English Français العربية

Agent Blast Radius

Official registry Security

Scan what an AI agent running as you can reach; optionally verify which keys are live (x402).

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package @kloudle/agent-blast-radius
Claude Code 
claude mcp add agent-blast-radius -- npx -y @kloudle/agent-blast-radius@0.3.1 mcp
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "agent-blast-radius": {
            "command": "npx",
            "args": [
                "-y",
                "@kloudle/agent-blast-radius@0.3.1",
                "mcp"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Agent Blast Radius
  2. Install it where your agent runs
  3. The scan
  4. Which ones are live? blast verify
  5. License

Agent Blast Radius

What could an agent running as you reach? blast scans the places a coding agent running as you can read — cloud profiles, dotfiles, project .env files, CI configs, MCP servers — and tells you what is exposed, scores it, and draws a card you can share. Offline, read-only, never prints a secret value. Optionally, blast verify checks which of those credentials are actually live, paid per check with your own wallet.

npx -y @kloudle/agent-blast-radius@0.3.1          # scan + share card (free, offline)
npx -y @kloudle/agent-blast-radius@0.3.1 verify   # which keys work? (paid, optional)

More at abr.kloudle.dev · step-by-step guides for every agent: abr.kloudle.dev/install · agent payments: abr.kloudle.dev/agent-payments

Install it where your agent runs

WhereHow
Any terminalnpx -y @kloudle/agent-blast-radius@0.3.1 · brew install makash/tap/blast · `curl -fsSL https://abr.kloudle.dev/install.sh \sh`
Claude Code/plugin marketplace add makash/agent-blast-radius then /plugin install agent-blast-radius@kloudle
Codex (CLI and app)codex plugin marketplace add makash/agent-blast-radius then codex plugin add agent-blast-radius@kloudle
Claude DesktopDownload agent-blast-radius-0.3.1.mcpb and open it
CursorAdd to Cursor · guide
VS CodeInstall in VS Code · guide
Devin Desktop (Windsurf), Cline, Zed, any MCP client{"mcpServers":{"blast":{"command":"npx","args":["-y","@kloudle/agent-blast-radius@0.3.1","mcp"]}}}
Agent Skillsnpx skills add makash/agent-blast-radius
Rules filesCursor · Devin Desktop / Windsurf · Cline

Release binaries and SHA256SUMS are on Releases: macOS and Linux, ARM64 and AMD64. They are not code-signed or notarized; verify the checksum. The npm launcher and install.sh verify it for you. Node.js 22+ for npx.

The scan

  • Reports credential types, locations, SHA-256 fingerprints, local scope hints and configured MCP reachability. Never values.
  • Makes no network calls, executes no MCP servers, uploads nothing, no telemetry.
  • Writes a 1080 × 1350 PNG card and share text by default (--anonymous drops your username, --no-card skips files). Existing files are never overwritten.
  • Scores are exposure estimates, not proof that a credential works or was compromised.

As an MCP server (blast mcp) it offers blast_radius, explain_credential and blast_card (read-only, offline) plus the verify tools below.

Which ones are live? blast verify

The scan can't tell a dead key from a live one. blast verify:

  1. counts eligible findings (AWS profiles; OPENAI_API_KEY / ANTHROPIC_API_KEY in the environment) and creates a claim at abr.kloudle.dev with class counts only, e.g. aws-sts-identity:2;
  2. prints the price — $0.10 USDC per check on Algorand — a code, and two ways to pay with your own wallet: your agent's x402 wallet tool (e.g. GoPlausible's algorand-mcp), or a browser link where you approve in Pera, Defly or Lute;
  3. once paid, fetches an Ed25519-signed manifest, runs the checks on your machine (aws sts get-caller-identity, provider model-list probes) with a minimal environment, and reports each finding as live, rejected or error.
blast verify --open            # open the pay page and wait
blast verify --claim <id>      # collect later (claims survive restarts for 30 days)
blast verify --list            # unfinished claims on this machine

MCP: blast_verify_quote → pay → blast_collect. Payments are final. Need a wallet? abr.kloudle.dev/wallet.

Never sent: credential values, profile names, environment variable names, file paths, scan output. See abr.kloudle.dev/privacy.

License

Proprietary — see LICENSE.txt. Free to use for checks on machines and accounts you own or are authorized to assess. Third-party notices: THIRD_PARTY_NOTICES.txt. Scanner source is private; this repository distributes binaries, the npm launcher's metadata, plugins, skills and rules.

Frequently asked questions

What is Agent Blast Radius?

Scan what an AI agent running as you can reach; optionally verify which keys are live (x402).

How do I install Agent Blast Radius?

It runs on your machine. In Claude Code: claude mcp add agent-blast-radius -- npx -y @kloudle/agent-blast-radius@0.3.1 mcp. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Agent Blast Radius need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Agent Blast Radius open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains Agent Blast Radius?

It is published by makash. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.