Detonation LabsBehavioral security for the AI agent supply chain

Legal

Terms of use

By using detonationlabs.com or its API you agree to these terms. Last updated 25 October 2026.

The service

Detonation Labs runs AI agent skills and MCP servers in an isolated sandbox and reports the behavior it observes. The service is in early access and may change, pause or be limited at any time.

What you may submit

Submit only packages you have the right to share with us, such as public packages or your own code. By submitting publicly, you allow us to publish the resulting report, the package name and its source in the public database. You keep all rights to your code.

Acceptable use

  • Don't use the service to develop, test or improve malware for use against others.
  • Don't try to break out of the sandbox except under our security policy, and don't attack, overload or scrape the service beyond its published limits.
  • Don't use results to make false claims about a package or its authors.

We may block submissions or keys that break these rules.

About results

Reports describe behavior observed during our runs. "No malicious behavior observed" is evidence, not a guarantee that a package is safe; code paths we did not reach can still hide behavior. Results are provided as is, and you remain responsible for what you install.

API keys and limits

Keep your API key secret; you are responsible for its use. Keys have usage limits, and we may change limits or revoke keys that are abused.

Liability

To the extent the law allows, Detonation Labs is not liable for indirect or consequential losses arising from use of the service or reliance on its results.

Changes

We may update these terms; the date above shows the latest version. Questions: [email protected].