If you're building an AI agent right now, there's a decent chance you're testing it by hand: typing weird prompts into a chat window and seeing what breaks. That works until your agent has tools, multi-turn memory, and an API surface someone else can hit. At that point you need something closer to a real test suite, and it needs to live where you're already working.
That's what humanbound-test is for. It's the first plugin in the new humanbound/plugins marketplace, and it brings adversarial security testing into Claude Code and Cursor as slash commands.
What it actually does
The main flow, /humanbound-test:run, walks through:
- Verify the Humanbound MCP and ngrok are set up
- Auto-detect your local FastAPI server
- Tunnel it out with ngrok
- Help you fill in bot-config.json (your agent's endpoints, payload shape, auth, telemetry)
- Dispatch the test through the Humanbound MCP
- Report results by email, or via /humanbound-test:resume if you'd rather watch it in-band
There are six slash commands total: run, setup, status, resume, stop, and config. Only run also responds to natural language. Say "run an adversarial test on my local agent" or "test my chatbot for jailbreaks" and the orchestrator skill infers intent and asks for whatever config it's missing. The other five are slash-only on purpose. Teardown, secrets, and config edits should be intentional, not something a stray sentence triggers.
Install
Claude Code:
/plugin marketplace add https://github.com/humanbound/plugins.git
/plugin install humanbound-test@humanbound-plugins
Restart your session and the six /humanbound-test:* commands show up.
Cursor (2.5 doesn't support Git-URL plugin installs yet, so it's a symlink for now):
bash
git clone https://github.com/humanbound/plugins.git ~/src/humanbound-plugins
mkdir -p ~/.cursor/plugins/local
ln -s ~/src/humanbound-plugins/plugins/humanbound-test ~/.cursor/plugins/local/humanbound-test
Then check Cursor → Settings → Plugins → Local plugins.
Under Cursor, Bash gating works differently: instead of Claude Code's per-command allowed-tools frontmatter, the plugin uses Cursor's beforeShellExecution hook to audit every shell exec to ~/.humanbound/test/logs/cursor-shell-audit.log and block anything invoking a humanbound-test script from outside the plugin root. Different hook model, same posture.
What you'll need
macOS (primary) or Linux (best-effort), Python 3.11+
The humanbound[mcp] package, which the plugin offers to install on first run
A logged-in hb session: the plugin dispatches tests through the hosted Humanbound platform, so this is a hard prerequisite, not optional
ngrok, authenticated (the plugin walks you through this too)
The honest limitation
Right now this only detects FastAPI servers. If your agent runs on Flask, Django, LangServe, Streamlit, Gradio, Express, Next.js, or Hono, the plugin will error out and point you at the roadmap, where LangServe support and a runtime OpenAPI scrape are next in line.
It also won't guess your agent's endpoint shapes or auth for you. You author bot-config.json yourself. That's a deliberate choice: pattern-matching against route decorators or guessing Pydantic field names is exactly the kind of "helpful" auto-detection that quietly breaks on anyone's actual codebase. You know your agent better than a detector script does.
Why this plugin, and not just a CLI
You could run adversarial tests against your agent from a standalone script today. The reason to put it in the editor as a plugin is the same reason linters and test runners live in the editor: the loop between "I changed something" and "did I just introduce a jailbreak path" gets shorter when you don't have to context-switch. Endpoint configs, multi-turn conversations, tool-abuse scenarios, all runnable with one command against whatever you're already looking at.
It's also part of a bigger idea we care about: testing an agent and then doing nothing with the findings isn't that useful. Most open-source testing tools stop at the report. Closing the loop from test failure to an actual guardrail is still work most tooling leaves on the table, and it's a big part of what we're building toward on the Humanbound platform side.
Contributing
This is a preview release (v0.1.0), and the plugin schema, slash commands, and .humanbound/ layout may still change before 1.0. If you hit something broken, or want to propose a new plugin, CONTRIBUTING.md has the dev loop and CLA info. Apache-2.0 licensed, code's fully open.
Repo: https://github.com/humanbound/plugins
Docs: https://docs.humanbound.ai/
Discord: https://discord.gg/gQyXjVBF
Top comments (0)