Documentation

Everything you need to scan an agent and act on the result.

ExfilPath has no configuration to learn before your first scan. Point it at code and read the paths.

Quickstart

Get a full local report in under a minute.

Live now · free during early access

Full local browser analysis

Open the analyze page and add a file, folder or full repository. Your source stays in your browser session, the agent is never executed, and the report appears immediately.

Open the analyze page

Coming next

CLI and MCP workflows

The same path engine is coming to terminal, CI and MCP-connected workflows. Until then, the complete local analyzer is available in the browser with no installation required.

Browser analysis

What browser analysis covers.

Identical detectors and identical results to a pipeline run. The only difference is where the files come from.

Files or folders

Add a single file or select an entire project. Dependencies and build output are skipped automatically.

Any source layout

Extensions are used when present and content detection fills the gap, so an unusually named file is still analysed.

Exportable output

Download structured JSON for tooling or a written report for a review.

CLI and MCP

The same engine, wherever your workflow runs.

CLI and MCP workflows are coming next. Today, the complete local analyzer is live in the browser and free during early access, with the same path traces, detector coverage and exportable reports.

Live today

Full local browser analysis

Select a file, folder or full repository and inspect every route from untrusted input to a damaging action. Nothing is uploaded and your agent is never executed.

Analyze an agent

Coming next

Terminal and MCP workflows

Bring the same engine to command-line checks, CI thresholds and MCP-connected development workflows as those surfaces roll out.

Same engine · Same detectors · Same explainable path reports

CI and automation

Bring path checks into the workflow you already use.

CLI and CI workflows are coming next, using the same explainable path reports that are live in the browser today.

Available now

Analyze locally, export the evidence

Run a full local scan in the browser, then download JSON or a written report for your review, remediation work and release conversations.

Run a local scan

Coming next

CLI and CI enforcement

Add severity thresholds, pipeline checks and release evidence when the CLI and CI surfaces roll out.

Output

What the JSON contains.

exfilpath.json (shape)json

{
  "engine": "exfilpath-static",
  "version": "0.1.0",
  "generatedAt": "2025-01-01T00:00:00.000Z",
  "summary": {
    "filesAnalyzed": 4, "linesAnalyzed": 77,
    "sources": 1, "sinks": 2, "guards": 0,
    "openPaths": 2, "guardedPaths": 0,
    "exposure": 96, "grade": "F",
    "bySeverity": { "critical": 2, "high": 0, "medium": 0, "low": 0 },
    "durationMs": 8
  },
  "paths": [
    {
      "id": "path-1",
      "title": "Inbound email reaches network egress",
      "status": "open",
      "severity": "critical",
      "confidence": 82,
      "crossesModel": true,
      "crossesFiles": true,
      "source": { "label": "Microsoft Graph mail item", "file": "src/inbox.ts", "line": 9, "trust": "external" },
      "sink": { "label": "Outbound HTTP request", "file": "src/notify.ts", "line": 5, "impact": "critical" },
      "steps": [{ "role": "source", "file": "...", "line": 9, "label": "...", "code": "..." }],
      "guards": [],
      "fix": { "title": "Pin the destination to an allowlist", "effort": "one-line", "snippet": "..." },
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "cwe": "CWE-918",
      "why": "..."
    }
  ],
  "sources": [], "sinks": [], "guards": [], "files": [], "notes": []
}

Detector reference

Every detector in the engine — all 46 of them.

Nothing here is hidden. If a detector is wrong for your codebase, we would rather you tell us than work around it.

Sources

Places where content an attacker can influence enters the agent.

Detector	Category	Trust	Why it counts
Gmail message body	Inbound email	external	Anyone who knows the mailbox address can put text in here. No authentication needed.
Microsoft Graph mail item	Inbound email	external	External senders control the subject and body that the agent reads.
IMAP / mail parser payload	Inbound email	external	Raw mail content, fully attacker-authored.
Scraped web page content	Fetched web content	external	Page owners choose what the agent reads, including hidden text.
Remote HTTP response body	Fetched web content	external	The remote server decides the bytes. Treat as adversarial.
RAG retrieval result	Retrieved documents	external	Anything ingested into the index becomes instructions the model will read.
RSS / feed item	Fetched web content	external	Feed publishers author this text.
CRM record field (web-to-lead)	CRM / ticket data	external	Public forms write straight into these fields. This is the ForcedLeak entry point.
Support ticket / issue text	CRM / ticket data	external	Anyone who can file a ticket or issue controls this text.
Chat platform event payload	Chat message	external	Any workspace or channel member can send this.
HTTP request body / query	End-user input	external	Unauthenticated callers can shape this if the route is public.
HTTP request body / query	End-user input	external	Unauthenticated callers can shape this if the route is public.
End-user chat message	End-user input	partially-trusted	Authenticated but still untrusted. Insiders and compromised accounts count.
Inbound webhook payload	Webhook	external	Anything that can reach the endpoint can post this.
MCP / tool call result	Tool output	external	A third-party tool server chooses what comes back, including instructions.
Uploaded / parsed document	Uploaded file	external	Document text is attacker-authored, including invisible layers.
Shared queue / storage object	Queue or object storage	partially-trusted	Whoever can write to the queue or bucket can steer the agent.

Sinks

Actions that leak data or change systems. A sink alone is not a finding.

