Security tools for AI agents, LLMs, MCP servers, cloud and CI pipelines
Practical checks for security, cloud and AI-platform engineers, from the team that assesses agent deployments for a living. Everything runs on your machine: nothing is uploaded, no account, no tracking.
The tools
MCP config auditor
Checks Claude, Cursor, VS Code, Windsurf and Gemini CLI configs before you roll them out.
- Plaintext secrets, masked in every output
- Unpinned npx / uvx / Docker servers
- Shell servers, root filesystem access, allow-all
- Untrusted-input + outbound tool mixes
Agent permission matrix
Map an agent's tools against the roles it acts for, and see where it can do more than the user behind it. Export as PNG.
Everyday utilities
JWT decoder with weakness checks, CVSS 4.0 calculator, certificate / CSR decoder, CIDR calculator with cloud reserved IPs, cron and IAM explainers.
Why you can trust it
Nothing leaves the page
Every tool page ships a Content Security Policy with connect-src 'none'. The browser itself blocks any network request, and CI fails the build if a page loses it.
Every rule is public
Rules are YAML files on GitHub with a passing and a failing fixture each. Read why a rule fires, report a false positive, or suggest a new one.
Built by assessors
Qlucent runs AI and agent security assessments. These tools are the checks we'd want on day one of an engagement, given away.
Latest releases
20 rules covering plaintext secrets, unpinned servers, shell execution, broad filesystem roots, plain-HTTP remotes and allow-all permissions.
Running agents in production?
Qlucent assesses agent permissions, data boundaries and the tools your agents can reach.
Talk to Qlucent →