Skip to content
Guard0

g0The open source background check for AI agents

You wouldn't hire someone without a background check. Why would you deploy an AI agent without one?

$ npx @guard0/g0 check

Is anything on this machine known-malicious? Then npx @guard0/g0 scan .

GitHubDocsnpmAGPL-3.0
and many more
Rules
1,128
github.com/guard0-ai/g0 README and docs/rules.md
Security domains
12
src/rules/builtin, one directory per domain
Framework parsers
10
LangChain, CrewAI, MCP and others, plus a generic parser
Malicious skills known
824
Koi audit of ClawHub, 2026, in the known-malicious database

Every background check answers three questions.

Vet any agent before it ships.

Point g0 at any repository. It finds every agent, maps every tool, and grades twelve security domains against OWASP, NIST, ISO 42001, and the EU AI Act. Every finding says what is wrong, where it is, and how to fix it. The grade is capped by the worst finding, so one critical cannot hide behind a good average.

$ g0 scan ./my-agent
LangChainOpenAIAnthropicCrewAIAWS BedrockVercel AISalesforceand many more
$g0 scan ./my-banking-agent
g0 v2.1.0 | Framework: langchain (+mcp)
Files: 14 | Agents: 2 | Tools: 4 | Prompts: 2
Goal Integrity60
5 issues
Tool Safety78
4 issues
Identity & Access45
6 issues
Data Leakage82
3 issues
Code Execution52
6 issues
Memory & Context71
3 issues
Supply Chain91
1 issues
Human Oversight88
1 issues
Inter-Agent55
4 issues
Cascading Failures73
2 issues
Reliability Bounds80
2 issues
Rogue Agent66
3 issues
CRITICALTool accepts raw SQL from user input
tools.py:34 | AA-TS-026 | Fix: Parameterize the query, scope the tool to the tables it needs
HIGHSystem prompt has no scope boundaries
main.py:21 | AA-GI-001 | Fix: State the role, the task, and what the agent must refuse
HIGHAPI key in prompt template
prompts/support.md:4 | AA-IA-003 | Fix: Move the key to the environment and rotate it
Overall:Ccapped: 1 critical | 21 findings | 2 Critical | 5 High | 6 Medium
OpenClaw

ClawHavoc is active. 824 malicious skills.

Koi's 2026 audit of ClawHub found 824 malicious skills. g0 ships full OpenClaw coverage: scan project files, audit ClawHub skills against the known-malicious database, red-team with OpenClaw-specific payloads, and probe live instances for both active CVEs.

$ g0 scan ./my-openclaw-agent
$ g0 mcp audit-skills ~/.openclaw/skills/

Probes CVE-2026-25253 (CVSS 8.8) and CVE-2026-28363 (CVSS 9.9).

$g0 mcp audit-skills
OpenClaw Skill Audit (ClawHub Supply-Chain)
MALICIOUSattacker/web-searrchscore: 0/100
ClawHavoc IOC detected: ClawHavoc C2 IOC (clawback3.onion)
TRUSTEDopenclaw/web-searchscore: 95/100
Verified publisher.
CAUTIONnew-dev/helperscore: 65/100
Unverified. Published 12 days ago.
Live Hardening Audit
VULNCVE-2026-25253: 1-click RCE via crafted skill
VULNCVE-2026-28363: safeBins bypass to arbitrary execution
SAFESession isolation: verified

Your dev machine is part of the attack surface.

g0 finds every AI tool installed, every MCP server connected, every hardcoded secret, by their config paths. One command. Auto-fix what it finds.

$ g0 endpoint
$ g0 endpoint --fix

Detects Claude Code, Cursor, Windsurf, VS Code, Zed, JetBrains, Gemini CLI, Amazon Q, Cline, OpenClaw, and many more.

$g0 endpoint
AI developer tools (5 detected)
Claude Coderunning3 MCPs
Cursorrunning1 MCPs
Claude Desktopinstalled
Windsurfrunning2 MCPs
OpenClawrunning
MCP findings
CRITICALHardcoded DATABASE_URL
postgres-mcp via Claude Code
CRITICALHardcoded SLACK_BOT_TOKEN
slack-mcp via Cursor
HIGHUnpinned version via npx
mcp-puppeteer via Continue
2 Critical | 1 High | Auto-fix available

And that's not all.

Everything else the background check covers.

  • Runtime enforcement

    g0 proxy sits on live MCP traffic: deny, redact, coach, or alert on every tool call, with checksum-validated secrets and exact-data-match.

  • One-command guardrails

    g0 protect installs proxy routing, known-malicious quarantine, and Claude Code hook enforcement. Dry-run first, fully undoable.

  • Red-team any agent

    An adversarial payload corpus, a 4-level judge cascade, and CVSS scoring against a live agent, HTTP endpoint, or MCP server.

  • Signed AI-BOM

    CycloneDX 1.6 inventory of every model, tool, agent, and MCP server. Content-addressed, so it diffs across releases.

  • Gate CI and PRs

    SARIF, JUnit, and a sticky PR comment via the GitHub Action. Baseline gating fails only on findings new since your baseline.

  • Runs inside your IDE

    g0 mcp serve turns g0 into an MCP server, so Claude Code, Cursor, and Windsurf can scan and vet servers from the chat.

g0 scans your code. Guard0 holds your whole company accountable.

Start with the CLI. Move to the platform when the agent becomes a company responsibility.

  • g0 CLI

    Open source, AGPL-3.0.

    • Local-first. No account required. Never uploads scans.
    • Scan, red-team, and audit MCP servers.
    • Runtime proxy and one-command protect.
    • Gate CI/CD on critical findings.
    $ npx @guard0/g0 scan .

  • Guard0

    Free to start.

    • Every agent your company runs, in one register.
    • A named owner for each.
    • Red teaming on a schedule, findings with their evidence.
    • Connect a repository or a cloud account, read-only.
    Start free

    Free. No card.

  • In your environment

    Private SaaS or air-gapped.

    • Inside your cloud account, or fully air-gapped.
    • Nothing leaves your environment.
    • The endpoint sensor, through the MDM you already run.
    • SIEM, tickets, and on-call connected.

Start free.

g0 is free and runs from your own terminal. Guard0 keeps the register for the whole company, with an owner for every agent.

Start freeg0 on GitHub

Free to start. No card. g0 never uploads scans.