Find vulnerabilities in your AI agents.
Ziran is our open-source agent security scanner. It models your AI agent as a graph of capabilities and tests what happens when they combine — surfacing dangerous tool chains, execution-level side effects, and multi-phase exploits that single-prompt scanners miss.
639
attack vectors across 11 categories
100%
OWASP LLM Top 10 coverage
72/86
MITRE ATLAS techniques (14/14 agent-specific)
Also benchmarked against AgentHarm, JailbreakBench, Agent Security Bench, HarmBench, R-Judge, and ALERT. Open source, Apache 2.0, published on PyPI.
Why Ziran
Most security tools test prompts and tools in isolation.
But agent vulnerabilities emerge from how tools interact. An agent with read_file and http_request has a data-exfiltration path even though neither tool is dangerous alone — testing each tool individually misses this entirely.
Tool-chain discovery — graph beats list
Individual tools can pass security review in isolation, but their compositions create vulnerabilities a list-based scanner never sees. Ziran models your agent as a graph of capabilities and walks it for dangerous transitive paths — read_file → http_request for data exfiltration, sql_query → exec_code for SQL-to-RCE.
Side-effect detection — chat is not the truth
An agent can refuse a request in its text response while the dangerous tool call fires underneath anyway. Chat-only scanners mark that as safe. Ziran intercepts at the execution layer and flags the silent failure.
Adaptive 8-phase campaigns
A live knowledge graph grows as the scan progresses, and the graph — not a fixed sequence — decides the next phase. A critical chain found mid-campaign routes straight to exploit setup; phases like trust building or persistence are skipped when the graph shows they won't yield results.
Framework agnostic
Tests LangChain, CrewAI, Bedrock, MCP, and browser-based or remote HTTPS agents through their native protocols — including A2A and MCP directly — exercising the actual attack surface rather than a simplified proxy. Custom adapters cover anything else.
How it compares
Built for agents, not just prompts.
Prompt-injection scanners test single turns. Ziran is agent-aware — it understands tools, memory, and multi-step execution.
Comparison reflects each project's own public documentation as of publication; check their docs for current capabilities.
Ziran is
An agent security scanner that discovers dangerous tool compositions via graph analysis, detects execution-level side effects, and runs multi-phase campaigns that model real attacker behavior.
Ziran is not
- An LLM safety/alignment tool — for prompt injection breadth and jailbreak templates, pair it with a tool like Promptfoo or Garak.
- A runtime guardrail — for real-time input/output protection, you still need a guardrail layer in production.
- A general-purpose eval framework — for model quality evaluation, that's what Shyena is for.
Run a real campaign against your own agent
Bring one real agent. We'll run a scoped Ziran campaign against it and walk through every finding — tool chains, side effects, and all — with you.