Crucible

What Crucible is

Crucible is a self-hosted security tool for stress-testing AI agents against attacks such as prompt injection, goal hijacking, and tool misuse before production. It evaluates tool calls, side effects, and outcomes rather than judging generated text alone. The site lists 11 modules and 153 attack vectors, covering eight of ten OWASP Agentic risks, with two in active development. Crucible says it runs 90 attack payloads in under 60 seconds and returns an A–F grade with severity, OWASP mapping, and reproduction steps. It supports LangChain, CrewAI, AutoGen, raw MCP endpoints, and agents with an HTTP or MCP interface. A GitHub Actions integration can fail a build when the security score falls below a configured threshold. The CLI installs with pip and supports Python 3.10 or later; the site says no Docker, cloud signup, or API key is needed to start. Local scanning requires no signup and has no telemetry by default. The core engine and test modules are Apache 2.0 licensed and free, with no security-test feature gating.