What is AgentScan used for?

AgentScan is a local, offline scanner that checks AI agent skills for shell commands, network calls, secrets and licensing before you install them, plus a catalog of reviewed skills. It is a good fit for vetting a downloaded Claude skill, checking skill licences before use and distributing reviewed workflows to a team.

Yes. AgentScan has a free plan.

Is AgentScan open source?

No. AgentScan is proprietary (closed-source) software. In the Security category, open-source options include Syft, Grype and Horusec.

Can I self-host AgentScan?

Yes. Although AgentScan is closed source, it can be self-hosted on your own servers, and the vendor also offers a hosted version.

What are some alternatives to AgentScan?

AgentScan competes with Socket and Snyk.

AgentScan: features, pricing and alternatives

About AgentScan

AgentScan is a security scanner for the skills that AI coding agents load, such as those used by Claude Code. Skills run with your permissions, so it reads a skill directory before installation and reports what it would do, including shell commands, network calls, secrets and the licence, with the exact line responsible for each finding.

The scan is deterministic and never executes or uploads the skill. It is installed as a command-line tool with pipx and offers commands to scan a folder, search a catalog of reviewed skills, install a bundle called Trust Pack and update installed items. It detects the agent runtime automatically and supports Claude Code, OpenAI Codex, OpenCode, Hermes and Grok Build. A web page also lets you paste a skill to scan it. The site describes the project as open source, though it is listed here as a proprietary product and no licence is stated. It also has a pricing page for paid offerings.

Key features

Scans skills before installation
Flags shell commands, network calls and secrets
Reports the exact line for each finding
Works offline with no execution of the skill
Searchable catalog of reviewed skills
Auto-detects Claude, Codex, OpenCode, Hermes and Grok

Good fit for

→Vetting a downloaded Claude skill
→Checking skill licences before use
→Distributing reviewed workflows to a team

Tags: security; ai-agents; skill-scanner; claude-code; cli; offline; supply-chain

AgentScan: questions and answers

What is AgentScan used for?: AgentScan is a local, offline scanner that checks AI agent skills for shell commands, network calls, secrets and licensing before you install them, plus a catalog of reviewed skills. It is a good fit for vetting a downloaded Claude skill, checking skill licences before use and distributing reviewed workflows to a team.
Is AgentScan free?: Yes. AgentScan has a free plan.
Is AgentScan open source?: No. AgentScan is proprietary (closed-source) software. In the Security category, open-source options include Syft, Grype and Horusec.
Can I self-host AgentScan?: Yes. Although AgentScan is closed source, it can be self-hosted on your own servers, and the vendor also offers a hosted version.
What are some alternatives to AgentScan?: AgentScan competes with Socket and Snyk.