qsag-core
Open-source security scanner for AI agents — catches MCP poisoning and prompt injection
The Panel's Take
qsag-core is a fresh open-source Python toolkit from Neoxyber that addresses the OWASP Top 10 for Agentic Applications 2026 — specifically the two fastest-growing attack vectors: MCP tool poisoning and prompt injection in AI agents. The library uses pattern-based detection (not ML-based, to minimize false positives) to scan 26 MCP tool poisoning patterns across 7 categories and detect 28+ prompt injection patterns across 9 threat categories. It also catches ghost agent attempts, credential harvesting, and memory poisoning in real time. The toolkit is available on PyPI, ships with cryptographic attestations, and is licensed under Apache 2.0. It was created in early April 2026, making it genuinely new-to-the-scene. The timing is significant: a recent Dark Reading poll found 48% of cybersecurity professionals now identify agentic AI as the #1 attack vector, up from a niche concern in 2025. Microsoft released a similar (but much larger-scope) Agent Governance Toolkit in early April, which validates the problem space but leaves room for nimble open-source tooling. qsag-core is early-stage — zero stars on GitHub as of today, minimal community traction, and no documented production deployments. But it addresses a problem that's going to become critical as MCP adoption accelerates. First-mover advantage in a niche that's about to explode.
Share this verdict
qsag-core verdict: SKIP ⏭️ 2 ships · 2 skips from the expert panel Full review: shiporskip.io/tool/qsag-core-neoxyber-mcp-agent-security-prompt-injection-tool-poisoning-2026
Weekly AI Tool Verdicts
Get the next verdict in your inbox
7 critics review a new AI tool every day. Weekly digest — free.
Compare qsag-core with Others
Embed this verdict
Tool makers can add a live ShipOrSkip badge to their site. Badge loads track impressions; clicks route back to this review.
<a href="https://shiporskip.io/api/badge-click/qsag-core-neoxyber-mcp-agent-security-prompt-injection-tool-poisoning-2026" target="_blank" rel="noopener"><img src="https://shiporskip.io/api/badge/qsag-core-neoxyber-mcp-agent-security-prompt-injection-tool-poisoning-2026" alt="qsag-core Skip verdict on ShipOrSkip" width="360" height="90" /></a>[](https://shiporskip.io/api/badge-click/qsag-core-neoxyber-mcp-agent-security-prompt-injection-tool-poisoning-2026)<iframe src="https://shiporskip.io/embed/qsag-core-neoxyber-mcp-agent-security-prompt-injection-tool-poisoning-2026" title="qsag-core ShipOrSkip verdict" width="360" height="260" style="border:0;border-radius:16px;max-width:100%;" loading="lazy"></iframe>The reviews
“I've been looking for exactly this since MCP started proliferating. Pattern-based detection over ML is the right call for security tooling — I can audit what it's flagging and why. Dropping this into my agent pipeline CI was a 30-minute job. The MCP tool poisoning scanner alone is worth it.”
“Zero stars, no known production deployments, no security audit of the security tool itself — that's an uncomfortable situation. Pattern-based detection will generate false positives as MCP tool definitions grow more complex, and attackers who know about this scanner can trivially evade it. Treat as research, not production security.”
“MCP security is going to matter enormously as AI agents gain real-world tool access. The OWASP Top 10 for Agentic Applications is brand new and most teams haven't even read it. Getting familiar with these attack patterns now, before an incident forces the conversation, is table-stakes security hygiene.”
“Unless you're running AI agents in production that use MCP tools, this is highly specialized developer/security tooling. Relevant context for understanding AI agent risks, but not something most creatives will interact with directly.”