QSAG-Core vs Socket

QSAG-Core is a Python security scanner specifically designed for the OWASP Top 10 for Agentic Applications 2026 threat model. It provides three core detection capabilities: MCP tool poisoning (26 malicious patterns across 7 categories), prompt injection (28+ attack patterns including goal hijacking, jailbreak attempts, and memory poisoning), and ghost agent detection for unauthorized API key usage. It runs as pure pattern matching — no ML, no cloud dependency — and can be integrated as a pre-execution guard in any Python-based agent pipeline. Released April 10, 2026 by the Neoxyber team, QSAG-Core fills a real operational gap as MCP-based agent deployments proliferate. While Microsoft's Agent Governance Toolkit addresses similar territory, it's heavyweight and enterprise-focused. QSAG-Core is a pip install and a few lines of code — the security-focused indie alternative that fits into a CI/CD pipeline or an existing agent framework without an enterprise contract. The threat model it addresses is timely. As MCP becomes the de facto standard for tool-calling in AI agents, malicious MCP servers and prompt injection via tool outputs are becoming documented attack vectors. Having a lightweight, open-source scanner that specifically targets these patterns is exactly what the community has been building toward. MIT licensed, 24 commits in its first day.

Socket detects supply chain attacks in npm, PyPI, and Go packages before they execute. Analyzes package behavior rather than just known vulnerabilities.