Is your agent ecosystem under control?

How it works

1. Create an account. Confirm your email, and turn on two-step verification if you like. Create your organisation, or accept an invitation to one. Invite colleagues as viewers (read only) or editors (create and change assessments).
2. Describe your setup. The data and systems you hold, your MCP servers and the tools each one offers, the agents that call them, any gateway or guardrail in between (authentication, authorisation, prompt injection filters), and 28 short questions across 9 areas. Save a draft and come back.
3. Get the assessment. A score and level, the first three things to do, a map of your ecosystem with the risky parts marked, and a zoomable globe that takes you to your country, your city and your building, with third-party agents and tools drawn outside on the internet, every finding explained, and reading from the PADAWAN reports. The site owner may add a written review.

What it looks at

• Know your agentsYou cannot protect what you cannot list.
• Identity and accessWhat agents can do is decided by the credentials they hold.
• Human oversightWhere a person stays in the loop, and whether the agent can skip it.
• ContainmentHow far a manipulated or mistaken agent can get.
• Tools and MCPEvery tool an agent can call is part of its attack surface.
• Data and knowledgeWhat agents read, who wrote it, and where it goes.
• Monitoring and responseWhether you would notice, and what you would do.
• Supply chain and changeWhat you let agents install, and how change is controlled.
• Governance and accountabilityPolicy, regulation, insurance and people.

The kind of thing it finds

• critical
  Agents rely on shared or static credentials

  A shared key means one leak exposes every agent and the logs cannot tell them apart. Static keys sit in config, traces and chat history until someone notices.

• critical
  No dependable human approval on risky actions

  If approval is a habit rather than a control, a manipulated agent simply does the thing. This is the most common route from an injected instruction to real loss.

• critical
  Outsider-written content is read as trusted

  This is how prompt injection works in practice: a ticket, email or web page carries instructions that the agent obeys.

• critical
  Tool servers without authentication

  Internet scans find unauthenticated MCP servers by the thousand. Inside a network, one compromised host or agent can use every open server.

It also looks at how your ecosystem is wired. For example, an agent that reads text outsiders can write, can see confidential data and can send things out has a ready-made prompt injection path, and the assessment says so by name.