I wrote a 12-page white paper on agent-ops-check, a free Node CLI (MIT license) that reads agent code, prompts and configs and reports risks. It runs fully offline: no SaaS, no account, no network calls. LLM review is optional and uses your own key.
npx github:ultimatixarup/agent-ops-check ./my-agent
What the paper covers
Five needs, each matched to checks:
| Need | Tab | Count today |
|---|---|---|
| Personal data in work channels | 1 Crossover | 6 personal sources, 6 work sinks, 9 secret patterns, 4 PII patterns |
| Agents acting on other sites | 2 Actions | 27 irreversible verbs, 4 gate detectors, 5 risky reads |
| Governance and spend | 3 Governance, 4 Labs | 11 provider patterns, 8 framework patterns, 11 governance findings |
| Hidden instructions in documents | 6 ADSF | 18 rule IDs |
| Unclear instructions | 5 STE | 11 style rules, 25 phrasal verbs, 31 hedges |
Architecture. Inputs are a folder, files, a .zip or stdin. The rules are YAML, the engine uses regex, and the reports come out as HTML, JSON, Markdown and SARIF. The local UI listens on 127.0.0.1 only. The score runs from 0 to 100: a high finding costs 10 points, a medium costs 4 and a low costs 1. The bad example in the repo scores 27.
Standards mapping. The checks map to 10 frameworks (112 items), including OWASP Top 10 for LLM Applications 2025, OWASP Agentic 2026, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS, CSA AICM and the EU AI Act. This is "maps to", never "compliant". For the paper I re-scored each item strictly against the code: 29 ✅ / 64 🟡 / 19 ⬜, against 43 / 52 / 17 shipped. In 16 items my score is lower than the shipped status.
Limits. The checks are static only, so they read what code says, not what it enforces. They can miss problems and flag harmless code. A gate is found only if it is from 6 lines above to 12 lines below an action.
- Read: https://github.com/ultimatixarup/agent-ops-check/blob/main/docs/WHITEPAPER.md
- PDF: https://github.com/ultimatixarup/agent-ops-check/blob/main/docs/whitepaper.pdf
Feedback on false positives is welcome.
Personal project built on my own time. Not affiliated with or endorsed by my employer; views are my own.
Top comments (0)