Tool permissions
Which tools and actions the agent can call, with which credentials and scopes, and whether a person approves high-impact actions such as sending email, moving money, deleting records or running code.
AI Agent & LLM Security Sprint
A security review of what your AI agent is allowed to do
For teams shipping AI agents and LLM features. The sprint reviews the tools an agent can call, the data it can reach, the input it trusts and where its output goes. Every finding is checked by a senior engineer and mapped to the OWASP Top 10 for LLM Applications 2025.
- Price
- On request fixed quote in writing after a free scoping call; no obligation
- Mapped to
- OWASP LLM Top 10 2025 edition
- You get
- Report + walkthrough findings ranked by real exploitability
Scope an agent review
Opens a pre-filled email to hello@proofmerge.com
What the sprint reviews
Six areas, from input to action
An agent turns text into actions. The review follows that path: what goes in, what the agent can touch, and where the result ends up. Automated checks do the first pass; a senior engineer confirms each finding and ranks it.
Data it can reach
Databases, files, vector stores, internal APIs and connected accounts reachable through tools or retrieval, and whether access follows the signed-in user or a shared service account.
Untrusted input
Where text the agent did not write enters its context (user messages, uploaded documents, web pages, emails, tool results) and what an injected instruction in that text could reach.
Output to dangerous sinks
Model output that flows into code execution, shell commands, SQL, file paths, raw HTML or outbound requests without validation.
MCP configuration
Which MCP servers are connected, where they come from, how they are pinned and authenticated, and what each exposed tool is permitted to do.
Cost limits
Token, output-length, rate and spend limits, plus loop and retry caps, so a single user or a runaway loop cannot run up the model bill.
We say what was reviewed and what was not. A clean report means we found nothing in the agreed scope; it does not mean the agent is secure.
OWASP mapping
Mapped to the OWASP Top 10 for LLM Applications 2025
Each finding carries its OWASP category, so your team and your customers' security reviewers can place it in a framework they already know. Some categories sit partly or fully outside a review of code and configuration; the list says which.
- LLM01:2025In scope
Prompt Injection
Paths by which user input, documents, web pages or tool results reach the prompt, and what an injected instruction could make the agent do.
- LLM02:2025In scope
Sensitive Information Disclosure
Secrets, personal data or other users' data that the model can read or return, and prompts or responses written to logs.
- LLM03:2025Partly
Supply Chain
MCP servers, model SDKs, agent frameworks and plugins: where they come from and how versions are pinned. A known-vulnerability (CVE) scan of dependencies is included only when agreed in the scope.
- LLM04:2025Partly
Data and Model Poisoning
Who can write to the documents and data the application retrieves or fine-tunes on. Training pipelines and model weights are not assessed.
- LLM05:2025In scope
Improper Output Handling
Model output passed to code execution, shell, SQL, HTML, file paths or URLs without validation or encoding.
- LLM06:2025In scope
Excessive Agency
Tool permissions, credential scopes and human approval for high-impact actions.
- LLM07:2025In scope
System Prompt Leakage
Credentials, internal rules or authorization decisions placed in system prompts, where the model can be asked to repeat them.
- LLM08:2025In scope
Vector and Embedding Weaknesses
Access control and separation between users or tenants in retrieval and vector stores, where the application uses them.
- LLM09:2025Not covered
Misinformation
The accuracy of model answers is a quality question, not something a code and configuration review can measure.
- LLM10:2025In scope
Unbounded Consumption
Token, rate, spend and loop limits on model calls and agent runs.
How it works
Scope first, then a read-only review
Scope and NDA
A short call to agree which agents, tools and integrations are in scope. We sign an NDA and you authorize the review in writing before anything is shared.
Read-only access
Read access to the repository, the agent and tool definitions, system prompts and MCP configuration. No production data and no model API keys.
Review
Automated checks run first. A senior engineer then traces each path from untrusted input to tool call and output, confirms what is real, and ranks it.
Report and walkthrough
A written report with location, impact and fix for every finding, then a call to go through it with your team.
Price and timeline are quoted in writing after the scoping call, before any commitment. The quote depends on the number of agents, tools and integrations in scope. Asking for a quote is free and non-binding.
The report
See the format before you commit
The sample report was generated from a demo application with planted issues, including agent and LLM findings. It contains no client data.
See the sample report →- Ranked by real exploitability. What an attacker could actually reach comes first.
- Specific. File and line, the impact, and the fix.
- Mapped. OWASP Top 10:2025 and OWASP Top 10 for LLM Applications 2025.
- Redacted. Secret values found in code are not reproduced in the report.
- Honest about scope. A list of what was reviewed and what was not.
Scope, plainly
A security review, not a penetration test
A static review
We review code and configuration with read-only access you grant. We do not attack running systems or test production.
Not model evaluation
Answer quality, bias and factual accuracy of the model, and the training of the model itself, are outside the review.
Not a certification
No SOC 2 report, ISO 27001 certificate or audit opinion. The report describes what we found in the agreed scope at the time of the review.
FAQ
Before you write
Do you need our model API keys or production data?
No. Read-only access to the code and configuration in scope is enough. If the review finds secrets in the code, the report shows where they are, with the values redacted.
Which stacks do you review?
The review reads code and configuration, so it is not tied to one framework. Name the language, model provider, agent framework and MCP servers in your first email, and we will say on the call whether the scope fits.
What does it cost, and how do I pay?
Each review is quoted individually: after a free scoping call you get a fixed price in writing, based on the number of agents, tools and integrations in scope. The quote does not commit you to anything.
Payment terms are agreed in writing before any work starts. There is no checkout on this site.
Can you also review the rest of the application?
Yes. The Launch Security Check covers secrets, authentication, database rules, API exposure and dependencies of one application, from US$790 for a small app. If both fit, we will say so on the scoping call.
Start with one email
Tell us what your agent can do
Describe the agent, its tools and the data it reaches. We reply with times for a short scoping call. Please do not send code, credentials or access at this stage.
No mail app? Write to hello@proofmerge.com