AI Agent Blast-Radius Mapper

Map what your agent can read, change and send.

Add the systems your agent connects to and the permissions it uses. The map updates from your entries and highlights controls to review. It does not connect to or test those systems.

Open the OWASP explorer

Map from your selections

Selected systems and authority

Connections and maximum permissions marked in this map.

4 connected systems

AI agent

MCP-connected assistant

write

Source code

Repositories, pull requests, issues, and workflows.

3 suggested checks

send

Email

Mailboxes, drafts, messages, and recipients.

4 suggested checks

read

Customer data

Profiles, orders, cases, and account records.

No modeled gaps

execute

Deployment

Build systems, environments, releases, and production.

4 suggested checks

Risk summary

5 suggested checks

critical

Check production approval

Deployment execution is selected, but human approval is not. Check whether the exact target and change require approval before execution.

Enforce approval outside the model before a production action can run.

high

Check approval for external messages

Email sending is selected without a human approval control. Check who approves the recipients and message before it is sent.

Separate drafting from sending and require approval of recipients and content.

high

Review combined authority

Multiple systems allow changes, and least privilege is not selected. Check whether one identity can use those permissions together.

Split read, draft, write, send, and execute into independently authorized tools.

high

Check validation before actions run

Actions that change a system are selected without output validation. Check the schema, target and authorization before execution.

Validate tool arguments and authorization server-side before execution.

moderate

Define how to contain unintended changes

Actions that change a system are selected without a recovery control. Check how an operator can revoke access, stop work or restore affected state.

Define rollback, revocation, containment, and operator escalation procedures.

Map these paths to OWASP

This map uses the connections and controls you select. Critical, high and moderate are TKOResearch planning priorities, not measured risk ratings. Test the implementation and review paths the map does not cover.

Method

Authority determines impact.

Map reachable systems

List each system the agent can reach and distinguish read, write, send, and execute authority.

Model deterministic boundaries

Count controls only when code, policy, credentials, or human approval enforce them outside the model.

Prioritize control gaps

Focus first on paths that combine sensitive systems, external actions, production authority, and weak recovery.