HungLeAI

AgentSpillCheck is an open-source guardrail scanner that tests AI agents before you trust them with your data. In under a minute it spins up a fake-but-believable world — files, emails, a fake web stage, a sink server — seeded with synthetic sensitive data (fake API keys, ID numbers, passwords), then connects your agent over MCP and watches what it actually does: does it print secrets in chat, mail them to the wrong person, follow hidden instructions on a web page? The result is a graded report (clean A/100 through leaky B/86 and worse) that answers four questions for a non-technical owner: what was read, was it sent, where to, and was it encrypted. No real data is ever touched. It ships as a Go CLI with an MCP server (Claude Desktop, Cursor, Claude Code), a local Docker deployment, and a deterministic spillcheck demo that deliberately leaks so anyone can see the scanner catch it in 60 seconds. Built for our world: end users who handed agents their email and passwords without any way to verify what happens next — and pushing the frontier of behavioural, evidence-based agent safety testing that anyone can run, not just security teams.