First, work out what to test.
Every agent reaches different things. One reads mail, another can pay, another runs code. Test them all with the same list and you either miss what matters or waste the run. Router reads what your agent can reach first, keeps the tests that apply, and returns the result in a format the people reading it already use.
- mail.read_inboxemail · reads private data
- mail.send_emailsends out
- crm.get_tickettool output
- crm.update_recordchanges records
- web.fetch_pageweb page
No skills, files, payments, code execution or long-term memory.
What it can reach
Router starts each of your MCP servers once and reads the tool list. From each tool's name it works out what the tool does: reading mail, sending it out, changing records, spending money. Anything it can't work out is treated as possibly consequential. If it guessed wrong, correct it in agent.yaml.
What to test
Every test states what it needs: where the attack comes in, and what it wants the agent to do. When an agent doesn't have those, the test is marked not applicable and isn't run. The choice follows fixed rules, not a model's judgement, so anyone who runs it gets the same list.
Who gets the result
Developers get SARIF that drops straight into CI. GRC tools get OSCAL, valid against the OSCAL schema. Auditors and insurers get the signed receipt from ATR Eval.
Not done yet
Today it can test Claude Code, Grok Build, and any agent that reads a standard MCP config file. Codex, goose and OpenHands have no adapter yet.
Also not built: Inspect support, so government evaluators can rerun the same tests themselves; a proxy mode that sits between a real agent and its tools; and a page that maps results to Annex IV of the EU AI Act.
Router is not public. It runs on the maintainers' machines today, and there is no release date.
Interests: the maintainer founded and controls PANGUARD AI, INC., which sells AI agent security products built on ATR.