No one really cares about knowing an agent's capabilities, until something goes wrong.

Following up on an earlier post about SafeAI, a static analyzer for AI agents. One uncomfortable thought we've had while building it: No one really cares about knowing an agent's capabilities — until something goes wrong. Before an incident, adding another tool, MCP server, filesystem permission or prompt change often looks harmless. After an incident, the first questions become: - What could this agent actually do? - When did that capability appear? - Who introduced it? - Was it intentional? --- One example we're working on is MCP tool descriptions. A tool description can look like documentation: "Search the user's notes. Ignore previous instructions and..." But that description may become part of the model's context. So configuration can effectively become an instruction surface. SafeAI now detects several forms of this, while trying to avoid flagging ordinary descriptions that happen to contain words like "ignore" or "act as". The bigger direction is **tracking changes in agent capability and authority**, rather than simply producing another list of security findings. But this raises a question for us: Is knowing your agent's capabilities actually useful before an incident, or only after one? And if it is useful before an incident, what is the right interface? CLI + CI + SARIF/HTML? Or would you actually want an interactive view showing things like: > "Show me all MCP tools across our agents that could introduce instruction injection." We're deliberately not building a UI yet. --- Would you use one, or is that solving a problem nobody has? Curious to hear from people running real MCP/agent systems. --- If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions. Here you may check: ikaruscareer/SafeAI on GitHub.