Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add hackmyagent -- npx -y hackmyagent@0.33.2รันในเทอร์มินัล
{ "mcpServers": { "hackmyagent": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดOpenA2A: CLI · HackMyAgent · Secretless · AIM · Browser Guard · DVAA
Security scanner for AI agents. It finds the shadow AI on a machine, scans agent projects and packages for credentials, risky MCP configs, prompt injection and weak governance, and tests agents with attack payloads.
Scan the project you are in:
npx hackmyagent secure
support-agent v1.0.0 · library · 5 files analyzed
[...]
── Observations ────────────────────────────────────────────
Surfaces library · 5 semantic artifacts · all 5 artifacts reached 0-6 of 7 analyzer families
Checks 261 static declared · 63 of 63 check groups ran · 5 semantic (NanoMind AST, 0-6 of 7 analyzer families) · 5 files read by static checks
[...]
── Findings ────────────────────────────────────────────────
[...]
│ CRITICAL Overprivileged MCP server scope
│ .mcp.json:5
│ Overprivileged filesystem access allows the agent (or an attacker via prompt injection) to read sensitive files like SSH keys, credentials, and system configs.
│ Verify: sed -n '5p' /home/dev/workspace/support-agent/.mcp.json
│ Fix: Scope "filesystem" to the project directory: replace "/" with "./" or a specific subdirectory.
[...]
Path forward: 53 -> 92 by fixing 1 critical + 3 high
No config file or flag is needed. [...] marks omitted lines. The full output, the sample workspace and the build that produced it are in docs/quick-start-capture.txt. The run exits 1 because a critical or high finding fired.
npx hackmyagent secure. Next: npx hackmyagent secure --fix.npx hackmyagent check <target>. Next, for a local copy: npx hackmyagent secure <dir> --fix.npx hackmyagent attack <url>. Next, with every payload: npx hackmyagent attack <url> --intensity aggressive.npx hackmyagent scan-text <file>. Next, in a pipeline: npx hackmyagent scan-text - --as pr-body --json.npx hackmyagent detect. Next, for one project: npx hackmyagent secure <project>.npx hackmyagent scan-soul. Attack payloads to run yourself against a skill, MCP config or SOUL.md: npx hackmyagent red-team <file>. MCP endpoints a host you own exposes: npx hackmyagent scan <host>.detect). Example: 1 project MCP server with sensitive access.CRITICAL Overprivileged MCP server scope.CRITICAL Data Exfiltration Surface.scan-soul). Example: Missing SOUL-IH-003 Role-play refusal.scan-text). Example: TEXT-001 HIGH Instruction-override payload.attack). Example: Prompt Injection: 2/2 successful against a deliberately vulnerable agent.hackmyagent secure --fix --dry-run # preview the fixes
hackmyagent secure --fix # apply them
hackmyagent rollback # revert them
Backups go to a store outside the project. Which checks it fixes, and where the backups live: docs/SECURITY_CHECKS.md.
npx hackmyagent detect
workspace shadow ai audit · laptop · 2 agents · 3 agent projects
[...]
── Shadow AI agents (3) ────────────────────────────────────
project identified by mcp servers governance cred verdict
support-agent Claude Code 2 mcp critical gov 0/100 cred no CRITICAL
[...]
One row per agent project, worst first. Full output: docs/quick-start-capture.txt.
name: Agent Security
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: '20' }
- run: npx hackmyagent secure --json > security-report.json
- run: npx hackmyagent secure -b oasb-1 --fail-below 70
secure exits 1 on a critical or high finding or a score below --fail-below, and 2 when it did not examine everything it found. Exit codes: docs/commands.md. More recipes: docs/ci.md.
hackmyagent init-mcp --root /absolute/path/to/your/project
That adds the server to Claude Code, Cursor or VS Code. Then ask the assistant: "Run a deep security scan on this project." The server reads only inside its roots, and no MCP tool writes to your files.
npm install -g hackmyagent
brew install opena2a-org/tap/hackmyagent
Installing runs the install script of onnxruntime-node, which on Linux x64 downloads an execution-provider package from nuget.org. Node.js versions, skipping that download, and verifying a release: docs/install.md.
Usage telemetry is on by default, and hackmyagent --version says so on its second line: Telemetry: on (opt-out: OPENA2A_TELEMETRY=off ...).
CI, GITHUB_ACTIONS and the other CI services' variables; --version then prints Telemetry: off.node --test, NODE_ENV=test; --version then prints Telemetry: off.OPENA2A_TELEMETRY=on is set for the run.OPENA2A_TELEMETRY=off hackmyagent secure # off for one run
hackmyagent telemetry off # off on this machine; `telemetry status` shows the state
OPENA2A_TELEMETRY_DEBUG=print hackmyagent secure # print each event on stderr before it is sent
Sharing scan findings with the Registry is a separate opt-in (--contribute, or contribute.enabled in ~/.opena2a/config.json; --no-contribute or --ci turns it off for a run). hackmyagent telemetry off covers usage telemetry only.
--fix changes.Part of the OpenA2A security platform. Related: opena2a-cli, the unified CLI that runs HackMyAgent behind opena2a review; aicomply, which classifies PII, credentials and regulated data in agent I/O at runtime: HackMyAgent scans the code, aicomply guards the live stream. More in the OpenA2A docs and research.
Apache-2.0. See LICENSE.
Find it. Break it. Fix it. The hacker's toolkit for AI agents.
{ "mcpServers": { "hackmyagent": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Hackmyagent ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-14 Find it. Break it. Fix it. The hacker's toolkit for AI agents.