Augustus: LLM Vulnerability Scanner

Augustus tests AI systems for security vulnerabilities. It works with Julius, Guard's LLM fingerprinting tool, to provide coordinated AI security coverage: Julius identifies which AI services are running, and Augustus tests those systems for exploitable weaknesses. Results appear inline in the Guard platform alongside Julius fingerprinting data.

What Augustus tests

Augustus runs 243 probes and 132 detectors covering:

• Jailbreak attempts
• Prompt injection
• Training data extraction
• Encoding evasion techniques
• Adversarial attacks
• MCP server security (tool poisoning, BOLA, transport weaknesses, credential leakage, authentication and authorization bypasses)
• Multimodal image and document attacks
• Reasoning model attacks
• Agentic and multi-agent exploitation

Detection uses 35 buff transformations for payload obfuscation and supports LLM-as-judge evaluation.

Supported providers

Augustus supports 48 generators, including OpenAI, Anthropic Claude, Azure OpenAI, AWS Bedrock, Google Gemini, Google Vertex AI, Cohere, Mistral, Ollama, xAI Grok, NVIDIA NIM, WatsonX, and others. It also supports MCP servers over Streamable HTTP and legacy SSE transports, as well as generic REST endpoints and WebSocket/hybrid transports.

How a scan works

When Guard schedules an Augustus scan:

1. Guard resolves target configuration, credentials, and model availability.
2. Augustus loads the probe families appropriate for the target type (MCP probes for type=mcp targets, LLM jailbreak probes for type=llm targets).
3. An optional reconnaissance phase runs, collecting inventory and context that feeds into probes.
4. Probes execute against the target. Each probe sends crafted payloads and records model responses.
5. Detectors score responses. Each attempt is scored by its own probe's detector set, not a shared union of all active detectors. Scores above the vulnerability threshold produce findings.
6. Per-probe risks are emitted to the Guard graph with evidence attached.

Augustus operates read-only. It sends test prompts and analyzes responses; it does not modify models, change configurations, or take autonomous actions.

MCP server security testing

Discovery and automatic routing

Julius includes an mcp-server probe that identifies Model Context Protocol servers. When Julius detects an MCP server, it sets Type = "mcp" on the asset. Augustus picks up these typed assets and automatically routes them into the MCP scan path — no additional configuration is required.

This routing applies to both deterministic and agentic execution paths. When an orchestrator agent discovers an MCP endpoint during a hunt, it is automatically handed to Augustus for security testing.

You can also register an MCP endpoint manually using the Add Webpage agent tool in Guard, supplying the endpoint URL and generator configuration. This bypasses the Julius auto-fingerprint path when you already know the target.

Active probe families

Augustus runs the following probe families against MCP servers:

• mcptool.* — tool-surface attacks: injection (including blind OS command injection), SSRF, BOLA, path traversal, response leak
• mcptransport.* — transport-level probes: origin validation, SSE session hijack, unauthenticated access
• mcpconfig.* — credential exposure in MCP server configuration
• mcpprimitive.* — resource and prompt template attacks: injection through primitives, credential leakage from resources and templates

These probes cover the OWASP MCP Top 10 attack classes.

Authentication and authorization probing

Augustus detects authentication and authorization weaknesses at the MCP layer:

• Unauthenticated access at the HTTP transport layer — servers that accept requests without valid credentials, including servers that advertise OAuth protection via RFC 9728 or RFC 8414 metadata but do not enforce it.
• Missing or bypassable authorization on tool calls — tools that do not enforce access controls.
• Privilege-escalation paths across MCP sessions — lower-privileged sessions that can exercise capabilities intended for higher-privileged callers.
• Token validation weakness — credential surfaces that accept values based on format rather than actual issuance.

Credential leakage across all MCP surfaces

Secret-detection coverage extends to all MCP response surfaces:

• MCP resources (including advertised resources read as-is)
• Prompt templates
• Tool responses
• MCP server configuration files (via mcpconfig.*)

When any of these surfaces expose plaintext credentials or other secrets, Augustus raises a finding with evidence attached.

Full JSON Schema traversal

Augustus traverses the complete input schema tree when building probe arguments for MCP tools. The following constructs are resolved at any depth:

• Nested properties
• $ref references
• allOf, anyOf, and oneOf composition keywords
• if/then/else conditional constructs

This ensures every tool reported as covered has been exercised with structurally valid arguments. Scan results on servers with complex schemas reflect the actual tested surface.

Argument value inference

When a tool's schema does not fully describe valid argument values, Augustus infers them from multiple sources in precedence order:

1. Operator-configured value rules (YAML values: selectors)
2. Hook variables
3. Values observed in prior tool responses during the same scan
4. Schema enum declarations and const values
5. Values disclosed in the server's own error messages when invalid arguments are submitted

This reduces the number of calls that fail at schema validation before reaching the target logic, improving coverage on servers with gated or discriminator-based parameters.

Paginated catalog traversal

Augustus follows nextCursor across all MCP catalog pages (tools, resources, resource templates, prompts) before building the probe argument set. A tool that appears only on a later page is not silently excluded from coverage.

