Agent Readiness Audit

Static analysis of your agent’s blueprint — identify risks before running any tests.

Why It Matters

The Agent Readiness Audit is a static analysis engine that examines your agent’s blueprint and architecture graph across 16 checks to identify security risks, reliability gaps, and design issues before any tests are run.

Running tests takes time. The audit gives you immediate, actionable feedback the moment you upload a blueprint. It catches structural problems — missing guardrails, exposed secrets, unconstrained permissions — that would otherwise surface as test failures or, worse, production incidents. Think of it as a linter for your agent’s architecture.

Agent Readiness Score (ARS)

The audit produces a single 0-100 score called the Agent Readiness Score (ARS). Unlike AQS, which requires test results, ARS is computed entirely from static analysis of your blueprint and (optionally) your Agent Intelligence Graph.

Score Ranges

How the Score Is Calculated

The ARS starts at 100 and deducts points based on findings across four categories. Each category has a point budget that caps how much it can deduct — so a single category cannot tank the entire score.

Severity penalties:

Category budgets:

Formula per category:

G = sum of global finding penalties
T = sum of per-tool finding penalties
adjusted = G + (T / num_tools)
deduction = min(budget, adjusted)

Per-tool findings are divided by the number of tools because a per-tool issue on 1 out of 20 tools is less severe than the same issue on 1 out of 2 tools.

Overall score:

ARS = 100 - sum(deductions across all categories)

The 16 Checks

The audit runs 11 blueprint-based checks and 5 graph-based checks. Blueprint checks analyze the static structure of your agent definition. Graph-based checks (marked with *) require Agent Intelligence Graph data and examine the relationships between nodes.

Security (50-point budget)

Reliability (25-point budget)

System Design (15-point budget)

Tool Quality (10-point budget)

How to Run the Audit

"Run an audit on my customer-support-agent."

"Show me the audit results for my travel-booking-agent."

"Validate this blueprint before uploading."

Understanding Findings

Each finding contains four pieces of information:

Global vs. Per-Tool Findings

Findings have one of two scopes:

• Global — Applies to the blueprint as a whole (e.g., “No system prompt defined”). Penalty is applied at full value.
• Per-tool — Applies to a specific tool (e.g., “Tool ‘send_email’ has no error handling”). Penalty is divided by the number of tools, so a single tool issue on a 20-tool agent has less impact than the same issue on a 2-tool agent.

Fixing Findings

Address findings in severity order — critical first, then high, medium, low. Each critical finding costs 8 points, so resolving one critical finding has the same score impact as resolving four high-severity findings or eight low-severity findings.

Common fixes by check:

Limitations

• Graph-based checks require graph data. Five of the 16 checks (unguarded_paths, unreachable_tools, circular_dependencies, unguarded_external_access, missing_error_recovery) only run when Agent Intelligence Graph data is available. Without graph data, these checks are skipped and the audit covers 11 checks.
• Audit reflects declared architecture. The audit analyzes what your blueprint declares, not what your agent actually does at runtime. If your blueprint says a tool has requires_confirmation: true but the implementation does not enforce it, the audit will not catch that gap. Use AQS (test-based scoring) to validate runtime behavior.
• Category budgets cap deductions. A category can never deduct more than its budget. If your Security category has 60 points of findings, the deduction is capped at 50. This means the ARS floor for a single-category disaster is 50, not 0.

FAQ

What is the difference between ARS and AQS?

ARS (Agent Readiness Score) is static analysis — it examines your blueprint and architecture without running any tests. AQS (Agent Quality Score) is test-based — it measures behavioral reliability from actual test results. ARS tells you if your agent is designed safely; AQS tells you if it behaves correctly. Use both: ARS for immediate feedback on architecture, AQS for validated confidence from test runs.

How do I fix critical findings?

Each finding includes a specific recommendation. For example, a secret_exposure finding recommends removing credentials and using environment variables. A tool_permissions finding recommends adding requires_confirmation: true for mutating operations. Address critical findings first, as they carry an 8-point penalty each — fixing a single critical finding recovers more score than fixing four medium-severity findings combined.

Why are category budgets not equal?

The budgets reflect relative production risk. Security vulnerabilities (exposed credentials, unguarded mutations) can cause immediate, severe damage — data breaches, unauthorized transactions, compliance violations. Reliability issues are serious but typically recoverable. System design and tool quality affect agent behavior quality but rarely cause catastrophic failures. The 50/25/15/10 split encodes this risk hierarchy.

What if I only have blueprint data, no graph?

Eleven of the 16 checks run on blueprint data alone. You get a valid ARS score, but it may be higher than the true score because graph-based checks (which catch issues like unguarded paths to payment tools) are skipped. Upload your Agent Intelligence Graph data when available for the most complete audit.