Agent Topology Visualizer
Describe a multi-agent or agent-harness system — orchestrators, subagents, tools, memory stores, external APIs / egress and human-in-loop gates — wire them together, and the tool draws a deterministic node-graph diagram and reads it for security: where data can leave the trust boundary, which memory is poisonable, how a delegation hands off trust, where a loop lets the system modify itself, and how far a single compromise reaches. Start from a preset — a single ReAct agent, an orchestrator with subagents, a pipeline, a recursive self-improving (Harness²-style) harness, or a swarm — then edit. Everything runs in your browser; nothing is uploaded, and the flags are honest governance heuristics, not a scan.
A planner delegates to specialist subagents, each with its own tools, over a shared memory. The common production fan-out.
Nodes
7/24Add the pieces of the topology. Each type carries a standing governance concern, shown in the security read.
Connections
8/60Wire the nodes together. The kind of connection decides how it is read for risk.
Topology diagram
Deterministic layered layout (no physics). A dashed edge closes a cycle — a self-improvement / recursion loop and a change-control concern.
Security read & blast radius
heuristicWorst-case blast radius: a compromise of Planner reaches 6 downstream nodes, and shared memory (persistence).
1 high-severity concern flagged below. Un-gated egress, poisonable memory and self-modifying cycles are the controls to add first.
Node concerns
Shared memory is poisonable — a bad or stale write persists and compounds; require provenance + a TTL and restrict writers. Multiple or delegated writers widen who can plant a lesson later readers trust.
Delegation authority concentrates here — a compromise of the orchestrator inherits the reach of everything it can reach.
A delegated worker inherits the spawner’s trust — a compromised or injected subagent acts with that authority.
A delegated worker inherits the spawner’s trust — a compromised or injected subagent acts with that authority.
A delegated worker inherits the spawner’s trust — a compromised or injected subagent acts with that authority.
Called with no human gate between the agent and the capability. Every tool call is attack surface — scope and type it so the agent cannot widen its own reach at runtime.
Called with no human gate between the agent and the capability. Every tool call is attack surface — scope and type it so the agent cannot widen its own reach at runtime.
Connection concerns
Tool invocation — the capability runs on the source’s behalf.
Tool invocation — the capability runs on the source’s behalf.
Memory write — a poisoning surface; the writer can plant a “lesson” later readers trust.
Memory write — a poisoning surface; the writer can plant a “lesson” later readers trust.
Delegation-trust: the target runs with the source’s authority.
Delegation-trust: the target runs with the source’s authority.
Delegation-trust: the target runs with the source’s authority.
Illustrative governance heuristics computed from the graph you drew — not a scan of a real system and not benchmark numbers. A tool call or egress counts as un-gated unless it originates from a human-in-loop gate node.
What this tool is
- A free, fully in-browser visualizer for a multi-agent / agent-harness topology: add nodes (orchestrator, subagent, tool, memory store, external API/egress, human-in-loop gate) and connections (delegates-to, calls-tool, reads/writes-memory, egresses-to), and see the whole thing as a diagram with a security read. Nothing is uploaded; there are no server calls.
- The diagram is a deterministic, layered node-graph drawn as inline SVG — laid out by longest-path from the orchestrator roots, with no physics or layout library, so the same topology always draws the same way.
- The security read flags the governance concern on every node and edge: an egress node is a data-exfiltration surface, a memory store is a poisoning surface, a delegation is a trust hand-off, and a cycle is a self-modification / change-control concern. It counts egress points, un-gated tool calls and memory writers, and computes a worst-case blast radius.
- Start from a preset — single ReAct agent, orchestrator + subagents, pipeline, recursive self-improving (Harness²-style), or swarm — then edit nodes and connections freely.
- Share the exact topology with a permalink (the whole graph is encoded in the URL hash), export the security read as Markdown, and export the diagram as SVG.
The shape of the system is a governance decision
As soon as a system has more than one agent, the interesting security questions stop being about any single model and start being about the topology: who can delegate to whom, whose memory is writable by whom, how many places data can leave the trust boundary, and whether any path lets the system rewrite its own instructions. Those questions are hard to answer from prose and obvious from a diagram. This visualizer exists to make them obvious — it lays the graph out the same way every time and annotates the parts that carry risk, so a review can argue about the architecture instead of about what the architecture is.
The read is deliberately conservative about three things. An egress point is treated as a data-exfiltration surface and an SSRF target, because that is what an uncontained one is. A memory store with more than one writer, or a writer that is itself a subagent, is treated as a poisoning surface, because a planted “lesson” is trusted by every later reader. And a cycle — any edge that loops back to an ancestor — is flagged as a change-control concern, because a self-improving loop with no human gate can modify its own behavior unreviewed. The blast radius makes the cost concrete: it counts how many downstream nodes a compromise of each orchestrator can reach, and whether that reach touches an egress point or shared memory. The controls that shrink it are the usual ones — scope and type the tools, confine egress to an allow-list in a sandbox, give memory provenance and a TTL, and put a human gate in front of anything privileged.
Frequently asked questions
What is an agent topology, and why visualize it?
An agent topology is the shape of a multi-agent or agent-harness system: which orchestrators delegate to which subagents, what tools and external APIs they call, what memory they share, and where a human sits in the loop. Drawing it makes the security picture legible — you can see at a glance where data can leave the trust boundary, which memory is writable by whom, how far a single compromise reaches, and whether any loop lets the system modify itself. This tool turns a described topology into that diagram plus a heuristic governance read, entirely in your browser.
How does it read a topology for security?
Heuristically and transparently, label by label. Each node type carries a standing concern — an external API/egress node is a data-exfiltration surface and SSRF target, a memory store is poisonable, a subagent inherits the spawner’s trust, an orchestrator concentrates delegation authority, and a human-in-loop gate is the control point. Each connection is read too: a delegation is a trust hand-off, a tool call or egress that does not originate from a human gate is flagged un-gated, a memory write is a poisoning surface, and any edge that closes a cycle is flagged as a self-modification / change-control concern. It then counts egress points, un-gated tool calls and memory writers, lists the trust-boundary crossings, and computes the worst-case blast radius: how many downstream nodes a compromise of each orchestrator can reach, and whether that reach touches an egress point or shared memory.
What do the presets represent?
Five common shapes. Single ReAct agent is one reasoning-and-acting loop with a couple of scoped tools. Orchestrator + subagents is the production fan-out where a planner delegates to specialists over shared memory. Pipeline is a fixed sequence of stages with a human gate before an external publish. Recursive self-improving (Harness²-style) spawns workers, writes evidence-backed lessons to persistent memory and reads them back to reconfigure itself — closing a cycle. Swarm is a flat set of peer agents handing off over a shared blackboard with no single planner. Each is a starting point you can edit.
What is the Harness²-style preset based on?
It is modeled after the self-improving agent-harness idea from Harness² (Google Cloud AI Research and Northwestern University, arXiv 2610.14224), where the winning harness and its evidence-backed lessons persist into an improvement harness that configures the next task — an outer loop that closes a cycle. The preset is an illustrative shape, not a reproduction of the paper’s system or any benchmark result. For a deeper composer of that harness, see the Custom Agent Harness Designer.
Does anything leave my browser?
No. The whole tool is client-side React with inline SVG and static data. There are no network or API calls, no account, and nothing you draw is sent anywhere. The shareable link encodes the entire topology in the URL hash, the Markdown read is built locally, and the SVG export serializes the diagram in the page — all in the browser.