When catalog enumeration reaches a configured page or volume limit, the scan reports the catalog as incomplete rather than presenting partial coverage as a clean result.

Reconnaissance panel

Discovered MCP servers surface a dedicated LLM Recon panel in the Guard UI. The panel shows:

• Server identity information (name, version, transport, protocol)
• Tool, resource, and prompt catalog
• Additional observation types surfaced during the reconnaissance phase

The Run recon button in the panel triggers a fresh reconnaissance pass against the asset without running the full probe suite.

Per-asset credentials

Credentials attached to an asset in Guard are automatically looked up and forwarded to MCP and HTTP probes at scan time. Authenticated tests use the stored credentials without additional configuration. Probes that require authentication do not produce misleading clean results due to missing credentials.

MCP server pre-flight

Model availability is verified before probes execute. If the configured judge or attacker model is not routable through the gateway, the scan fails with an actionable error rather than producing a silent empty result.

Multimodal probes

Image attack probes

Augustus includes image-based attack probes (multimodal.*) that embed adversarial payloads in images and submit them to vision-capable models. These probes cover:

• Typographic instruction injection (plaintext, scene-coherent, fine-print)
• Invisible and low-contrast text
• Image scaling attacks (targeting CLIP-tier vision encoders)
• Steganographic techniques (LSB, DCT-domain, adaptive)
• Metadata injection (PNG tEXt, JPEG EXIF)
• FigStep numbered-list jailbreak
• Visual semantic exploits and VSH narrative scene attacks

Probes score findings using a channel-aware model: covert channels (stego, metadata, invisible text) score a canary read as a confirmed finding; visible channels score a standalone obeyed instruction as a "verify" result requiring manual review.

Obeyed injection findings — when a visible-channel probe confirms that the model obeyed an image-embedded instruction over the user prompt, Augustus emits an informational-severity risk flagged for manual verification. This signal appears in Guard scan results so the behavior can be assessed in your deployment context.

PDF attack probes

Augustus includes multimodal document attack probes (pdf.*) that send adversarial content embedded in PDF payloads to the target model. Supported providers:

• Anthropic — supported via native document content blocks.
• Google Gemini and Vertex AI — native document content blocks are wired through both Google generators.

PDF probes run automatically when a supported provider is configured; no additional setup is required.

Multi-turn attack strategies

Augustus includes adaptive attack strategies for multi-turn probing:

Multi-turn probes require a judge model configured in the scan. When Guard provides a Bifrost virtual key, the judge and attacker models are routed through the platform gateway automatically.

Scan output and findings

Per-probe risks

Each probe that produces a finding emits a separate risk in Guard. Risk names follow the pattern llm-<probe> (for example, llm-goodside-ThreatenJSON). This structure allows per-probe triage and deduplication.

Finding evidence

Each finding includes:

• The prompt sent and the model response
• Tool name and parameter (for mcptool.* probes)
• Control call results (for BOLA and authorization probes)
• A plain-language goal sentence summarizing what the finding demonstrates
• Attempt metadata surfaced in a readable format

Scan verdict and exit codes

Each scan attempt is classified into one of four verdicts:

The scan exits with a code that indicates the overall outcome:

If probe errors appear in a scan report, review the affected target's credentials and connectivity before treating the scan as complete.

MCP security write-ups

MCP probe findings carry structured, self-contained security write-ups:

• Vulnerability description and impact
• Remediation guidance
• CWE taxonomy and references
• CVSS v4.0 scoring (conservatively scored)
• Verification write-up — reproduction-oriented prose describing how the probe confirmed the finding and the steps to reproduce it manually

Write-ups are available for the following probes:

Aggregated origin validation findings

Origin header bypass variants are reported as a single consolidated finding per server. Each bypass variant is included as evidence within the finding, but a server with multiple bypass classes produces one risk rather than one per variant. The finding scores are adjusted based on the target host class (loopback and LAN hosts are directly exploitable via DNS rebinding; public hosts represent a CSRF-class concern).

Configurable refusal phrases

If your target responds to probes with custom guardrail messages not recognized by the default detector vocabulary, add your target's refusal phrases using the --refusal-pattern CLI flag or the detectors.refusal_patterns YAML config field. These phrases are distributed to all mitigation and refusal detectors automatically, reducing false-positive vulnerable findings on hardened targets.

Security controls

• Augustus sends test prompts and records responses. It does not modify AI models, change configurations, or take autonomous actions.
• Testing is scoped to AI endpoints authorized within Guard. Augustus cannot reach beyond the defined scope.
• All activity is logged and auditable within the platform.
• LLM-as-judge evaluation is isolated for classification purposes only. Remediation decisions remain with your security team.

Getting started

1. Ensure Julius has fingerprinted your AI services and created assets in Guard.
2. Navigate to the asset representing an LLM endpoint or MCP server.
3. Configure scan parameters (probe selection, generator type, credentials) or accept the defaults.
4. Run an Augustus scan from the asset panel.

For MCP servers discovered automatically during a hunt, no manual configuration is required — Augustus runs the appropriate probe families automatically.