Compliance scoring, credential leak detection, extension drift monitoring, and security hardening checks—the AI-specific security layer that sits on top of your existing infrastructure.
A 0–100 composite score across 7 configuration checks. Each check is weighted equally. A score below 70 triggers a YELLOW warning; below 50 triggers RED.
| Check | What It Validates |
|---|---|
| Network Binding | Gateway binds to localhost only, not exposed externally |
| Authentication | API authentication enabled and properly configured |
| Sandbox Mode | Agent sandbox restrictions active for code execution |
| DM Policy | Telegram direct message policy set to deny-all by default |
| Exec Mode | Code execution mode restricted to sandboxed environments |
| Version Currency | OpenClaw version is current and not known-vulnerable |
| Multi-User Isolation | Session isolation prevents cross-agent data leakage |
20 regex patterns scan workspace files for accidentally exposed secrets: API keys, tokens, private keys, passwords. Results are redacted in output to prevent secondary exposure.
openclaw.env, GOG keyring, fleet-credentials.json) are checked for permission correctness (600/700) rather than flagged as leaks. The credential scan targets unexpected locations: session files, memory files, agent workspace output, logs.SHA-256 baselines are computed for every file in the extensions directory. On subsequent scans, Mighty Mark compares current hashes against the baseline. Any drift indicates either a legitimate upgrade (update the baseline) or unauthorized modification (investigate).
No existing SIEM tool knows whether your AI agent's Telegram DM policy is set to deny-all. No vulnerability scanner checks whether extension binaries have drifted from their last known-good SHA-256. No EDR solution validates whether session isolation is properly enforced for a multi-agent AI fleet.
Mighty Mark's security scanning is the AI-specific layer that fills the gap your existing infrastructure security can't reach. It doesn't replace your SAST, DAST, or SIEM—it complements them with governance-aware checks that only matter when you're running autonomous AI agents in production.
# mighty-mark v0.7.x
# Run full security scan
mighty-mark security-scan
# Run with extension drift detection
mighty-mark security-scan --drift