Authorization notice. Dodoguard is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.
Who it is forA platform owner who builds agents in Dify, Coze, FastGPT, or n8n and must confirm the app is configured safely before go-live.
The problemAgent apps can ship with misconfigurations and exposed attack surface that a demo never shows.
The outcomeA versioned detection task with findings, severity, and evidence for the agent app, plus a list of fixes to retest.
What you need first
- Node.js 22.12 or newer for the CLI
- An OpenAI API key for the OpenAI example, or a local Ollama setup for the local red-team example
- Docker with Docker Compose for the web console
- Access to the Dify, Coze, FastGPT, or n8n app you want to check, if you run platform checks
Steps
- Start the web console with
docker compose up -d --build - Open http://localhost:3000 in your browser
- Register the agent app as an asset in the asset ledger
- Create a detection task for platform checks against that asset
- Review the findings, fix them, then rerun the task before you decide on go-live
Prompt for your agent
Using the dodoguard web console at http://localhost:3000, register the agent app <agent-name> as an asset and create a platform check task for it. Return the findings with severity and evidence. Verify that the task was rerun after fixes and that no open high-severity finding remains before you recommend release.
Caveat. The README names Dify, Coze, FastGPT, and n8n with Dify-class scans, so check that your platform is covered before you rely on the results.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for dodoguardai/dodoguard and "Audit a Dify or Coze agent for misconfig and attack surface"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer