Four open-source tools check the setup of AI coding agents on a developer’s machine. This table lists only what each tool’s own documentation says, with the date we read it; «not stated» means the documentation does not say.
| RosmarOps | Snyk Agent Scan | cc-audit | agentcheck | |
|---|---|---|---|---|
| What it checks | The configuration of AI coding agents, your repositories and your local credentials | Agent applications, MCP servers, tools and skills, for risks such as prompt injection | Claude Code skills, hooks and MCP servers | What an AI agent could access from your shell: cloud IAM, API keys, Kubernetes and local tools |
| Sends data | Nothing | Component information, including tool names and descriptions, to the Snyk Agent Scan API; secrets redacted before sending | Not stated | Not stated |
| Score | Agent Posture Score out of 100, per agent it evaluates | Scored risk indicators | 0–100 | Severity levels from LOW to CRITICAL |
| Systems | Windows; macOS in preview | macOS, Linux and Windows, with caveats per agent | Not stated (install guide names macOS and Linux) | Not stated (install guide names macOS and Linux) |
| Licence | AGPL-3.0 | Apache-2.0 | MIT | MIT |
| Source, read on 29 October 2026 | README of qtorb/rosmarops | README on main (latest release 0.6.9, 20 October 2026) | docs.rs 3.23.30 (12 October 2026) | GitHub README |
Vendors can send corrections to legal@rosmarops.com.