AI Agent Risk Calculator

An AI agent is risky in proportion to what it can do and how little stops it. The calculator measures both. Part 1 adds up the agent's exposure: points for each capability that could cause harm, such as reading content from outside the company, reaching personal data, sending data out, changing records, paying, running code or deciding about people. Part 2 measures control coverage: the share of the relevant controls that are in place, weighted by how much each one matters.

Risk score = (exposure ÷ 25) × (1 − control coverage) × 100. Yes = full weight, Partial = half, No = 0. 0 is the lowest risk.

An agent that can do nothing harmful scores 0 whatever its controls. An agent that can do everything with no controls scores 100. The weights are our own judgement of how much each capability adds and each control removes, based on the OWASP Top 10 for LLM Applications 2025 and for Agentic Applications 2026 and the MCP security best practices.

Levels: Low below 20, Medium from 20, High from 40. Any high red flag makes the level at least High, and a critical red flag makes it Critical, whatever the score.

Part 1 answers are Yes or No. Each Yes adds the points shown, up to 25.

Part 2 answers are Yes, Partial or No. A control counts only when the agent has one of the capabilities it limits; the others are marked as not counted and left out of the coverage.

Some combinations matter more than an average can show, so the calculator also checks seven fixed rules. A red flag closes only when the control that answers it is fully in place; Partial is not enough.

The first rule is the most important. An agent with untrusted input, private data and an outbound channel can be told by a single malicious email, ticket or web page to send that data to an attacker. The model cannot reliably tell instructions from data, so the fix is structural: remove one of the three capabilities, or put a person or a fixed allowlist between the agent and the outside world.

A support assistant reads incoming tickets (untrusted content), looks up customer records (personal data), replies by email (sends data out), uses a CRM connector from an MCP server (third-party tools) and replies on its own (no per-action approval). Its exposure is 3 + 3 + 3 + 2 + 3 = 14 of 25.

Ten controls are relevant; only the sandbox is not, because it runs no code. The agent has its own scoped credentials (3), approved and pinned tools (2) and is registered (1). Approval exists for some replies (Partial, 1.5 of 3), logging is partial (1 of 2) and data protection was assessed but has no DPIA yet (Partial, 1 of 2). There are no restricted destinations, limits, kill switch or injection tests. That is 9.5 of 21 points, a coverage of 45%.

Score: 14 ÷ 25 × (1 − 0.45) × 100 = 31, which alone would be Medium. But the exfiltration path is open (approval is only partial and destinations are not restricted), and the agent acts autonomously without a kill switch. The level is Critical. Requiring approval for every outgoing email that contains customer data, or limiting replies to the ticket's sender, closes the critical flag.

It is a structured self-assessment, not a scanner, a penetration test or an audit. It cannot see what your agent really does; it takes your word for it. Use it to decide where to look first and to explain the risk to management. For a full review of the MCP servers and tools an agent uses, the MCP Security Audit Kit has 57 checks with how to verify each one. To document the agent, its permissions and its risks, the AI Agent Governance Pack has a register, a delegation and permissions matrix and a risk assessment workbook.

The same rules are available to AI assistants as the agent_risk_check tool of the ClevSec MCP server, so an assistant can run the check for you and get the same result.