Directory / Strands Agents SDK

Strands Agents SDK

Agent framework · AWS · 4/7 verified · Listed on agentsafetyscore 2026-10-23 · Last checked 2026-10-23

Cedar policies and intervention handlers can deny or pause any tool call, with fail-closed options. Approval, sandboxes and tracing are all opt-in.

Overall: B (2.00 avg, 4/7 controls verified)

Lock this down first

Add CedarAuthorization or a HumanInTheLoop handler before giving an agent side-effecting tools, and run shell and code tools in a Docker or SSH sandbox. Upgrade to strands-agents 1.43.0 or @strands-agents/sdk 1.5.0 if you run the A2A server.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	CedarAuthorization checks each tool call against Cedar policies, including identity and arguments, and denies when nothing permits it; it fails closed if identity can’t be resolved. Opt-in. No documented admin lock, so 2. 2026-10-22: CVE-2026-115419 (AWS): the A2A server didn’t keep callers’ conversations apart, so one caller could read another’s history and plant instructions for later callers. Fixed in strands-agents 1.43.0 and @strands-agents/sdk 1.5.0.
Human approval gates	2/3	The HumanInTheLoop handler pauses before tool calls for a person to approve; allowedTools skips it for listed tools. Nothing pauses by default.
Sandboxing	2/3	Pluggable Docker and SSH sandboxes run shell, code and file operations away from the agent process. Opt-in. Strands Box is in preview and isn’t scored.
Secrets handling	Unverified	Strands Box injects credentials at its gateway, but Box is in preview, so this isn’t scored.
Audit logs	2/3	OpenTelemetry traces cover every model and tool call, including parameters and results. Export is something you set up.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	Unverified	Not confirmed in the docs we checked.

Unverified: Secrets handling, Kill switch / interrupt, Network egress control. That means we could not confirm it in public docs, not that it is missing.

Public reports

Independent reporting, not used for scoring.

2026-10-22 · NVD: CVE-2026-115419: A2A server mixed callers’ conversation state (fixed in 1.43.0 / 1.5.0)

Sources

Vendor? Request a correction. We review every correction request. How corrections work.