlapping security issues; a user saying 'audit/check if this MCP server is safe before installing' or 'scan this MCP server for vulnerabilities' plausibly routes them to the wrong member. |
inkog_scan |
inkog_deep_scan |
medium | Both scan agent code for security issues; a user asking for a 'thorough/deep analysis' of an agent or requesting complex vulnerability detection could be misrouted, since only the Deep tool's description mentions advanced logic-flaw detection and the 10-minute runtime. |
inkog_scan |
inkog_mcp_scan |
medium | A generic request like 'scan this project/repo for security issues' when the repo happens to contain MCP servers is ambiguous between the general agent scan and the MCP-specific scan, especially since inkog_scan accepts any path. |
inkog_scan |
inkog_skill_scan |
medium | A user saying 'scan my repo for security vulnerabilities' where the repo contains SKILL.md packages could pick the general agent scan instead of the skill-specific scanner, or vice versa, since both accept a repository/path input. |
inkog_deep_scan |
inkog_skill_scan |
medium | A request like 'run a deep scan on this skill package' is ambiguous between inkog_deep_scan (deep, AI-driven analysis of a path) and inkog_skill_scan with deep=true, which explicitly advertises 'AI-powered deep analysis (~10 min)'; the near-identical deep-scan phrasing misroutes easily. |
inkog_audit_mcp_server |
inkog_audit_a2a |
medium | Both are 'audit' tools invoked with a path or server name; a user working on a multi-agent system that uses MCP servers asking to 'audit my agents for security' could be routed to either the MCP-server audit or the A2A delegation audit depending on phrasing. |
Compare the field