01Safety
30.0 / 30
What changed in the harness
Selection accuracy 100→100, token cost up 9%, unconfirmed writes 100%→100%.
Category breakdown
Where the score comes from.
Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.
02Legibility
26.0 / 30
03Economics
19.6 / 20
04Discoverability
14.0 / 20
Highest-impact fix
Estimated gain +6 pointsMake target tools discoverable on the first call
Clarify tool names, decision boundaries, and required argument schemas so an agent can choose and construct the target call without exploratory steps.
Description evidence
Defects and rewrites.
10 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.
| Tool | Defect types | Suggested rewrite |
|---|---|---|
inkog_scan |
no_return_description |
Security co-pilot for AI agent development. Scans for prompt injection, infinite loops, token bombing, SQL injection via LLM, and missing guardrails. Supports LangChain, CrewAI, LangGraph, AutoGen, n8n, and 20+ agent frameworks. Returns a summary, detailed, or SARIF-formatted list of security findings, each with severity, location, and description, based on the selected policy and filter settings. Use this whenever building, reviewing, or deploying AI agents to catch security issues before they reach production. |
inkog_deep_scan |
no_return_description |
Inkog Deep scan for AI agents. Uses advanced analysis to detect complex vulnerabilities, logic flaws, and security issues that pattern-based scanning may miss. Requires the Inkog Deep role. Returns a list of deep-analysis findings with severity, location, and remediation context once the scan completes. IMPORTANT: Deep scans typically take around 10 minutes — inform the user before starting and let them know the scan is running. |
inkog_verify_governance |
no_return_description |
Validate that AGENTS.md declarations match actual code behavior. Detects governance mismatches like 'read-only declared but code writes data' or 'human approval required but no approval gates in code'. Essential for EU AI Act Article 14 compliance. Returns a list of detected mismatches, each describing the declared claim, the conflicting code behavior, and its file location. Use this whenever an AI agent project has an AGENTS.md file, or to verify governance compliance before deployment. |
inkog_compliance_report |
no_return_description |
Generate a compliance report for EU AI Act, NIST AI RMF, ISO 42001, or OWASP LLM Top 10. Analyzes agent code and maps findings to regulatory requirements. Returns a report, in the requested markdown, JSON, or PDF format, listing coverage status and gaps against the selected framework's requirements. Use this when preparing AI agents for regulatory compliance or audit. |
inkog_explain_finding |
no_return_description |
Get detailed explanation and remediation guidance for a security finding or pattern, identified by finding_id from prior scan results or by pattern name (e.g. prompt-injection, infinite-loop, sql-injection-llm). Returns a description of what the issue is, why it's dangerous, step-by-step fixes, and example code. Use this after scanning to understand how to fix security findings. |
inkog_audit_mcp_server |
no_return_description |
Security audit any MCP server from the registry (by server_name) or GitHub (by repository_url). Analyzes tool permissions, data flow risks, input validation, and potential vulnerabilities. Returns an audit report listing identified risks and vulnerabilities with severity ratings and affected components. Use this before installing any new MCP server to verify it is safe. |
inkog_generate_mlbom |
no_return_description |
Generate a Machine Learning Bill of Materials (MLBOM) for AI agents at the given path. Lists all models, tools, data sources, frameworks, and dependencies. Returns the MLBOM document in the requested format (cyclonedx, spdx, or json), optionally annotated with known vulnerabilities for detected components when include_vulnerabilities is true. Use this when documenting AI agent dependencies for supply chain compliance. |
inkog_audit_a2a |
no_return_description |
Audit Agent-to-Agent (A2A) communications in multi-agent systems at the given path. Detects infinite delegation loops, privilege escalation, data leakage between agents, and unauthorized handoffs, optionally scoped with a protocol hint (a2a, crewai, langgraph, autogen, custom) and delegation-chain checks. Returns a list of detected issues with severity, description, and location. Use this when building or reviewing multi-agent systems to detect delegation vulnerabilities. |
inkog_skill_scan |
no_return_description |
Scan SKILL.md packages and agent tool definitions, given as a repository_url or local path, for security vulnerabilities: tool poisoning, command injection, data exfiltration, prompt injection, excessive permissions, obfuscation, supply chain risks, and more. Set deep=true for AI-powered deep analysis (~10 min, catches novel threats). Returns a list of findings mapped to OWASP Agentic Top 10 and OWASP MCP Top 10 categories, each with severity, description, and location. For MCP server scanning, use inkog_mcp_scan instead. |
inkog_mcp_scan |
no_return_description |
Scan MCP servers from the registry (server_name) or by repository_url for security vulnerabilities: tool poisoning, command injection, data exfiltration, prompt injection, excessive permissions, obfuscation, supply chain risks, and more. Set deep=true for AI-powered deep analysis (~10 min, catches novel threats). Returns a list of findings mapped to OWASP Agentic Top 10 and OWASP MCP Top 10 categories, each with severity, description, and location. For skill package scanning, use inkog_skill_scan instead. |
Selection evidence
Confusable tool pairs.
6 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.
| Tool A | Tool B | Confidence | Why they collide |
|---|---|---|---|
inkog_skill_scan |
inkog_mcp_scan |
high | Both scan packages for identical vulnerability classes (tool poisoning, command injection, prompt injection) with nearly identical descriptions and both accept repository_url/path/deep params; an agent asked to 'scan this MCP-related repo for security issues' could easily pick skill_scan when the target is actually a skill package or vice versa, especially since both explicitly cross-reference each other. |
inkog_scan |
inkog_deep_scan |
medium | Both scan an AI agent codebase at a path for security issues; a request like 'thoroughly scan my agent for vulnerabilities' could trigger either the default scan or deep_scan since the only differentiator is the word 'deep' or 'advanced/thorough', which a user might use without realizing deep_scan requires a special role and 10 minutes. |
inkog_scan |
inkog_mcp_scan |
low | inkog_scan targets general AI agent code while inkog_mcp_scan targets MCP servers specifically; overlap is low but a vague request like 'scan this for security issues' on a path that happens to be an MCP server implementation could plausibly go to either tool. |
inkog_scan |
inkog_skill_scan |
low | inkog_scan covers general agent frameworks while inkog_skill_scan is specific to SKILL.md packages; a request to 'scan my agent skill for vulnerabilities' could ambiguously route to either since inkog_scan's description mentions general agent scanning without excluding skill files. |
inkog_audit_mcp_server |
inkog_mcp_scan |
high | Both explicitly operate on MCP servers by registry name or repository URL and both detect security vulnerabilities/permissions issues before installation; a request like 'check if this MCP server is safe to install' maps almost equally well to either tool's description. |
inkog_audit_mcp_server |
inkog_audit_a2a |
low | Both are 'audit' tools but target different domains (single MCP server vs multi-agent A2A communication); confusion is unlikely unless the task vaguely mentions 'audit this agent system' without specifying MCP vs multi-agent delegation context. |
Compare the field