Usage
const analysis = await kavach.analyzer.analyzeAgent(agentId);
console.log(analysis.overPrivileged); // permissions broader than needed
console.log(analysis.unusedPermissions); // granted but never exercised
console.log(analysis.riskScore); // 0-100 risk assessment
console.log(analysis.recommendations); // suggested permission changes
Scan all agents
const report = await kavach.analyzer.scanAll();
for (const finding of report.findings) {
console.log(`${finding.agentId}: ${finding.type} - ${finding.description}`);
}
Finding types
| Type | Description |
|---|---|
over-privileged | Agent has broader permissions than its actual usage |
wildcard-risk | Agent uses * wildcard on sensitive resources |
unused-permission | Permission granted but never used in audit trail |
stale-agent | Agent hasn’t been used in 30+ days |
no-expiry | Agent has no expiration date set |
deep-delegation | Delegation chain depth exceeds recommended limit |
Configuration
const kavach = await createKavach({
analyzer: {
unusedThresholdDays: 30, // flag permissions unused for 30+ days
maxRecommendedDepth: 3, // flag delegation chains deeper than 3
wildcardWarning: true, // flag wildcard permissions
},
});
The analyzer reads from the audit trail. Enable
auditAll: true in agent config for accurate unused-permission detection.