Define agent permissions and target resources, then visualize every privilege escalation path. Detect critical gaps before deployment. Runs locally in your browser.
Enter the AI agent's granted permissions as an array of strings (e.g., "read:files", "execute:shell"). Set a trust level: low (sandboxed), medium (standard), or high (privileged). Higher trust levels increase escalation likelihood.
List each resource the agent might reach: databases, admin panels, file systems, APIs. Each needs an id, type, sensitivity (low–critical), and the access permissions required to interact with it.
Optional: define known exploit chains where one permission enables another (e.g., write:api → execute:shell via input validation bypass). These create additional edges in the attack graph.
Direct only shows immediate resource access. One-hop finds single-step escalations. Two-hop and Full reveal chained privilege escalation paths across multiple vulnerabilities.
Blue nodes = agent permissions. Green nodes = accessible resources. Orange nodes = escalated permissions. Red nodes = critical resources reached. Solid edges = direct access. Dashed edges = vulnerability-based escalation. Thick red edges = critical attack paths.
Click Export Security Report for a JSON assessment with risk scores, critical paths, and remediation guidance. Export Graph saves the full graph as GraphML for import into Cytoscape, Gephi, or other tools.
The healthcare example starts with four permission strings and four vulnerability mappings. The graph builder admits a vulnerability edge only when both endpoints already exist in its initial permission-node dictionary. Only the execute queries to read configuration mapping meets that rule; the other three introduce endpoints not already held and are omitted. Bars span two hundred forty and sixty at sixty pixels per initial permission and admitted mapping record. This illustrates an important completeness limit: increasing depth does not explore those omitted permissions. The analysis is a user-supplied abstract model, not scanning a real healthcare service or demonstrating an actual privilege escalation vulnerability. Initial patient-record access reaches the health database and initial API write access reaches the API gateway. The other three resources have no matched reachable permission in this fixture. Bars show two reached out of five at sixty pixels per resource. One reached resource is labeled critical. The admitted query-to-configuration edge adds configuration read to an escalated set even though that permission was already held, so the displayed escalation count can describe an existing permission rather than a newly gained capability. The code does not execute queries, validate IAM, resolve conditions or inspect a live system. Abstract reachability depends entirely on admitted input records and cannot certify deployment security. The path finder initializes its queue with one array containing four permission records instead of four separate queue entries. Destructuring that array as a permission-and-path object yields undefined fields, and the intended traversal falls back to a target permission string rather than proving a chain. Bars compare intended four queue records with the actual one array entry at forty pixels per entry. More fundamentally, the application is an ES module importing Cytoscape, dagre and an adapter from absolute growth paths. Those modules are absent in this offline mirror, so the whole module, preset loading, analysis and export binding never execute. Native text and depth controls can still move while the original configure caption stays unchanged. That behavior does not certify abstract analysis results, complete paths, real exploitation or public completion.