
AgentScan
AgentScan is a cloud service that provides automated security testing for LLMs, retrieval-augmented generation pipelines, and autonomous agents through an API.
What AgentScan is
AgentScan is a cloud service that provides automated security testing for LLMs, retrieval-augmented generation pipelines, and autonomous agents through an API. It tests attack patterns including prompt injection, data exfiltration, jailbreaks, and MCP attacks. Scan results include a 0–100 risk score, severity breakdown, remediation advice, and evidence that can be exported as JSON or PDF. Its web dashboard detects agent formats, displays scan progress and errors, supports live throttle adjustment, and offers PDF downloads. The REST API queues scans asynchronously, returns a scan ID, and supports completion webhooks. AgentScan maps vulnerabilities to OWASP LLM Top 10 risks and describes mappings to EU AI Act articles and NIST AI RMF functions. Its compliance documentation says it does not test LLM04 Model Denial of Service or LLM10 Model Theft in its OWASP mapping. Its terms require customers to scan only agents they own or have explicit written authorization to test.
Good
- Scan results include risk scores and remediation advice
- Exports results as JSON or PDF
- API supports completion webhooks
- Dashboard provides real-time scan progress and error tracking
Watch out
- Free plan allows five scans per month
- Free plan covers 185 attack vectors
- Two OWASP-mapped risks are not tested
- Scans require ownership or written authorization
Who it suits
AgentScan suits teams seeking automated security scans for LLMs, RAG pipelines, or autonomous agents. It is intended for users authorized to test the agents they scan.
Verdict
AgentScan provides API-based security scans with evidence, risk scoring, and remediation guidance. Check its coverage limits and ensure you have authorization before scanning an agent.
Plans and prices
From AgentScan's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | 5 scans per month · 185 attack vectors · 5 categories · auto-detect agent format · JSON results · $0/month |
| Starter | $29 a month | 30 scans per month · 300 attack vectors · 12 categories · PDF reports · full test audit trail · 3 concurrent scans · $29/month |
| Pro | $99 a month | 100 scans per month · 348 attack vectors · 14 categories · custom secrets monitoring · configurable throttling · PDF reports + webhooks · priority support · $99/month |
| Enterprise | Priced on request | Unlimited scans · all 412 attack vectors · all 19 categories · MCP, State Injection, PII · SLA + priority support · Custom |
The facts
Each one read from AgentScan's own pages, with the date it was checked.
What it does
- Agent support
- The documentation lists 12 agent types, including generic HTTP, OpenAI-compatible, Dify, Flowise, n8n, OpenClaw, AutoGPT, OpenHands, Anthropic-compatible, LangChain, and Manus.checked 3 Oct 2026
- Authorized use
- The terms say customers may scan only agents they own or have explicit written authorization to test.checked 3 Oct 2026
- Automation
- The REST API queues scans asynchronously, returns a scan ID, and supports completion webhooks.checked 3 Oct 2026
- Coverage
- The product says it tests 412 attack vectors across 19 categories, including prompt injection, data exfiltration, jailbreak, and MCP attacks.checked 3 Oct 2026
- Coverage limits
- The compliance documentation says LLM04 Model Denial of Service and LLM10 Model Theft are not tested in its OWASP mapping.checked 3 Oct 2026
- Dashboard
- The web dashboard supports agent-format auto-detection, real-time scan progress and error tracking, live throttle adjustment, and PDF downloads.checked 3 Oct 2026
- Data handling
- The privacy policy says scan results remain in the account until deleted and account data is permanently removed within 30 days after account deletion.checked 3 Oct 2026
- Hosting
- The privacy policy says user data is stored on Hetzner servers in Germany (EU).checked 3 Oct 2026
- Integrations
- Documented connection examples include OpenAI, Groq, LiteLLM, Dify, n8n, Flowise, OpenClaw, AutoGPT, and OpenHands.checked 3 Oct 2026
- Purpose
- AgentScan provides automated pentesting for LLMs, RAG pipelines, and autonomous agents through an API.checked 3 Oct 2026
- Reports
- Scan results include a 0–100 risk score, severity breakdown, remediation advice, and JSON or PDF export with evidence.checked 3 Oct 2026
- Security
- The privacy policy says passwords are hashed with Argon2id, API keys are stored as HMAC-SHA256 hashes, connections use TLS, and outbound requests have SSRF protection.checked 3 Oct 2026
- Support
- The Pro plan lists priority support, while Enterprise lists dedicated support, an SLA, and priority support.checked 3 Oct 2026
Where it runs
- Framework mapping
- AgentScan maps vulnerabilities to OWASP LLM Top 10 risks and describes mappings to EU AI Act articles and NIST AI RMF functions.checked 3 Oct 2026
Alternatives to AgentScan
- 1
OpenSecureAI Scanner
Free planOpen sourceWebAPILinuxmacOS8.1From $49 a month - 2

PromptGuard
Free planWebAPIExtensionLinux7.9From $19 a month - 3

Promptfoo
Free planOpen sourceWebAPILinuxmacOS7.8Free plan - 4

Giskard
Free planOpen sourceWebAPILinuxSelf-hosted7.6Free plan - 5

AIRTA Red Team
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6
CyberSecEval
Free planOpen sourceWebAPILinuxmacOS7.5Free plan
