Trust, but Verify the Network: Social-Graph Analysis for Safer Agent-to-Agent Transactions

Agents are starting to call, pay, and rely on other agents, but how does an agent decide whom to trust before it transacts? Capability and endpoint scoring can tell you whether a single MCP server claims to be good. It can't tell you whether the network around that agent behaves like a trustworthy actor or like a coordinated, Sybil, or prompt-injection-amplifying cluster.

MoltWatch is an MIT-licensed Python toolkit that applies Social Network Analysis to AI agent interaction graphs for security threat detection. Which agents are coordinating inauthentic behaviour? If a prompt injection reaches a high-centrality agent, what's the blast radius across the network? Is a given agent operating autonomously, or is a human pulling the strings? These questions are invisible to content analysis, the attack only shows up in the graph.

This talk introduces MoltWatch, an open-source toolkit that applies Social Network Analysis, the same techniques used to study human communities, to AI-agent social networks. Using Neo4j Graph Data Science, a Python pipeline, and an MCP server that exposes graph algorithms as conversational tools. Dashboard on React + Sigma.js (WebGL). Entire stack is FOSS: Neo4j Community Edition, Python, MCP SDK, Sigma.js, Docker Compose.

Live demos on the MoltGraph dataset (11,874 agents, 162,024 temporal edges): CoV temporal classification and blast radius simulation via MCP. You'll leave with a concrete model for a network-behaviour trust layer that complements endpoint scoring, a forkable MCP server for your own agent security analysis, and a reproducible method for explaining why a trust score changed, not just that it did.

OWASP's Top 10 for Agentic Applications (December 2025) lists six risks detectable through graph analysis, goal hijacking, agent-to-agent communication attacks, memory poisoning, cascading failures, rogue agents, tool misuse. MoltWatch covers all six.

Project: github.com/iamakash-06/moltwatch (MIT License)

• A new attack surface most security teams haven't modelled: agent interaction graphs are unmonitored. MoltWatch is an open-source toolkit that treats them as a threat intelligence surface.

• One formula to audit agent autonomy: Coefficient of Variation of inter-post intervals separates autonomous agents from human-operated proxies at 87%+ accuracy. No model training required.

• Blast radius before the cascade: simulate prompt injection propagation before it spreads, identify high-risk bridge agents, and set monitoring priorities based on graph position.

• Why content moderation misses these attacks entirely: coordinated campaigns and prompt injections are invisible in individual outputs. They only show up in the graph.

• A forkable foundation for agent security research: MoltWatch's Neo4j schema, MCP server, and analysis modules are designed to be extended. Build new detectors, add data sources, publish research on top.