Context for decision-makers evaluating MCP / AI-agent static scanners in April 2026.
Verifiable claims only. If you find a claim here that no longer holds, file an issue and we will correct it (best-effort — no fixed clock).
| agent-audit-kit | Microsoft AGT | Snyk Agent Scan (ex Invariant) | Semgrep Multimodal SAST | Lakera Guard | |
|---|---|---|---|---|---|
| License | MIT | MIT | Proprietary | Proprietary + OSS rules | Proprietary |
| Scope | Static scanner + compliance evidence | Runtime governance (policy engine + mesh) | Static + runtime (post-acquisition) | Multimodal SAST | Runtime guardrail |
| Account / cloud required | No | No (but Azure-native paths) | Yes | Optional | Yes |
| Cloud round-trip | No | No | Yes (findings leave your repo) | Optional | Yes |
| Compliance-evidence PDF | Yes (EU AI Act, SOC 2, ISO 27001+42001, HIPAA, NIST AI RMF, Singapore, India DPDP, Alabama DPPA, Tennessee SB 1580) | No (runtime policies, no audit PDFs) | No (findings only) | No | No |
| Regional / US-state compliance | Yes (India DPDP, Singapore, Alabama, Tennessee) | No | No | No | No |
| Signed rule bundle | Yes (Sigstore) | Partial (SLSA provenance on releases) | No (proprietary) | No | No |
| Deterministic (reproducible CI) | Yes | Yes (sub-ms policy enforcement) | No (multi-model analysis) | Partial | No |
| Public CVE-to-rule ledger | Yes (CHANGELOG.cves.md) | No (internal cadence) | No | No | No |
| MCP Security Index / leaderboard | Yes (weekly, 500+ servers) | No | No | No | No |
| Pin + drift verification of tool surface | Yes | Yes (via Agent Runtime rings) | No | No | No |
| OWASP Agentic Top 10 coverage | 10/10 | 10/10 | Partial | Partial | Partial |
Microsoft open-sourced AGT under MIT license on April 2 2026, with broad coverage on Apr 16 (Help Net Security, InfoWorld). It is the first major-vendor entry to claim 10/10 OWASP Agentic Top 10 coverage with deterministic sub-millisecond policy enforcement.
AGT is an ally in positioning, not a head-on competitor. It validates the category we've been shipping for months; different tool, different layer:
- agent-audit-kit runs at CI time and ship time. It's a static scanner + compliance evidence generator. You run it on a repo to catch issues before deployment and to produce auditor-ready PDFs (EU AI Act Art. 15, ISO 42001, Alabama DPPA, Tennessee SB 1580, etc.).
- Microsoft AGT runs at runtime. Agent OS (policy engine), Agent Mesh (A2A comms), Agent Runtime (dynamic execution rings), Agent SRE (reliability), Agent Compliance (automated evidence collection), Agent Marketplace, Agent Lightning (RL training governance). It enforces policies as agents execute.
Use both: agent-audit-kit tells an auditor your design is sound;
Microsoft AGT tells them your runtime actually behaved. Differentiation
is the compliance-evidence PDF stack (EU/US state-by-state), the
public CVE-to-rule ledger, the signed rule bundle,
and the MCP Security Index leaderboard — none of which are AGT goals.
Microsoft AGT ships Python / TypeScript / Rust / Go / .NET. Integrations
already operational in Dify, LlamaIndex, OpenAI Agents SDK, Haystack,
LangGraph, PydanticAI. agent-audit-kit integrates with AGT findings on
the roadmap (a future --runtime-policies microsoft-agt flag can
cross-check our static rules against a deployed AGT policy set).
SnapLogic announced
enterprise iPaaS primitives for agent identity + governance. Signal: "agent
identity" is now a vendor-category, not a feature. agent-audit-kit's
pin + verify commands already cover the "is this the agent I
expected?" question for MCP tool surface; SnapLogic extends the same
idea to cross-enterprise RPA / iPaaS flows. Complementary, not
competing.
-
Multi-model analysis. Snyk's acquisition of Invariant Labs bought them a proprietary corpus + a multi-model pipeline. Their ToxicSkills recall numbers (claimed 90–100%) are out of reach for a deterministic scanner. If you need semantic coverage on skills you don't author, you want both: Snyk for that and agent-audit-kit for compliance evidence + pin/verify + a public CVE-to-rule ledger.
-
Hosted dashboards. We ship SARIF for GitHub Security tab. If you want a hosted triage dashboard, a commercial product is easier.
-
Vulnerability research. We ship detection for disclosed MCP CVEs on a best-effort basis, tracked in a public ledger. We do NOT originate CVE research — that's Invariant, Palo Alto Unit 42, HiddenLayer, Check Point, etc.
- You need an auditor-ready compliance report (EU AI Act high-risk obligations Aug 2 2026).
- Your environment is air-gapped (defense, finance, healthcare) and no data can leave the repo.
- You need reproducible CI — the same scan on the same commit must produce byte-identical output.
- You have regional compliance obligations in India (DPDP Act) or Singapore (Agentic AI Governance Framework).
- You want to pin + verify your MCP tool surface over time.
- You need a public scanner whose rule set your security team can read, audit, and fork.
- You have zero in-house security review capacity and want a vendor SLA, phone number, and on-call.
- You need a hosted triage dashboard beyond SARIF → GitHub.
- You prefer to pay for multi-model semantic analysis of skills/tools from third parties.
The OSS agent-security-scanner category is crowded (May 2025–Apr 2026):
snyk/agent-scan, cisco-ai-defense/mcp-scanner, riseandignite/mcp-shield,
mcpshield/mcpshield, affaan-m/agentshield, HeadyZhang/agent-audit,
plus Semgrep's Multimodal SAST.
