Most agent scanners read tool names and guess. Lucin reads the code
inside every tool and shows you the exact path from untrusted input to the
action that hurts you — with a witness, not a hunch.
0% adjudicated false positiveson 2,732 files ·
76% recall(38/50, 10 vuln classes) ·
20.5–31.5% precision(95% CI 12.9–42.9%) Every number regenerates with one command —
see the methodology ·
see what we miss →
lucin scan — one flagged pathcleanin model contextleaves the boundary
AG-TRIFECTA on a real fixture · regenerate with
python site/make_hero.py
Reproducible, not asserted
Most agent scanners cry wolf. Ours publishes the receipts.
0.0%
false positives
52 real repos · 2,732 files · 0 confirmed FP outside a documented allowlist
Run the commands yourself. We'd rather you reproduce the numbers than
trust our marketing. See the methodology →
One model, three uses
The path we flag before deploy is the path we block at runtime.
Every agent incident is the same shape — untrusted input reaching a
dangerous action through the tool graph. We model that shape once, then use it three ways.
No one else ships the open static scanner and the runtime gate on one coherent model.
SCAN Free · MIT
Reads the real code inside your tools — not just the tool names — and maps every
path from untrusted input to a dangerous action. SARIF out, drops into CI as a GitHub Action.
One command, no API key. For most people this is the whole product, and it's free forever.
GUARD Preview
The path SCAN flagged, enforced live: a deterministic gate blocks untrusted-controlled data
from reaching an external sink — no matter how the agent was talked into it. Behavioral
monitoring flags the machine-speed anomalies a human can't watch.
PROVE Experimental
Generates targeted payloads for your tools and reports attack-success vs. benign
utility — so a finding ships with proof it's real and proof it's fixed.
The flow, not the string
Every agent incident is the same object.
Untrusted input reaching a consequential action through your agent's tool graph.
We model that object once — the Agent Information-Flow Graph — and use it to scan statically
and block at runtime. We don't chase prompt-injection strings. We cut the flow.
Why now
July 2026: an AI agent took 17,000+ actions
inside Hugging Face. Nobody was watching the flow.
It wasn't a sophisticated exploit. It was an ordinary data flow — untrusted input, a tool that
executes, a tool that reaches credentials — running at machine speed with nothing watching.
Every agent you ship has the same shape. Hugging Face's own fix: stricter admission controls,
and the ability to page a responder in minutes.
