# Scoring formula

How the Agent Security Score (0-100) is computed. Public, versioned, reproducible from a report.

The Agent Security Score runs from 0 to 100. It is weighted by severity. The same findings always give the same score. A report carries `scannerVersion` and `rulesHash`, so anyone can reproduce a score.

Formula version: `1`.

## Steps

1. Start at 100.
2. Subtract a penalty for each finding, by severity:

| Severity | Penalty per finding |
| -------- | ------------------- |
| critical | 40                  |
| high     | 15                  |
| medium   | 5                   |
| low      | 1                   |
| info     | 0                   |

3. If any finding is critical, cap the score at 40.
4. Clamp the result to 0–100.

```text
score = clamp(100 - sum(penalty[f.severity] for f in findings), 0, 100)
if any(f.severity == "critical"): score = min(score, 40)
```

## What counts as critical

- A gateway exposed with auth off.
- A known-malicious skill installed.
- A live leaked key.

## Rules

- One critical finding caps the score at 40, however clean the rest is.
- An attestation needs a score of 70 or more and no critical findings.
- Every finding maps to a control in OWASP Agentic (ASI01–ASI10) and the OWASP MCP Top 10 (MCP01–MCP10).
- A change to this formula bumps the formula version. Old reports keep their original score.

## The eight checks

| Check                            | Example finding                                 | Controls            |
| -------------------------------- | ----------------------------------------------- | ------------------- |
| Network exposure                 | Gateway bound to `0.0.0.0`, auth off            | ASI03, MCP07        |
| Version and CVEs                 | Runtime older than the CVE-2026-25253 fix       | LLM03, MCP04        |
| Secrets at rest                  | Plaintext `sk-ant-` key in a config             | ASI03, MCP01        |
| Installed skills and MCP servers | Component with a `malicious` verdict            | ASI04, MCP03, MCP04 |
| Tool and permission scope        | Shell plus network plus file-write, no approval | ASI02, MCP02        |
| Egress                           | No egress allowlist                             | ASI01, MCP10        |
| Identity and audit               | No stable identity, tool calls not logged       | ASI07, MCP08        |
| Memory and context               | Untrusted content in long-term memory           | ASI06               |