Agentic AI component security scanner. Detects AVE vulnerabilities in SKILL.md files, MCP servers, system prompts, and agent plugins. Produces OWASP AIVSS v0.8 scores.
Bawbel Scanner provides 12 tools with explicit schemas and descriptions. Most tools have clear verb-noun naming (scan, scan_cmd, init_cmd, pin_cmd, accept_cmd, creds_cmd, chain_cmd) and documented input parameters with types and enums. However, descriptions are inconsistent in depth, some are terse (version_cmd: empty input, minimal context), and several lack guidance on when to use them vs. similar tools. Output schemas are not documented in the source provided, forcing LLMs to infer result structure. Error handling and recovery guidance are absent. Parameter descriptions are present but often lack format constraints, ranges, or examples of valid values. The tool set is well-composed (each does one thing), but lacks idempotency hints and confirmation patterns for destructive operations (init_cmd, pin_cmd, accept_cmd all modify files).
Mark a finding as a false positive or accepted risk. Inserts justified suppression comments directly into source files.
Scan for unsafe agent delegation chains. Flags trust boundary violations: permission inheritance, unconstrained sub-agent spawning, and privilege escalation.
Check for rug pull drift by verifying file hashes against .bawbel-pins.json. Alias: cp
Scan for hardcoded credentials in agent components. Filters to credential-related AVE rules only (AVE-2026-00047).
Initialise Bawbel Scanner in a project. Generates .bawbelignore and bawbel.yml configuration files.
Hash skill files and generate .bawbel-pins.json for integrity verification and rug pull detection.
Generate full remediation guide for a scanned file with detailed fix instructions for each finding.
Output schemas not documented. LLMs cannot infer what fields ScanResult, ConformanceReport, or other responses contain, forcing them to guess downstream field names and risk broken tool chains.
Destructive operations (init_cmd, pin_cmd, accept_cmd) lack confirmation or dry-run patterns. Agents may accidentally overwrite .bawbelignore, .bawbel-pins.json, or source files without user approval.
accept_cmd has 10 parameters with complex interdependencies (do_list, expiring_soon, within, search_path) that are not documented as mutually exclusive or conditional. LLMs will struggle to compose valid calls.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2026-07-28+ | v2 |
Main entry point for scanning a file or directory for AVE vulnerabilities. Returns a ScanResult with findings.
CLI command to scan a file or directory for AVE vulnerabilities. Outputs results in text or JSON format.
Score an MCP server manifest against the MCP specification. Returns conformance report with grade A+-F and per-check results. Alias: conform
Fetch and scan an MCP server-card from a URL. Alias: ssc
Display version and engine status (YARA, Semgrep, LLM, Sandbox availability).
version_cmd has no description and empty input schema. LLMs cannot determine when to call it or what it returns. Minimal context for tool selection.
No error handling guidance. Tools do not document what errors are retryable, user-fixable, or fatal. LLMs receive raw errors with no recovery path.