Scoring formula
How the Agent Security Score (0-100) is computed. Public, versioned, reproducible from a report.
Plain Markdown for agents: /docs/scoring.md
The Agent Security Score runs from 0 to 100. It is weighted by severity. The same findings always give the same score. A report carries scannerVersion and rulesHash, so anyone can reproduce a score.
Formula version: 1.
Steps
- Start at 100.
- Subtract a penalty for each finding, by severity:
| Severity | Penalty per finding |
|---|---|
| critical | 40 |
| high | 15 |
| medium | 5 |
| low | 1 |
| info | 0 |
- If any finding is critical, cap the score at 40.
- Clamp the result to 0–100.
score = clamp(100 - sum(penalty[f.severity] for f in findings), 0, 100)
if any(f.severity == "critical"): score = min(score, 40)
What counts as critical
- A gateway exposed with auth off.
- A known-malicious skill installed.
- A live leaked key.
Rules
- One critical finding caps the score at 40, however clean the rest is.
- An attestation needs a score of 70 or more and no critical findings.
- Every finding maps to a control in OWASP Agentic (ASI01–ASI10) and the OWASP MCP Top 10 (MCP01–MCP10).
- A change to this formula bumps the formula version. Old reports keep their original score.
The eight checks
| Check | Example finding | Controls |
|---|---|---|
| Network exposure | Gateway bound to 0.0.0.0, auth off | ASI03, MCP07 |
| Version and CVEs | Runtime older than the CVE-2026-25253 fix | LLM03, MCP04 |
| Secrets at rest | Plaintext sk-ant- key in a config | ASI03, MCP01 |
| Installed skills and MCP servers | Component with a malicious verdict | ASI04, MCP03, MCP04 |
| Tool and permission scope | Shell plus network plus file-write, no approval | ASI02, MCP02 |
| Egress | No egress allowlist | ASI01, MCP10 |
| Identity and audit | No stable identity, tool calls not logged | ASI07, MCP08 |
| Memory and context | Untrusted content in long-term memory | ASI06 |