With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

With traditional applications, we have established CI/CD checks for things like vulnerabilities, dependencies, secrets and infrastructure.

But what about the agent itself?

Do you have specific AI-agent security checks in your CI/CD pipeline, or are you relying on the same checks you use for ordinary applications?

Before deploying an agent, do you know:

• What tools it can access?
• Whether it gained a new capability in the latest PR?
• If it can execute shell commands or write to the filesystem?
• Which MCP servers it can reach?
• ..

I'm curious how teams are answering these questions today.

We're experimenting with SafeAI as a GitHub Action to bring this kind of static analysis into the existing CI workflow. It's still early stage but going fast, thanks to all contributors.

If you want to try it against your own agent project, we'd genuinely appreciate feedback, as well as contributions.

Here you may check: ikaruscareer/SafeAI on GitHub.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

We've become pretty comfortable putting conventional applications through CI:

• dependency scanning
• SAST
• CodeQL
• secret scanning
• container scanning
• IaC checks
• security policies ...

But what happens when the application being deployed is an AI agent? That may not look particularly interesting in a conventional code diff. But from a security perspective, it could be a significant change.

I'm experimenting with a different CI question:

“What capabilities changed in this PR?”

--

We've implemented an early version of this approach in an open-source static analyzer and connected it to GitHub Actions. (ikaruscareer/SafeAI at GitHub)

The scanner runs locally against the repository and doesn't execute the agent or send the source to a remote service.

I'm curious how other teams approach this.

It is now ready to use and for your reviews.

TL;DR: SafeAI now runs automated security scans on every push/PR with a new Community Scan programme that reads major AI frameworks (LangChain, CrewAI, LlamaIndex, etc.) without touching their code.

SafeAI: Static AI Agent Risk Analyzer for AI applications. Offline-first. No telemetry. No SaaS backend.

What we shipped

GitHub Actions CI/CD

• Full CI/CD pipeline with automated scans on every push/PR
• CodeQL, dependency review, and security hardening workflows enabled
• Pinned action versions and hash-locked dependencies for supply-chain security
• PR comments that show capability escalations in plain English (e.g., "MCP server invoice-lookup: read → mutate")

Community Scan Programme

• 5-target allowlist: n8n, LangChain, CrewAI, LlamaIndex, LangGraph
• Read-only matrix scan — resolves refs to pinned SHAs, no external publication
• Deterministic 0–10 scorecard with JSON/Markdown/GitHub summary outputs
• Hardened sanitization: strips javascript: URIs, escapes Markdown, truncates to 280 chars, redacts secrets from paths

Security hardening

• Exact security-policy hostname matching (no prefix substring matches)
• No Authorization header sent to HTML pages
• --fail-on-missing-policy enforced for manifest validation
• Concurrency groups + timeout-minutes on all workflows
• Private vs public artifact separation in CI outputs

Why this matters

SafeAI is the static AI agent risk analyzer that:

• Detects capabilities, prompt risks, tool permissions, MCP integrations, governance gaps, and autonomy before deployment
• Generates JSON, HTML, and SARIF reports for CI/CD
• Operates entirely offline — no LLM calls, no cloud services, no source upload
• Provides deterministic finding identities and baseline/PR-focused gating

Try it

pip install safeai
safeai scan /path/to/your/ai/project --json report.json --html report.html

GitHub Actions:

text- uses: ikaruscareer/SafeAI@v1.6.0
  with:
    scorecard: true
    scorecard-summary: true
    scorecard-fail-under: 7

Repo: ikaruscareer/SafeAI at GitHub

Hi everyone,

Over the past few months we've been building SafeAI, an open-source static security scanner for AI agents and agent frameworks.

Our goal isn't to compete with runtime observability or governance platforms. We want to help developers find AI security and governance issues before deployment, just like traditional static analysis tools do for application code.

One thing we've noticed is that AI capabilities are evolving at an incredible pace. Every week there are new agent frameworks, MCP servers, tools, and autonomous workflows.

Unfortunately, the security and governance ecosystem isn't keeping up.

Developers can now build agents that execute shell commands, browse the web, access databases, manage cloud infrastructure, and call hundreds of external tools, but understanding what an agent can actually do and what risks it introduces is still surprisingly difficult.

We believe the open-source community can help close that gap, just as it has done for software security over the last two decades.

SafeAI currently performs static analysis for AI projects by discovering:

• AI frameworks and agent architectures
• Agent capabilities and permissions
• Prompt injection risks
• Tool security issues
• Identity and memory risks
• Governance and autonomy concerns
• AI components such as prompts, skills, workflows and model configurations

During development we've already found several meaningful security findings in well-known open-source agent frameworks. That convinced us there's real value in analyzing AI projects before they're deployed.

Now we'd love the community's help.

We're looking for people who can:

• Test SafeAI against real AI agent repositories
• Try to break it with unusual architectures
• Report false positives and false negatives
• Suggest new risk detections
• Contribute support for additional frameworks
• Tell us where the analysis is missing important capabilities

If you're building with LangGraph, CrewAI, Semantic Kernel, AutoGen, OpenAI Agents SDK, Claude Code, Google ADK, MCP servers, or other agent frameworks, we'd especially love your feedback.

Our long-term vision is simple:

Make AI capabilities visible. Make AI risks understandable. Help developers build safer agents by default.

If you'd like to test it, contribute, or simply tell us where we're wrong, we'd genuinely appreciate your feedback.

The AI ecosystem is moving incredibly fast. Defending it shouldn't be left to a handful of vendors—we think the open-source community can help move just as quickly.

Thanks!

Feedback and contributions are welcome: github/ikaruscareer/SafeAI/

Hi everyone,

Over the past few months we've been building SafeAI, an open-source static security scanner for AI agents and agent frameworks.

Our goal isn't to compete with runtime observability or governance platforms. We want to help developers find AI security and governance issues before deployment, just like traditional static analysis tools do for application code.

One thing we've noticed is that AI capabilities are evolving at an incredible pace. Every week there are new agent frameworks, MCP servers, tools, and autonomous workflows.

Unfortunately, the security and governance ecosystem isn't keeping up.

Developers can now build agents that execute shell commands, browse the web, access databases, manage cloud infrastructure, and call hundreds of external tools, but understanding what an agent can actually do and what risks it introduces is still surprisingly difficult.

We believe the open-source community can help close that gap, just as it has done for software security over the last two decades.

SafeAI currently performs static analysis for AI projects by discovering:

• AI frameworks and agent architectures
• Agent capabilities and permissions
• Prompt injection risks
• Tool security issues
• Identity and memory risks
• Governance and autonomy concerns
• AI components such as prompts, skills, workflows and model configurations

During development we've already found several meaningful security findings in well-known open-source agent frameworks. That convinced us there's real value in analyzing AI projects before they're deployed.

Now we'd love the community's help.

We're looking for people who can:

• Test SafeAI against real AI agent repositories
• Try to break it with unusual architectures
• Report false positives and false negatives
• