From your editor
Run, re-run and schedule scans from Claude Code, Cursor or Codex through the Lustena MCP server.
MCP server docsScan Hub
Scan Hub
Every red-team check the Lustena scanner runs against your own agents: what it tries, what it finds, and which OWASP LLM risk it covers. Each failed check becomes a finding on the agent it was run against.
Ten agent-native checks
The catalog, by suite
Checks are grouped into suites. A scan runs a suite, a few checks, or all of them.
Suite
core
The first scan every agent gets.
- prompt-injectionDirect jailbreaks that try to override the agent's instructions.medium – critical
- system-prompt-leakAttempts to make the agent reveal its system prompt or tool schemas.medium – high
Suite
surfaces
Everything the agent reads that is not the user.
- tool-output-injectionInstructions hidden in what a tool returns to the agent.high – critical
- indirect-injection-documentInstructions hidden in a document the agent is asked to read.medium – critical
- encoding-obfuscationAttacks disguised in encodings the model still understands.medium – high
- mcp-supply-chainUnsigned installs, tool poisoning, rug pulls and credential forwarding through MCP.high – critical
- sensitive-info-disclosurePersonal data or secrets leaking in the agent's answers.medium – critical
Suite
topology
What the agent does with the authority it has.
- handoff-escalationGaining privileges by handing off to another agent.high – critical
- autonomy-scope-mismatchActing beyond the autonomy ceiling declared in its limit.high – critical
- multi-turn-escalationSmall steps over a conversation that add up to a violation.high – critical
Plus, on every scan
endpoint-hygiene
TLS posture and HTTP security headers, from one handshake and one request. It reports the clean case and an unreachable endpoint as information, never as a pass.
Coverage
OWASP Top 10 for LLM applications
Mirrors the mapping each check declares in the scanner's code.
| LLM01 Prompt Injection | Covered | prompt-injection, tool-output-injection, indirect-injection-document, encoding-obfuscation, multi-turn-escalation |
| LLM02 Sensitive Information Disclosure | Covered | sensitive-info-disclosure |
| LLM03 Supply Chain | Partial | mcp-supply-chain |
| LLM05 Improper Output Handling | Partial | tool-output-injection |
| LLM06 Excessive Agency | Covered | handoff-escalation, autonomy-scope-mismatch |
| LLM07 System Prompt Leakage | Covered | system-prompt-leak |
| LLM10 Unbounded Consumption | Planned | consumption probe on the roadmap |
| LLM04, LLM08, LLM09 | Out of scope | need training data or vector stores, invisible to a runtime scan |
How a scan works
From endpoint to finding
01
Authorize
Point the scanner at an agent endpoint you own or are authorized in writing to test.
02
Bind
Every scan is bound to the agent in the inventory, so the report lands on its owner.
03
Run
Pick a suite or single checks. The scanner rate-limits itself so it never becomes the incident.
04
Repeat
Schedule re-runs. Findings reopen when they come back and close when they are fixed.
From the platform
Queue scans per agent, review the report and decide on each finding with its owner.
Talk to us