Finds hidden instructions, tool poisoning, secret theft, download-and-run commands and risky MCP settings - in your browser, the CLI or a GitHub Action.
AI agents now load skills, MCP servers and tools written by strangers.
Hexbane checks those files before your agent trusts them, shows what any hidden or disguised text really says, then guards what the agent does while it runs.
Paste or drop a SKILL.md, AGENTS.md, .cursorrules, mcp.json, tool list or a whole skill folder. Runs in your browser; files are never uploaded.
Finds zero-width and tag characters, bidi overrides, HTML-comment and base64 payloads, and unfolds look-alike Cyrillic/Greek letters, entities, s p a c e d words and split words - then shows the decoded text.
Flags 'ignore previous instructions', 'do not tell the user', fake <IMPORTANT> tags, shadowing of other tools and requests to pass secrets as parameters.
Unpinned npx/uvx packages, shell wrappers, plain-HTTP remotes, privileged Docker, inline API keys and broad filesystem roots.
`hexbane lock` pins every file and tool description; a later scan with --lock flags anything that changed after you approved it.
allow / ask / deny for each tool call (rm -rf /, reads of ~/.ssh, pipes to a shell) and quarantine for tool results that carry injected instructions.
From ScopeGuard: keeps a business assistant on its mission - allow, steer back, redirect, throttle off-topic use, block jailbreaks.
Every finding has a copy-paste fix and a ready 'reviewed' suppression line; `hexbane fix` strips invisible characters. A GitHub Action puts findings in code scanning (SARIF).
From the README’s “Quick start” section. Full options, requirements and troubleshooting are there too.
Open the README
$ git clone https://github.com/juw12/hexbane && cd hexbane
$ python -m hexbane scan path/to/skill-or-repo
$ python -m hexbane scan . --format sarif --out hexbane.sarif
$ python -m hexbane lock path/to/skillsStraight from the README, so you know what you're getting before you try it.
69 files in the repo · last updated 10 Nov 2026.
Browse the codeWeb, Python, GitHub Action. You can try it in the browser with nothing to install.
The commands in the “Quick start” box above come straight from the README. Paste them into a terminal; the README covers options and troubleshooting.
T h
A
Not yet: it's marked “live” and still changing. The README always has the current state.
The source is public on GitHub under the MIT licence.
Juwen Lie, an R&D mechanical engineer in Batam, Indonesia, as an independent personal project.
Check an AI agent skill or MCP server before you trust it