MASSAT - Multi-Agent System Security Audit Toolkit

The open-source security audit framework for AI agent systems. Covers all 10 OWASP Agent Security Index (ASI) categories. Used in production to audit a 94-agent fleet.

Get a Free Audit in 30 Seconds

curl -X POST https://craigmbrown.com/api/audit \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/your-org/your-agent-repo"}'

Returns JSON with risk score, findings by severity, and link to full HTML report.

What MASSAT Checks

API Reference

POST /audit - Run Security Audit

# Audit a GitHub repo (free, 10/day)
curl -X POST https://craigmbrown.com/api/audit \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/user/agent-repo"}'

# Audit with payment (unlimited, full scope)
curl -X POST https://craigmbrown.com/api/audit \
  -H "Content-Type: application/json" \
  -H "X-402-Payment: <ecash-token>" \
  -d '{"repo": "https://github.com/user/agent-repo"}'

Response:

{
  "audit_id": "audit-20260405-004858-f31d9003",
  "risk_score": 4.3,
  "risk_level": "medium",
  "critical": 0,
  "high": 0,
  "medium": 6,
  "low": 4,
  "report_url": "https://craigmbrown.com/audits/audit-20260405-004858-f31d9003.html",
  "get_passport": "https://craigmbrown.com/api/onboard?audit_id=audit-20260405-004858-f31d9003",
  "subscribe": "https://craigmbrown.com/api/subscribe"
}

POST /subscribe - Get Security Updates

curl -X POST https://craigmbrown.com/api/subscribe \
  -H "Content-Type: application/json" \
  -d '{"email": "you@company.com", "name": "Your Name", "company": "Acme AI"}'

GET /audit/{id} - Retrieve Full Report

curl https://craigmbrown.com/api/audit/audit-20260405-004858-f31d9003

GET /health - Service Status

curl https://craigmbrown.com/api/audit/health

Blog Posts

• Security Auditing a 94-Agent Fleet: Before & After MASSAT - How we went from 4.3 to 4.0 risk score across 30 hardened agents
• 93% of AI Agents Have Zero Security - Why agent identity and audit infrastructure matters now
• OWASP ASI01-10 for AI Agent Builders - Practical guide to each threat category with code examples

Real Audit Examples

See examples/ for sanitized production audit reports from 5 different fleet types:

• SFA Fleet (19 Single File Agents) - Score: 4.3
• Orchestrator Fleet (13 coordination agents) - Score: 4.3
• Communication Fleet (6 WhatsApp/notification agents) - Score: 4.3
• Marketplace Fleet (25 BlindOracle DeFi agents) - Score: 4.3
• MCP Server (Context Oracle tool server) - Score: 4.5

Connection to BlindOracle

MASSAT is the security layer for the BlindOracle agent marketplace:

• Every marketplace agent must pass a MASSAT audit before activation
• Audit results are embedded in ERC-8004 agent passports
• Continuous auditing available for marketplace operators ($99/mo)
• Delegation proofs (15 kinds) are verified against MASSAT findings

Agent Onboarding Flow:
  1. curl /api/audit     -> Get security score
  2. curl /api/onboard   -> Get ERC-8004 passport (includes audit results)
  3. curl /api/subscribe  -> Join mailing list for security updates
  4. Marketplace active   -> Agent listed on BlindOracle with verified badge

Repository Structure

massat-framework/
  README.md              # This file
  LICENSE                # MIT
  api/
    openapi.yaml         # OpenAPI spec for the audit API
  blog/
    security-auditing-94-agent-fleet.md
    93-percent-zero-security.md
    owasp-asi-guide.md
  examples/
    audit-reports/       # Sanitized production audit JSON
    curl/                # Ready-to-run curl examples
  docs/
    getting-started.md   # Quick start guide
    api-reference.md     # Full API docs
    threat-model.md      # OWASP ASI01-10 detailed threat model
  assets/
    massat-badge.svg     # Badge for GitHub READMEs

Links

• Live API: craigmbrown.com/api/audit
• BlindOracle Marketplace: craigmbrown.com/blindoracle
• Agent Passports: blindoracle-docs
• Whitepaper: Security Auditing a 94-Agent Fleet

License

MIT - See LICENSE for details.

Built by Craig Brown | Powered by BlindOracle