Scored against Microsoft's published guidance · AgentAz™ companion

Compliance Scanner

Generated your agent with ChatGPT, Claude, or Cursor? Wrote it by hand? Either way — paste its system prompt or its agentaz.json and see whether it's actually production-safe. Scanned against Microsoft's published agent-governance guidance, with the AgentAz™ companion mapping that shows how each control is met at the prompt layer. Pass/fail gates, failure scenarios, a risk radar, and a copy-paste fix block. Deterministic — same input, same result — and your prompt is processed to produce the score, then discarded: never stored, never sent to a model.

System prompt or agentaz.json

Scored against Microsoft's published agent-governance guidance, with the AgentAz™ companion mapping. Deterministic — same input, same result. Your prompt is processed on our edge to produce the result and is never stored, logged, or sent to any model.

Disclaimer

The AgentKits Compliance Scanner is a free, informational tool that performs automated heuristic screening of AI-agent system prompts for common governance gaps. It is not a security audit, penetration test, legal or regulatory compliance certification, or a substitute for qualified human review. Results are provided “as is”, without warranties of any kind, express or implied, and must not be relied upon as the sole basis for deploying, approving, or assessing any AI agent. Heuristic analysis can produce false positives and false negatives and may miss contextual nuance; a system-prompt scan assesses only the design layer and cannot evaluate platform-, runtime-, or infrastructure-level controls. Always consult qualified security, privacy, and legal professionals before deploying AI agents in regulated or high-risk contexts. To the maximum extent permitted by law, AgentKits and its authors disclaim all liability for any loss or damage arising from use of this tool.

Trademarks & affiliation. AgentKits is not affiliated with, endorsed by, sponsored by, or certified by Microsoft (or OWASP, NIST, or any other organization). “Microsoft” and related names and marks are trademarks of Microsoft Corporation; other product and company names are trademarks of their respective owners. This tool references publicly published governance guidance for informational and educational purposes only, and such references do not imply any relationship with or approval by the trademark owners. “AgentAz” is a trademark of AgentKits.

What it scores against

The scanner maps your agent to the design-layer controls in Microsoft's published guidance for AI agents — the Cloud Adoption Framework's governance and security recommendations, the Responsible AI principles, and the agentic maturity model. Each Microsoft control is shown with its AgentAz™ companion: the spec field that satisfies it at the prompt layer.

What it can't see (on purpose)

A system-prompt scan only assesses the design layer. Microsoft's platform-enforced controls — Entra ID identity, Purview data-loss prevention, runtime threat detection — are marked platform, out of scope rather than guessed at. This complements those controls; it doesn't replace them.

Why deterministic, not an LLM

A governance check you can't reproduce isn't a check. The default scan uses fixed rules and the same risky-tool vocabulary the runnable run.py demos enforce, so the same input always produces the same verdict. It never auto-executes or contacts a model.