Behavior cop and red-teamer for A2A, MCP, and Python agents

What it does

Rogue is a client-server testing platform that vets AI agents in two modes. It first checks whether your agent follows business policies and expected conversation flows, flagging regressions. Then it switches to adversarial red teaming, throwing encoding tricks, social engineering, and injection attempts at the agent to surface vulnerabilities scored with standard CVSS metrics.

The interesting bit

Rather than forcing your agent into a specific framework, Rogue speaks Google’s A2A, Anthropic’s MCP, or plain Python function calls. The frontend TUI is written in Go with Bubble Tea while the evaluation engine stays in Python—an architectural split that feels oddly fitting for a tool built to audit polyglot agents.

Key highlights

• Maps findings to eight compliance frameworks, including OWASP LLM Top 10, MITRE ATLAS, and the EU AI Act.
• Generates reproducible scan results using fixed random seeds, so regression tests actually regress deterministically.
• Exports reports in Markdown, CSV, and JSON for human review or pipeline ingestion.
• Uses an external judge LLM—via LiteLLM—to grade responses, supporting OpenAI, Anthropic, and Google models.
• Free for personal and internal use; commercial hosting requires a separate license.

Caveats

• Requires external LLM API keys to run evaluations; no fully offline mode is described.
• Proprietary license: free for personal and internal use, but commercial deployment needs explicit permission.

Verdict

Worth a look if you are shipping customer-facing agents and need both behavioral regression tests and a structured security audit. Skip it if you want a fully open-source, offline-capable scanner with no third-party LLM dependencies.