Detector	Category	Impact	Mapping
Outbound HTTP requestSends whatever it is given to a destination the caller chooses.	Network egress	critical	LLM02:2025 Sensitive Information DisclosureCWE-918
Outbound HTTP requestSends whatever it is given to a destination the caller chooses.	Network egress	critical	LLM02:2025 Sensitive Information DisclosureCWE-918
Markdown / HTML image or link rendered to the userThe victim client fetches the URL automatically, so data leaves with zero clicks.	Auto-fetched render	high	LLM05:2025 Improper Output HandlingCWE-74
Outbound email sendDelivers content and recipients chosen at runtime.	Messaging	high	LLM02:2025 Sensitive Information DisclosureCWE-200
Chat / SMS message sendPushes content to an external channel.	Messaging	high	LLM02:2025 Sensitive Information DisclosureCWE-200
Dynamic code or shell executionRuns attacker text as code with the process identity.	Code execution	critical	LLM05:2025 Improper Output HandlingCWE-94
Dynamic code or shell executionRuns attacker text as code with the process identity.	Code execution	critical	LLM05:2025 Improper Output HandlingCWE-78
Database write or raw queryChanges or destroys stored records.	Data mutation	critical	LLM06:2025 Excessive AgencyCWE-89
Filesystem write or deleteWrites or removes files on the host.	Data mutation	high	LLM06:2025 Excessive AgencyCWE-73
SaaS record writeWrites into the system of record other automations trust.	Data mutation	high	LLM06:2025 Excessive AgencyCWE-284
Cloud control-plane callChanges infrastructure or grants access.	Infrastructure	critical	LLM06:2025 Excessive AgencyCWE-732
Payment or funds movementMoves money.	Financial action	critical	LLM06:2025 Excessive AgencyCWE-284
Source repository writeShips code or config changes.	Infrastructure	high	LLM06:2025 Excessive AgencyCWE-284
Unrestricted tool dispatchLets the model pick which tool runs and with what arguments.	Agent autonomy	high	LLM06:2025 Excessive AgencyCWE-74
Agent-controlled browser navigationA URL in the payload becomes a request the agent makes for the attacker.	Network egress	high	LLM02:2025 Sensitive Information DisclosureCWE-918

Guards

Schema validation

strong

Forces the value into a known shape before it is used.

Destination allowlist

strong

Only pre-approved destinations are reachable, so exfiltration has nowhere to go.

Protects everything after it in the same function.

Prompt-injection screening

partial

Classifiers reduce volume but are bypassable — EchoLeak walked through one. Treated as partial.

Human approval gate

strong

A person authorises the action, so a payload alone cannot complete it.

Protects everything after it in the same function.

Sandboxed execution

strong

Execution is contained, so code execution does not reach the host or its credentials.

Protects everything after it in the same function.

Authorization check

strong

The action is bound to a caller identity and permission, not to whatever the payload asks for.

Egress policy / URL validation

strong

The destination is checked before the request leaves.

Protects everything after it in the same function.

Output encoding / sanitisation

partial

Neutralises rendered content. Strong for HTML, partial for free-form model output.

Parameterised query

strong

Values cannot change the statement structure.

Model boundaries

Model calls are neither sinks nor guards. They are boundaries: taint continues through them and severity rises, because data becomes instructions.

OpenAI chat / responses callOpenAI
Anthropic messages callAnthropic
Google Gemini callGoogle
Amazon Bedrock invocationAmazon Bedrock
LLM framework callLangChain / Vercel AI SDK / local

Triage

How to work through a result.

01
Read the sink first
The sink tells you what the damage would be. Egress and code execution come before rendering.
02
Check the source trust
External sources like inbound mail and public forms need no account to reach, so they come first.
03
Follow the trace
Open the path and read the hops. If a hop is wrong, the finding is a false positive — tell us which hop.
04
Apply the fix
Each path ships with the smallest change that closes it. Most are a few lines at the sink.
05
Re-scan
A closed path moves to the guarded list with the guard named, which is how you confirm the change landed.

Support

When a finding looks wrong, tell us which hop.

Precision is the product. A report of a bad hop is more useful to us than a five-star review.

Disputing a finding

Send the path title and the step you disagree with. We reproduce it against a minimal example and adjust the detector or document why the route stands.

Missing coverage

If your framework reads input or performs an action we do not recognise, send the pattern. New detectors ship regularly and are listed in the changelog.

Reports and retention

Exported reports live wherever you save them. We retain no copy of your source or your findings.

support@exfilpath.tech Contact the team

Get a full local report in under a minute.

Full local browser analysis

CLI and MCP workflows

What browser analysis covers.

Files or folders

Any source layout

Exportable output

The same engine, wherever your workflow runs.

Full local browser analysis

Terminal and MCP workflows

Bring path checks into the workflow you already use.

Analyze locally, export the evidence

CLI and CI enforcement

What the JSON contains.

Every detector in the engine — all 46 of them.

Sources

Sinks

Guards

Schema validation

Destination allowlist

Prompt-injection screening

Human approval gate

Sandboxed execution

Authorization check

Egress policy / URL validation

Output encoding / sanitisation

Parameterised query

Model boundaries

How to work through a result.

Read the sink first

Check the source trust

Follow the trace

Apply the fix

Re-scan

When a finding looks wrong, tell us which hop.

Disputing a finding

Missing coverage

Reports and retention