AI security · agentic AI engineering — B.Tech CSE (Cybersecurity), IIIT Kottayam
I build static scanners and evaluation harnesses for the attack surfaces of LLM agents: MCP tool definitions, agent memory files, RAG corpora and fine-tuning datasets. I measure them on real-world data and report the precision numbers, including the unflattering ones.
📫 praisingharris@gmail.com · LinkedIn
mcp-scan-study — an empirical evaluation of my own MCP security scanners on 90 top-starred public MCP-server repos (4,898 tools statically extracted, commit-pinned corpus, plus a 45-repo fresh validation set).
- The first result was humbling: mcpaudit v0.6's HIGH
permission_scopefindings had 37.5% strict precision on hand-labelled samples. - I patched the scanner and re-evaluated on a held-out sample. Precision rose to 64.3%, and on a blind-labelled fresh corpus it went from 40% to 72.7% with every accurate finding retained.
- memsentry false positives on 170 agent-context files dropped from 61 to 5.
- Limitations (single labeller, top-starred repos only, static extraction) are documented in the report.
AI-agent security scanners — Python CLIs on PyPI with SARIF output for GitHub code scanning and documented evaluation methodology:
| Tool | What it detects |
|---|---|
| mcpaudit | MCP servers: tool-description poisoning, over-broad permission scope, rug-pull and confused-deputy patterns |
| memsentry | Injected instructions and hidden payloads in agent memory/context files |
| ragsentry | Instruction injection and retrieval manipulation in RAG source documents |
| trainsentry | Planted poisoning in fine-tuning datasets: injection, rare-trigger backdoors, duplicate flooding |
| loopcheck | Wasted calls in agent tool-calling loops: duplicates, thrashing, semantic redundancy |
| aisec-suite | One aisec CLI and GitHub Action that runs the scanners together |
Also: adversagen (red-team counterpart that evolves evasions against the scanners above) and agent-security-ci (the scanners wired into a CI gate against clean/vulnerable agent fixtures).
OSIRIS — my personal agent runtime, which I use daily from the terminal. It supports multiple LLM providers with failover, tool calling and a Discord interface. It also includes a tool-calling reliability benchmark for local models, which led to a dedicated Ollama code path and fixed a large local-model latency problem.
soc-parallax — SOC behavioural-detection platform (FastAPI, Postgres, Neo4j, local LLM via Ollama, Next.js).
| Project | PR | Status |
|---|---|---|
| SQLGlot | #8780 — typed lambda parameters shared one DataType node across casts, breaking in-place transforms |
✅ Merged |
| SQLFluff | #8899, #8900, #8901, #8902 — dialect grammar fixes | In review |
| LiteLLM | #47105, #47311, #47312 — authorization checks on proxy management endpoints | Open |
| CrewAI | #8240, #8244 — MCP pagination cursor, Redis URL decoding | Open |
| Qualtran · PennyLane | #1986 · #10391 | Open |
ModelHawk (pickle-RCE detection in model files without loading them) · PromptStrike (LLM jailbreak red-teaming CLI) · pqc-scanner (post-quantum crypto migration analyzer) · qec-lab (surface-code simulation with Stim + PyMatching)
Stack: Python, TypeScript, SQL, Bash · FastAPI, Postgres, Neo4j, Docker · OpenAI/Anthropic/Ollama APIs, MCP · SARIF, GitHub Actions