Wargame Arena
A wargame arena, not a static scanner.
AgentSmack makes the synthetic-SaaS sandbox executable: feed it the ordered tool-call requests your agent issued and it serves each one a canary-seeded, sinkholed, reversible fixture response — the attacker's injected instruction lives in the tool output the agent reads, not just a prompt. The arena never forwards real egress; it sinkholes any unauthorized target by construction and plants only a redacted canary reference (the raw secret is never served). You get a per-call timeline + an Autonomy Risk Score from the same deterministic scorer, with OWASP/NIST coverage and paste-able remediation.
Driving a live endpoint? Run a pre-flight first — prove your endpoint is reachable and speaks a parseable wire shape before you trust a clean live score.
Want to grade an agent's autonomy with NO scenario? The Autonomy Risk Score Lab grades any observed action transcript against a declared ceiling (recommend / draft / approval-required / autonomous).
3 · Run as a live agent
Don't paste a transcript — drive a deterministic agent turn-by-turn. It REACTS to the injected instruction the arena embeds in each tool output (what a static call-list can't show).
Replay a captured agent reply
Drive the loop with REAL function-calling provider JSON (OpenAI tool_calls / Anthropic tool_use), translated deterministically into each next move. The gauge swings off the captured reply — not a pre-decided policy.
3b · Bring your own tool surface
Don't settle for a canned demo — declare YOUR agent's real fake-tool surface, plant YOUR canary, and watch the susceptible reference agent fall for a tool-output injection on YOUR own tools. The arena hash-verifies + redacts your canary (the raw value is never served or returned).
4 · Drive a live agent endpoint
Point AgentSmack at YOUR deployed function-calling agent and watch it run, turn by turn, against the scenario above. Each turn is a real HTTP round-trip; the arena embeds the injected instruction in the tool output your agent reads, then feeds the response back as its next turn.
This POSTs to a real endpoint you control. All side effects are SINKHOLED by construction (no egress is ever forwarded), and localhost / private / link-local targets are refused server-side by the SSRF guard.