Skip to content

Free tool 5 · Agent Key Blast-Radius Scorecard

If one agent's key leaked tonight, how much could walk out? Score your agent keys in 3 minutes, without sharing a single key.

Fifteen multiple-choice questions about where your agent keys live, what they can sign and who else can use them. You get a custody level from 0 (key in the agent's loop) to 4 (no standing key), a score from 0 to 100, the largest balance one compromised component could reach, your top risks and a checklist for the next seven days. Where your answers can't tell, it says so instead of guessing high. The weights are published below the questions.

Nothing you enter leaves your browser.

  1. 1. Where do your agents' signing keys live?
  2. 2. Do agents share keys?
  3. 3. What can a single agent key sign?
  4. 4. How long does an agent key or session stay valid?
  5. 5. How much can one key reach (balance plus allowances)?
  6. 6. Does the agent runtime load third-party plugins, tools or MCP servers in the same process as the key?
  7. 7. Have you tested exporting and recovering an agent wallet?
  8. 8. Could a re-authentication, provider change or lost session orphan a wallet?
  9. 9. How are agent keys rotated?
  10. 10. Who can sign with an agent's key without going through the agent?
  11. 11. Can you revoke one agent's key without stopping the others?
  12. 12. Could a key end up in the model's context, prompts or logs?
  13. 13. If a wallet provider or signing service holds the key (CDP, Privy, Turnkey, a KMS), where is the credential that asks it to sign?
  14. 14. Can a hosted model router or proxy see your agent's prompts and tool results?
  15. 15. Can you rotate an agent's signer without changing its wallet address?
How the score is calculated

Each answer scores 0 to 10 points and each question has a weight from 1 to 3. Your score is the weighted points you got as a share of the weighted maximum, from 0 to 100. Bands: 80+ low, 60-79 moderate, 35-59 high, under 35 severe.

QuestionWeightPoints per answer
1. Where do your agents' signing keys live?×30 / 3 / 7 / 7 / 8 / 10
2. Do agents share keys?×210 / 4 / 0
3. What can a single agent key sign?×210 / 4 / 0
4. How long does an agent key or session stay valid?×110 / 6 / 2 / 0
5. How much can one key reach (balance plus allowances)?×310 / 7 / 4 / 2 / 0
6. Does the agent runtime load third-party plugins, tools or MCP servers in the same process as the key?×210 / 5 / 0
7. Have you tested exporting and recovering an agent wallet?×110 / 4 / 0
8. Could a re-authentication, provider change or lost session orphan a wallet?×110 / 3 / 0
9. How are agent keys rotated?×110 / 3 / 0
10. Who can sign with an agent's key without going through the agent?×210 / 3 / 0
11. Can you revoke one agent's key without stopping the others?×210 / 5 / 0
12. Could a key end up in the model's context, prompts or logs?×110 / 3 / 0
13. If a wallet provider or signing service holds the key (CDP, Privy, Turnkey, a KMS), where is the credential that asks it to sign?×210 / 0 / 3 / 10
14. Can a hosted model router or proxy see your agent's prompts and tool results?×110 / 7 / 2 / 0
15. Can you rotate an agent's signer without changing its wallet address?×110 / 4 / 0
0 of 15 answered

Want a second pair of eyes on one real workflow?

This tool checks how you describe your agent keys from what you typed. It can't see your code, keys, contracts or production traffic. If the result shows gaps, send me one real workflow. In my free 48-hour integration review I go through it end to end and send you a written report: fit, dependencies, permission risks, acceptance tests and a build or don't-build-yet call.

A self-reported score can't show how keys actually move through your code and infrastructure. The review maps one workflow's signing path (who can sign what, from where, with what limits) and returns the permission risks plus acceptance tests. It is explicitly not an audit.

Contact: Shilpa Goel, [email protected]

This is an engineering checklist, not a security audit, legal, compliance or investment advice.