DEV Community

Cover image for Hardening Production AI Agents: Open-Sourcing an MCP AST Security Auditor, Multimodal JSONL Crash Firewall & Zero-Downtime LLM Router
HM Shihabuddin Jashory
HM Shihabuddin Jashory

Posted on

Hardening Production AI Agents: Open-Sourcing an MCP AST Security Auditor, Multimodal JSONL Crash Firewall & Zero-Downtime LLM Router

#ai #opensource #github #security

When moving autonomous AI agents from local prototypes into production CI/CD pipelines, three critical engineering failure modes consistently surface:

  1. Unverified MCP Tool Execution: Model Context Protocol (MCP) servers and agent tools frequently expose unvalidated shell execution, SSRF, path traversal, or prompt-injected tool descriptions (OWASP LLM01–LLM10).
  2. Multimodal Trajectory Poisoning (HTTP 400 INVALID_ARGUMENT): A single password-protected PDF, 0-byte attachment, or HTML login error page saved with a .pdf/.png extension permanently bricks long-running transcript.jsonl sessions in Claude Code, Google Antigravity, and Codex.
  3. Single-Provider Rate Limits & Stream Drops: Relying on a single upstream LLM endpoint leads to cascading failures during HTTP 429 quota exhaustion or HTTP 529 upstream overload.

Today, I am open-sourcing v2.0.0 of three zero-dependency Python engines—each published as an official GitHub Marketplace Action and paired with an Interactive Browser Sandbox you can test immediately without installing anything.

1. MCP & AI Agent Security Auditor (v2.0.0)

GitHub Repository • GitHub Marketplace Action • Live Browser AST Sandbox

mcp-agent-security-auditor is a zero-dependency Python AST taint & static security analyzer purpose-built for Model Context Protocol (MCP) servers, LangChain/CrewAI tools, and autonomous agent skills.

Key Capabilities

  • 12 Security Rules Mapped to OWASP LLM Top 10 & CWE: Detects command injection (subprocess(..., shell=True), os.system, eval), SSRF in tool handlers, credential & os.environ exfiltration, arbitrary file writes, and hidden prompt-injection instructions inside tool docstrings (MCP-001 through MCP-012).
  • Native SARIF v2.1.0 Output: Integrates directly with the GitHub Security Code Scanning tab.

Drop-in GitHub Action Usage 

name: MCP & Agent Security Audit
on: [push, pull_request]

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run MCP & AI Agent Security Auditor
        uses: jashory/mcp-agent-security-auditor@v2.0.0
        with:
          target: "."
          format: "sarif"
          fail-on: "high"
Enter fullscreen mode Exit fullscreen mode

2. AGY & Claude Code Crash Guard Kit (v2.0.0)

GitHub Repository • GitHub Marketplace Action • Live Multimodal Firewall Sandbox

If you have ever had a 200-step agent conversation permanently die with HTTP 400 INVALID_ARGUMENT after reading a downloaded PDF or image, the root cause is almost always multimodal trajectory poisoning. Once an encrypted PDF (/Encrypt), a 0-byte file, or an HTML error page disguised as a PNG/PDF is appended into transcript.jsonl, every subsequent API turn fails.

Key Capabilities

  • Pre-Flight Binary & Magic-Byte Firewall: Inspects magic bytes (%PDF-, PNG/JPEG/WebP headers), detects PDF /Encrypt dictionaries without external dependencies, and blocks oversized or fake-HTML media before read_file is invoked.
  • Self-Healing JSONL Trajectory Surgeon: Scans poisoned .jsonl transcripts, isolates corrupted multimodal blocks, creates a timestamped backup, and surgically repairs the session in place. 
# Pre-flight validate any media or PDF before agent ingestion
python crash_guard.py --check ./downloads/statement.pdf

# Surgically heal a bricked agent conversation transcript
python crash_guard.py --heal ~/.gemini/antigravity/brain/<session-id>/.system_generated/logs/transcript.jsonl
Enter fullscreen mode Exit fullscreen mode

3. Infinite LLM Fallback Router (v2.0.0)

GitHub Repository • GitHub Marketplace Action • Live Failover Simulator

infinite-llm-fallback-router is a lightweight, zero-dependency multi-provider AI gateway that routes requests across Anthropic Claude, Google Gemini, OpenAI, DeepSeek, and local OpenAI-compatible servers.

Key Capabilities

  • Sub-Second Failover & Stateful Circuit Breakers: Automatically detects HTTP 429, 500, 502, 503, and 529 responses, trips per-provider circuit breakers with exponential cooldowns, and fails over cleanly across providers.
  • CI/CD Route Matrix Verification: Ships as a GitHub Action to validate routing configurations and fallback chains on every commit.

4. Bonus: Built-in WebCrypto RFC 6238 TOTP 2FA Vault in Vision Flow Studio Pro v2.0

Alongside these three open-source repositories, we also shipped Step 08: Client-Side WebCrypto TOTP 2FA Code Generator inside Vision Flow Studio Pro v2.0 and updated our full-stack SaaS & Cybersecurity engineering showcase at Vision Flow Agency.

All three open-source tools are MIT-licensed and available today:

Feedback, issues, and pull requests are welcome!

Top comments (0)