What it covers
These checks run as part of a code scan of your application's source: they read code and configuration, and none of them (except the runtime module described below) contacts a live system.
| Check | What it does |
|---|---|
| Static OWASP LLM Top 10 | Targets the categories that are actually decidable by reading code: prompt injection through unsanitized input concatenated into a prompt, secrets baked into a system prompt, agents granted broad or dangerous tool access, and model calls with no output or spend cap. The categories that need runtime behaviour or a threat model (supply chain, model poisoning, output handling) are out of scope for a static reader and are not claimed here. |
| Transcript and log leakage | A context-based detector for credentials leaked into an agent transcript or a log file: a value assigned to a secret-shaped variable name, or carrying a known provider's key prefix, built specifically because an entropy-based secret scanner drowns in false positives on a Web3 transcript full of addresses and transaction hashes that look exactly like high-entropy secrets but are not. |
| Tool & MCP security | Reads your project's and your host's MCP/agent tool configuration to see which tools are exposed to a model and what each can actually do, including the confused-deputy shape where a tool's own standing authority exceeds what the calling agent actually negotiated. Scoped strictly to the tree being scanned, not to the scanning host's own separate configuration. |
| Model provenance | Checks whether a model artefact's file format executes code merely by being loaded. A Python pickle-based format does, a .safetensors file does not, and this is decidable from the file itself. Where a model file ships a signed attestation alongside it, that signature is verified using the same cryptographic check as a supply-chain provenance check. Where none exists, the file is reported as not attested, never treated as evidence of tampering. |
| Autonomous agent guardrails | Reads a codebase for whether agent actions are bounded, spend is capped, an irreversible step requires human approval, and decisions are recorded in a way that can be attributed. This is text-shape evidence: it looks for the pattern a real guardrail takes, not a live evaluation of what an agent actually did. |
| RAG pipeline security | Looks for the shape of an ingestion pipeline (can an untrusted document reach the index, is there any provenance on what was ingested) and a retrieval pipeline (does retrieved content flow into a prompt that can also call tools or make outbound requests). This answers whether the pipeline is shaped safely. It never connects to a vector store to check what is actually indexed today, so a pipeline that looks safe can still be serving a document that was indexed before the safety check existed. |
Runtime prompt injection
Everything above reads code. A separate, active module instead throws a corpus of adversarial inputs at a live agent endpoint you declare, and judges what comes back: a different question, given the code a static check just read, does the deployed agent actually do the dangerous thing when asked. A static miss can still be live-vulnerable, and a static hit can be caught at runtime by a guardrail the static reader cannot see.
This module follows the same rules as every other active module on the platform: disarmed by default, a consent phrase typed verbatim by the caller, a target restricted to your own infrastructure by default and requiring an explicit allow-list entry to test anything else, and hard ceilings on how large a corpus and how long a run can be.
Judging is deliberately narrow. Most categories ask the model to make its reply begin with a one-time value generated for that single request, so a refusal that merely quotes the malicious payload back is not mistaken for compliance. A category that asks the model to leak its system prompt is judged as unknown (never a guessed pass or fail) unless you supply a short fragment of your real system prompt to check against; without one, no test can tell a genuine leak apart from a confident fabrication.
What it stops short of
- Static checks read source and configuration; none of them (other than the runtime module) confirms that a running deployment actually behaves the way its code suggests.
- The tool/MCP, agent-guardrail, and RAG checks all match on the textual shape of a pattern within a bounded scope, not a full data-flow trace. A retrieval and its later use split across files, or separated by more code than the check's window covers, can be invisible to it.
- RAG security checks the pipeline's shape, never the index's actual contents. A pipeline that scores well can still be serving a document that reached the index before any ingestion safeguard existed.
- Model provenance can only confirm a signature that was actually published alongside a model file. It never evaluates whether a model's weights themselves have been poisoned; no byte-level check distinguishes a poisoned tensor from a clean one, and this platform does not claim one.
- Runtime prompt-injection testing only ever runs against a target you declared and proved, under an explicit consent phrase, never a target discovered elsewhere in a scan.
- A system-prompt-leak test without a supplied canary fragment returns unknown by design, not a guessed verdict either way.
How to run it
- 1
Run a code scan
Submit your application's source at /scans, Code tab. The static AI checks run alongside every other code-scan family automatically. - 2
Read the findings
AI- and agent-specific findings appear in the same report as the rest of a code scan; see Reading a report. - 3
Arm runtime testing, if you want it
Where the platform operator has enabled runtime prompt-injection testing, declare your agent endpoint with the exact consent phrase and, optionally, a system-prompt canary fragment before running it.
Sentinelleai is an automated security monitoring platform. Nothing it produces is an audit, a penetration test, a compliance opinion, or a guarantee that a system is secure. "No findings" means the tools that ran found nothing, never that nothing is there; anything a tool could not check is reported as unknown, not as clean. For decisions that carry real money or real liability, engage qualified professionals and treat Sentinelleai's output as their starting material.