Y
yagobski/agentleak
Open-source privacy testing for AI agents. Python SDK, CLI and MCP tools to detect data leaks across tool calls, memory, inter-agent messages and logs, with redacted reports and CI gates.
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
- Copy the command above
- Paste it as one entry under
mcpServersinclaude_desktop_config.json— local servers take command + args (example: clients) - Restart your client
Install command from the repository
pip install agentleak
Parsed from the README we fetched on 2026-10-26; we have not executed it.
This is the install method the repository states, not an MCP client config, so no JSON is generated.
Key names differ by client: Clients & CLI
- Star count
- 11 ★ · yagobski/agentleak · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 11 ★ · 23 sources · mcp
- Install
pip install agentleak
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
pip install agentleak. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
yagobski/agentleak；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.Privacy-leakage testing for AI agents.
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Audit every execution channel, score it deterministically, gate it in CI.
Quickstart ·
Documentation ·
Benchmark ·
Scoring ·
Website
Your agent's final answer can look perfectly clean while sensitive data leaks
through its tool calls, shared memory, inter-agent messages, and logs, the
channels that output-only audits never inspect. AgentLeak tests for exactly
that, locally, before you ship.
text
Risk Index: 0.440 / 1.0 High risk (privacy 56/100)
Final output: clean ✓
Shared memory: L4 health identifier + diagnosis leaked ✗
Inter-agent: L4 diagnosis leaked ✗
Logs: L2 email leaked ✗
Key insight: the final answer appears safe, but sensitive data leaked through
internal channels. (The SIN, medication and address the agent received stayed
contained, which is why RI is 0.440 and not 1.0.)
A trace goes in, a privacy report comes out. Leakage is scored with
AgentRisk, a severity-weighted, density-normalized Risk
Index grounded in GDPR Article 9 and Québec Law 25. No cloud, no LLM dependency,
no data ever leaves your machine.
## What is in this repository
AgentLeak-authored software and scenarios are released under MIT. Bundled
third-party-derived research fixtures retain their upstream licenses and
attribution: PrivacyLens-derived fixtures are CC-BY-4.0 and AgentDojo-derived
fixtures are MIT. The wheel includes the applicable license texts and NOTICE.
| | Where |
| SDK, CLI, engine, AgentLeak-authored scenarios, Action, local UI | this repository, MIT |
| PrivacyLens-derived fixtures | bundled research fixtures, CC-BY-4.0 |
| AgentDojo-derived fixtures | bundled research fixtures, MIT |
| Hosted workspace | agentleak.org/app |
| Published benchmark | agentleak.org/benchmark |
## Install
bash
pip install agentleak # core
pip install "agentleak[gui]" # + local web UI
pip install "agentleak[mcp]" # + MCP tools for coding agents
pip install "agentleak[presidio]" # + Presidio
pip install "agentleak[full]" # everything above
From source:
bash
git clone https://github.com/yagobski/agentleak.git
cd agentleak
pip install -e ".[dev]"
## Platform (web UI)
bash
pip install 'agentleak[gui]'
agentleak serve # opens http://127.0.0.1:8000/app/
A full local platform built with React, Tailwind and shadcn/ui (black
theme), fully self-contained (no CDN, self-hosted fonts), with a left-sidebar
navigation:
Projects — each is an agent under test. Run a real agent against any
scenario, or use the built-in scripted agent offline. Connect your own agent
via the SDK (the Connect tab generates a copy-paste snippet).
Red Team — 62 executable plugin IDs (24 native, plus 38 transposed for
Promptfoo compatibility so an existing taxonomy keeps working —
not a scoreboard)
privacy/security transpositions, mapped to 46
observable attack classes across 6 families, combined with 10 delivery
strategies (direct, jailbreak framing, markup, encodings, Unicode, and
multi-turn Crescendo). Run a zero-cost scripted baseline or attack the real
configured agent; every probe persists with ASR / ELR / CLR evidence.
Runs — every analysis is stored locally (SQLite); view, compare
(weight-robust dominance), export (JSON / MD / HTML), delete.
Quickstart ·
Documentation ·
Benchmark ·
Scoring ·
Website
Your agent's final answer can look perfectly clean while sensitive data leaks
through its tool calls, shared memory, inter-agent messages, and logs, the
channels that output-only audits never inspect. AgentLeak tests for exactly
that, locally, before you ship.
text
Risk Index: 0.440 / 1.0 High risk (privacy 56/100)
Final output: clean ✓
Shared memory: L4 health identifier + diagnosis leaked ✗
Inter-agent: L4 diagnosis leaked ✗
Logs: L2 email leaked ✗
Key insight: the final answer appears safe, but sensitive data leaked through
internal channels. (The SIN, medication and address the agent received stayed
contained, which is why RI is 0.440 and not 1.0.)
A trace goes in, a privacy report comes out. Leakage is scored with
AgentRisk, a severity-weighted, density-normalized Risk
Index grounded in GDPR Article 9 and Québec Law 25. No cloud, no LLM dependency,
no data ever leaves your machine.
## What is in this repository
AgentLeak-authored software and scenarios are released under MIT. Bundled
third-party-derived research fixtures retain their upstream licenses and
attribution: PrivacyLens-derived fixtures are CC-BY-4.0 and AgentDojo-derived
fixtures are MIT. The wheel includes the applicable license texts and NOTICE.
| | Where |
| SDK, CLI, engine, AgentLeak-authored scenarios, Action, local UI | this repository, MIT |
| PrivacyLens-derived fixtures | bundled research fixtures, CC-BY-4.0 |
| AgentDojo-derived fixtures | bundled research fixtures, MIT |
| Hosted workspace | agentleak.org/app |
| Published benchmark | agentleak.org/benchmark |
## Install
bash
pip install agentleak # core
pip install "agentleak[gui]" # + local web UI
pip install "agentleak[mcp]" # + MCP tools for coding agents
pip install "agentleak[presidio]" # + Presidio
pip install "agentleak[full]" # everything above
From source:
bash
git clone https://github.com/yagobski/agentleak.git
cd agentleak
pip install -e ".[dev]"
## Platform (web UI)
bash
pip install 'agentleak[gui]'
agentleak serve # opens http://127.0.0.1:8000/app/
A full local platform built with React, Tailwind and shadcn/ui (black
theme), fully self-contained (no CDN, self-hosted fonts), with a left-sidebar
navigation:
Projects — each is an agent under test. Run a real agent against any
scenario, or use the built-in scripted agent offline. Connect your own agent
via the SDK (the Connect tab generates a copy-paste snippet).
Red Team — 62 executable plugin IDs (24 native, plus 38 transposed for
Promptfoo compatibility so an existing taxonomy keeps working —
not a scoreboard)
privacy/security transpositions, mapped to 46
observable attack classes across 6 families, combined with 10 delivery
strategies (direct, jailbreak framing, markup, encodings, Unicode, and
multi-turn Crescendo). Run a zero-cost scripted baseline or attack the real
configured agent; every probe persists with ASR / ELR / CLR evidence.
Runs — every analysis is stored locally (SQLite); view, compare
(weight-robust dominance), export (JSON / MD / HTML), delete.
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/yagobski-agentleak/)
- Source
- awesome · https://github.com/yagobski/agentleak
- Browse by field
- MCP servers
- Traction
- 11 ★
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.