multi-agent orchestration
AutoGen is a framework for building multi-agent AI applications where agents can work autonomously or collaborate with humans. It provides layered APIs (Core, AgentChat, and Extensions) for different levels of abstraction, from low-level message passing to high-level rapid prototyping. The project is currently in maintenance mode; Microsoft recommends new users start with Microsoft Agent Framework instead.
Build single or multi-agent AI systems using AssistantAgent and orchestration patterns Connect external tools and services via MCP (Model Context Protocol) servers for web browsing, code execution, and file handling Prototype workflows without code using AutoGen Studio's no-code GUI Extend functionality across Python and .NET with the Extensions API for LLM clients and capabilities Evaluate agent performance using AutoGen Bench for benchmarking and testing ⚠ REVIEW
Risk score 55/100
21 HIGH✓ 28 MEDIUM 8 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 21 likely real (100%) 6 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 4 high-signal, 2 mostly false-positive (hidden by default)
CHK-083 10 findings 8 likely 2 false positive
20% FP CHK-099 5 findings 5 likely
0% FP CHK-090 4 findings 4 likely
0% FP CHK-103 2 findings 2 likely
0% FP ▼ Show 2 checkers that are mostly false positives (6 findings) 57 findings click to expand
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
python/samples/core_streaming_handoffs_fastapi/app.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/samples/core_streaming_handoffs_fastapi/agent_user.py
python/samples/core_streaming_handoffs_fastapi/agent_user.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/packages/agbench/src/agbench/run_cmd.py
python/packages/agbench/src/agbench/run_cmd.py
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/packages/agbench/src/agbench/tabulate_cmd.py
python/packages/agbench/src/agbench/tabulate_cmd.py
AI: likely real possible ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
python/samples/agentchat_fastapi/app_agent.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/packages/magentic-one-cli/src/magentic_one_cli/_m1.py
python/packages/magentic-one-cli/src/magentic_one_cli/_m1.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/samples/agentchat_graphrag/app.py
python/samples/agentchat_graphrag/app.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/packages/agbench/src/agbench/remove_missing_cmd.py
python/packages/agbench/src/agbench/remove_missing_cmd.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/packages/autogen-ext/src/autogen_ext/agents/web_surfer/_multimodal_web_surfer.py
python/packages/autogen-ext/src/autogen_ext/agents/web_surfer/_multimodal_web_surfer.py
AI: likely real possible ▼
CHK-083 Potential path traversal — user-controlled path in file operation: python/samples/core_streaming_handoffs_fastapi/app.py
python/samples/core_streaming_handoffs_fastapi/app.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
python/packages/autogen-studio/autogenstudio/web/routes/sessions.py
AI: likely real possible ▼
CHK-103 Destructive operation without authorization check
python/packages/autogen-studio/autogenstudio/web/routes/sessions.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
python/packages/autogen-studio/autogenstudio/web/routes/teams.py
AI: likely real possible ▼
CHK-103 Destructive operation without authorization check
python/packages/autogen-studio/autogenstudio/web/routes/teams.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
python/packages/autogen-studio/autogenstudio/web/routes/settingsroute.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'user_id' accessed without ownership check
python/packages/autogen-studio/autogenstudio/web/routes/gallery.py
AI: likely real possible ▼
CHK-099 Potential IDOR — 'item_id' accessed without ownership check
python/samples/core_streaming_handoffs_fastapi/tools.py
AI: likely real possible ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
python/samples/core_streaming_response_fastapi/app.py
AI: likely real possible ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
python/samples/agentchat_fastapi/app_team.py
AI: likely real possible ▼
CHK-129 Sensitive field in return type/schema — "secret"
python/packages/autogen-studio/frontend/src/components/types/datamodel.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — secret: str
python/packages/autogen-studio/autogenstudio/web/auth/models.py
AI: likely real likely ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in local/__init__.py
python/packages/autogen-ext/src/autogen_ext/code_executors/local/__init__.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
python/samples/gitty/src/gitty/_db.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in python/check_md_code_blocks.py
python/check_md_code_blocks.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gitty/_github.py
python/samples/gitty/src/gitty/_github.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gitty/_db.py
