tools⌄

Agent Threat MapperMap access to OWASP and ATLAS Trace LabPlan runs and investigate evidence CyberChefDecode and inspect data locally

personal API about

theme:modern

C:\SEAN> choose theme

Modern appearance Daylight uses Modern. Retro themes keep their original colors.

a tool for thinking through agent security

Agent Threat Mapper.

Start with a familiar workflow. See where its authority could go wrong.

Trace Lab →

◇ Design review · local only

01 / choose a starting point

Which agent are you mapping?

Choose the deployment you use. These are editable examples, not vendor defaults or a product ranking.

02 / choose the job

What will it do?

The same agent can have very different exposure from one job to the next.

03 / make this your deployment

What can it read, use and reach?

Click a part of the map to change it. Don’t enter real secrets or personal data.

Name this map

→→

I reviewed these example settings against the deployment I want to model.

possible paths / not observed attacks

Start with these paths

Ranked by a transparent screening heuristic, not measured likelihood.

OWASP Agentic Top 10 2026

Risk categories. Select one to see why it applies to this map.

Official framework ↗

MITRE ATLAS 2026.09

Tactics describe the objective. Techniques describe the method. Highlighted techniques are potential matches to your declared access.

Official ATLAS ↗

● Potential match○ Not triggeredReviewed subset: 10 techniques, not the complete ATLAS matrix. No TTP was detected.

What changes with less access?

A separate hypothetical configuration. Your real map and control evidence stay unchanged.

Remove outbound capabilitiesBrowser/network, messaging and MCP connectionsRemove privileged identityAlso remove the readable-credentials assumptionRemove shell and generated codeNo command execution declaredRemove persistent memoryNo writable memory declared

No agent runs here. Mappings suggest what to review, not what happened.

Framework match

Edit access

Choose the channels this deployment reads.

User promptsWeb contentEmail and messagesFiles and documentsRetrieved knowledgeImages, audio and videoOther agents

Select actual capabilities. A connection to MCP does not automatically mean shell access.

Persistent memoryFile accessBrowser and networkShell executionGenerated codeDatabase accessOutbound messagingMCP toolsTransactionsPhysical control

PurposeAssets (comma separated)

DeploymentIdentityAutonomyOversightData sensitivity

Credentials are readable from files or the environment

Controls need implemented status and a reference to receive heuristic credit. Neither the reference nor effectiveness is verified by this app.

Control

StatusConfiguration or test reference

Map files

Saves are unencrypted on this device. No automatic saving or uploads. JSON uses Trace Lab’s project format; existing plans are preserved when imported.

Import project JSON

What the map can tell you

Choose an example workflow and confirm its real access.
Explore design-review hypotheses and the selections that triggered them.
Follow the named OWASP risks and ATLAS techniques, then validate the controls.

This is a deterministic, local tool. It does not scan your agent, detect attacks, verify controls, or certify compliance. Vendor presets do not credit security features automatically.

ATLAS techniques and tactic relationships are pinned to the official 2026.09 dataset. OWASP names follow the Agentic Top 10 2026. Mappings are site-authored and not one-to-one equivalences. A category without a match is not a claim of safety.

ATLAS source data · OWASP publication

Sean McQuillingCybersecurity, AI agents, and local tools.Built with AI assistance. Direction, review, and responsibility are mine. Details

email github rss start here workshop evidence daemon colophon CyberChef ~/

~/Search this site

↑↓ move enter run help commands ⌘K toggle