What's empty in the category: compliance evidence mapped to specific regulatory articles; deterministic reproducibility; a public CVE-to-rule ledger; a pinning + drift primitive; a public leaderboard. agent-audit-kit occupies that space.
Last reviewed: 2026-04-18.
Merged here from docs/comparison.md in v0.3.86. Three comparison pages
coexisted, the README linked only this one, and the other two drifted unread.
| Feature | AgentAuditKit | mcp-scan | Snyk Agent | Agent Audit | Microsoft AGT |
|---|---|---|---|---|---|
| Rules | 320 | ~10 | ~15 | 57 | N/A (runtime) |
| MCP config scanning | Yes | No | Yes | No | No |
| Hook injection detection | Yes | No | No | No | No |
| Trust boundary analysis | Yes | No | No | No | Yes |
| Secret exposure scanning | Yes | No | Yes | No | No |
| Supply chain analysis | Yes | No | Yes | No | No |
| Agent instruction scanning | Yes | No | No | No | No |
| Tool poisoning detection | Yes | Yes | Yes | No | No |
| Tool pinning / rug pull | Yes | Yes | No | No | No |
| Taint analysis (@tool) | Yes | No | No | Yes | No |
| A2A protocol scanning | Yes | No | No | No | No |
| Multi-agent discovery | Yes | No | Yes | No | No |
| OWASP Agentic Top 10 | 10/10 | 0/10 | Partial | 10/10 | 10/10 |
| OWASP MCP Top 10 | 10/10 | Partial | Partial | 0/10 | 0/10 |
| Compliance frameworks | 12 | 0 | 0 | 0 | 3 |
| SARIF output | Yes | No | Yes | No | No |
| Auto-fix mode | Yes | No | No | No | No |
| Security scoring | Yes | No | No | No | No |
| Pre-commit hook | Yes | No | No | No | No |
| GitHub Action | Yes | No | Yes | No | No |
| Runtime proxy | Yes | No | No | No | Yes |
| Offline / no network | Yes | No | No | Yes | Yes |
| Zero dependencies | Yes* | No | No | No | No |
*Only click + pyyaml required.
- AgentAuditKit: Comprehensive static + config scanning, compliance reporting, CI/CD integration
- mcp-scan: Quick tool description poisoning check via cloud API
- Snyk Agent Scan: Enterprise multi-agent MDM with cloud backend
- Agent Audit: Academic-quality taint analysis for LangChain/CrewAI code
- Microsoft AGT: Runtime policy enforcement with execution rings
These tools are complementary. Use AgentAuditKit alongside runtime tools for defense-in-depth.
Merged here from docs/comparison-gitlab-agentic-sast.md in v0.3.86.
GitLab 18.11 (2026-04-17) shipped Agentic SAST behind the Ultimate tier. This is a no-marketing, dated-source comparison so AAK consumers can pick the right tool for their stack.
| Dimension | AgentAuditKit | GitLab Agentic SAST 18.11 |
|---|---|---|
| License | MIT, OSS | Proprietary, Ultimate-tier paywall |
| Distribution | PyPI + Marketplace + Docker + VS Code ext | GitLab CI / Premium offering only |
| Rule count | 320 | Not publicly disclosed |
| OWASP Agentic Top 10 mapping | Per-rule, public JSON manifest | Claimed; mapping not published |
| MCP Top 10 mapping | Per-rule | Not advertised |
| AICM (CSA) mapping | Yes | Not advertised |
| Out-of-band corpus refresh | aak corpus update (signed) |
No equivalent — rules ship on product release cadence |
| SARIF diff (regression-only gating) | aak diff --baseline ... --current ... |
Not advertised |
| VS Code extension | Yes (open-source) | No |
| PR-title indirect prompt injection | AAK-PRTITLE-IPI-001 (CVSS 9.4) | Not advertised in 18.11 changelog |
| MCP function-hijacking detection | AAK-MCP-FHI-001 (arXiv 2604.20994) | Not advertised |
| Atlassian MCP CVEs | AAK-MCP-ATLASSIAN-CVE-2026-27825/27826 | Generic SAST may catch; no per-CVE rule |
| Sigstore-attested releases | Yes | Not applicable |
| Self-scan / dogfood gate | .github/workflows/self-scan.yml (PR-blocking) |
Not applicable to a managed product |
- DAST + IAST integration: GitLab integrates SAST + DAST + IAST in one pipeline. AAK is SAST + supply-chain only.
- Multi-tenant org-level dashboards: GitLab's Vulnerability Reports aggregate across the org. AAK ships SARIF; consumers wire their own dashboard.
- Ecosystem coverage: GitLab's traditional SAST has rule packs for ~30 languages. AAK targets the agent / MCP slice specifically.
- Same-day defense for new payload families: Out-of-band signed corpus refresh decouples threat-data updates from product releases.
- PR-title IPI rule: First-to-market on Comment-and-Control class (CVSS 9.4, 2026-04-25 disclosure).
- MCP function-hijacking rule: First-to-market on the BFCL FHI class (arXiv 2604.20994, 2026-04-23, 70-100% ASR).
- Free + OSS: No tier paywall, no per-seat licensing.
- SARIF regression gating:
aak difflets PR-blocking workflows gate onnewly_introducedonly — eliminates the "huge backlog blocks every PR" failure mode that GitLab Ultimate users report.
- GitLab 18.11 release announcement: https://www.helpnetsecurity.com/2026/04/17/gitlab-18-11-agentic-ai/
- AAK v0.3.8 release notes: ../releases/v0.3.8.md
- OWASP Agentic Top 10: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
Last updated: 2026-04-27