python/samples/gitty/src/gitty/_db.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gitty/_config.py
python/samples/gitty/src/gitty/_config.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in gitty/__main__.py
python/samples/gitty/src/gitty/__main__.py
possible ▼
CHK-125b chown — ownership change — no scope constraint in autogen-studio/Dockerfile
python/packages/autogen-studio/Dockerfile
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in ParallelAgents/scenario.py
python/packages/agbench/benchmarks/GAIA/Templates/ParallelAgents/scenario.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in agbench/remove_missing_cmd.py
python/packages/agbench/src/agbench/remove_missing_cmd.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in agbench/run_cmd.py
python/packages/agbench/src/agbench/run_cmd.py
possible ▼
CHK-125a pathlib.Path — unconstrained path access — no scope constraint in agbench/run_cmd.py
python/packages/agbench/src/agbench/run_cmd.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in .devcontainer/post-create-command.sh
python/packages/autogen-studio/.devcontainer/post-create-command.sh
possible ▼
CHK-125a os.remove() — file deletion — no scope constraint in notebooks/tutorial.ipynb
python/packages/autogen-studio/notebooks/tutorial.ipynb
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in database/db_manager.py
python/packages/autogen-studio/autogenstudio/database/db_manager.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in database/schema_manager.py
python/packages/autogen-studio/autogenstudio/database/schema_manager.py
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in types/component-templates.ts
python/packages/autogen-studio/frontend/src/components/types/component-templates.ts
possible ▼
CHK-125b chown — ownership change — no scope constraint in guides/docker.tsx
python/packages/autogen-studio/frontend/src/components/views/deploy/guides/docker.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in fields/agent-fields.tsx
python/packages/autogen-studio/frontend/src/components/views/teambuilder/builder/component-editor/fields/agent-fields.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in fields/tool-fields.tsx
python/packages/autogen-studio/frontend/src/components/views/teambuilder/builder/component-editor/fields/tool-fields.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in workbench/workbench-fields.tsx
python/packages/autogen-studio/frontend/src/components/views/teambuilder/builder/component-editor/fields/workbench/workbench-fields.tsx
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in tools/_function_tool.py
python/packages/autogen-core/src/autogen_core/tools/_function_tool.py
possible ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in utils/page_logger.py
python/packages/autogen-ext/src/autogen_ext/experimental/task_centric_memory/utils/page_logger.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in redis/_redis_memory.py
python/packages/autogen-ext/src/autogen_ext/memory/redis/_redis_memory.py
possible ▼
CHK-125a os.unlink() — file deletion — no scope constraint in azure/_azure_ai_agent.py
python/packages/autogen-ext/src/autogen_ext/agents/azure/_azure_ai_agent.py
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in docker/_docker_code_executor.py
python/packages/autogen-ext/src/autogen_ext/code_executors/docker/_docker_code_executor.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in agents/_code_executor_agent.py
python/packages/autogen-agentchat/src/autogen_agentchat/agents/_code_executor_agent.py
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/dotnet-release.yml
.github/workflows/dotnet-release.yml
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in Scripts/init_tasks.py
python/packages/agbench/benchmarks/HumanEval/Scripts/init_tasks.py
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in agentchat_fastapi/app_team.html
python/samples/agentchat_fastapi/app_team.html
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in core_streaming_handoffs_fastapi/README.md
python/samples/core_streaming_handoffs_fastapi/README.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in langchain/_langchain_adapter.py
python/packages/autogen-ext/src/autogen_ext/tools/langchain/_langchain_adapter.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in agentchat_graphrag/app.py
python/samples/agentchat_graphrag/app.py
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in core_streaming_response_fastapi/README.md
python/samples/core_streaming_response_fastapi/README.md
possible ▼
CHK-125c urllib.request — unconstrained HTTP — no scope constraint in azure/_azure_ai_agent.py
python/packages/autogen-ext/src/autogen_ext/agents/azure/_azure_ai_agent.py
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in agentchat_fastapi/app_agent.html
python/samples/agentchat_fastapi/app_agent.html
possible ▼
▼ Show 6 false positives (10% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.