Connect an agent without handing it the keys to your machine.
Anyone can list thousands of AI tools. The hard part is trusting them. On FindAgent, every agent you connect is held to the same rules — enforced in code, not promised on a badge. Here is exactly what those rules are, and what they don’t cover.
Each one is enforced by FindAgent’s runtime and review pipeline — a creator can’t opt out.
Most agents run no code at all
A declarative agent — instructions, skills or actions — never ships code that runs on your machine. It only describes what to do; one trusted FindAgent runtime decides how, from a fixed set of safe actions (an API call or a prompt). So connecting one can’t run someone else’s program on your computer.
What it can do
Call the specific tools it declares — read your data, or, for an agent with actions, take an action you ask for.
What it can’t
Run arbitrary code, reach hosts it never declared, or touch your machine outside your AI client.
Your API keys go to one place only
When an agent needs a key — say your GitHub token — where it can go depends on who runs the agent. For a declarative agent, FindAgent’s own runtime makes every request: it attaches the key only to a request going to a host the agent declared up front, drops it if a request tries to redirect it elsewhere, and the creator never touches the value. For an agent whose code FindAgent runs, the creator’s code uses the key inside our sandbox, and the sandbox’s network allowlist is what holds it to the declared hosts. For code you download and run yourself, there is no sandbox and no allowlist of ours — you are trusting the publisher, which is why that kind is labelled and asks for your consent first. Each agent’s page says which of the three it is before you connect.
What it can do
Send your key to the destinations it lists on its page (for example, api.github.com).
What it can’t
Reach any host it never declared. And for a declarative agent — the large majority — the creator never sees the value at all: you enter keys encrypted and our runtime, not their code, makes the call.
What you send and what comes back are both scanned
What you send is checked against a prompt-injection deny-list before it reaches the agent, and every result it returns is scanned for leaked secrets before it reaches you. Both are always-on checks that an agent’s configuration cannot switch off. An agent can add stricter rules (like stripping personal data from a result), but it can never remove either one.
What it can do
Add extra guardrails on top of the baseline — never fewer.
What it can’t
Disable the injection deny-list on your input, or the secret-leak scan on its results.
Agent code runs in a locked-down sandbox
A few agents do run the creator’s real code. Hosted agents with code run it on FindAgent, in a single-use sandbox created fresh for each run and thrown away after, walled off from FindAgent’s own systems — it starts with no network access and can reach only the hosts the agent declares. A creator may also offer an agent whose code runs on your OWN machine (a local agent) so it can reach your local tools; that one is clearly labeled, shows its source, and asks for your consent before you download and run it — FindAgent never runs a local agent for you, and there is no sandbox around it, so review the source first.
What it can do
Run the creator’s code in isolation and reach only its declared hosts.
What it can’t
Run on your computer, reach the open internet by default, or touch FindAgent’s own app and data.
Every listing is human-reviewed, and every agent we serve is scanned
Before anything goes live, a person on the FindAgent team reviews it. An agent we serve also passes an automated security scan first. An MCP-server listing points at a server its provider runs, so there is no FindAgent-side code for a scanner to read — those are published on the human review alone. The publish step is enforced on our servers and fails closed — anything the checks can’t verify as safe is held back rather than waved through. A published agent, review, or comment can still be reported for a second look.
What it can do
Go live only after human review — and, for an agent we serve, a clean automated scan.
What it can’t
Self-publish, or slip past a failed scan or a failed build.
See the facts on every agent
You don’t have to take our word for it. Each agent’s page shows a plain-language summary drawn from that agent’s own definition — whether it ships code, the exact hosts your keys can reach, and which of its tools can change or delete data. No score, just the facts.
Honest boundaries build more trust than a wall of green checkmarks. Here’s what these protections don’t cover.
We don’t claim an agent is bug-free or that its results are correct — the guarantees are about safety boundaries, not quality. Read reviews and try an agent before relying on it.
We don’t claim the secret scan stops deliberately malicious agent code from smuggling data out — a determined program can encode around a text scan. The real boundary there is the sandbox’s network allowlist, which blocks any host the agent didn’t declare.
We don’t claim to vet the third-party services an agent connects to. If an agent calls an external API, that provider’s own security and privacy apply once your request reaches them.
We don’t rank agents by a security “score” or grade. We show you the concrete facts — what code it runs, where your keys go, what it can change — and let you decide.
For an agent listed only as a pointer to an external server the provider runs, FindAgent doesn’t run or inspect that server — you connect to it directly with the provider’s own sign-in.
Does connecting an agent run someone else’s code on my computer?
For a declarative agent — instructions, skills or actions — no. It ships no executable code; one trusted FindAgent runtime performs only the actions the agent declares. The agents that run real code are agents with code: most run in an isolated sandbox on FindAgent, never on your machine. A creator may also offer an agent whose code runs on your OWN machine (a local agent) so it can reach your local tools — that one is clearly labeled, asks for your consent, and shows its source before you download and run it, exactly like installing an npm package or a local MCP server. FindAgent never runs a local agent for you.
Where do my API keys go when I connect an agent?
It depends on who runs the agent, and its page says which before you connect. For a declarative agent, FindAgent’s runtime makes the requests: keys are entered encrypted, attached only to a request going to a declared host, dropped on a redirect elsewhere — the creator never sees the value. For an agent whose code FindAgent runs, the creator’s code uses the key inside our isolated sandbox, whose network allowlist keeps it to the declared hosts. For code you download and run yourself, no sandbox or allowlist of ours applies — you are trusting the publisher, which is why that kind is labelled and asks for your consent first.
Can an agent leak my secrets in its results?
Every result is scanned for leaked secrets before it reaches you, and that scan cannot be turned off by an agent — prompt-injection screening runs in the other direction, on what you send. It catches accidental leaks; the stronger boundary against deliberately malicious agent code is the sandbox network allowlist, which blocks any host the agent didn’t declare.
Is every agent reviewed before it goes live?
Yes. Every listing passes a human review, and every agent we serve also passes an automated security scan; the publish step is enforced on our servers and fails closed — a failed scan or build holds an agent back rather than letting it through. Published items can also be reported for a second look.
We use essential cookies to keep you signed in. With your consent we also use non-essential cookies for analytics. Read our privacy policy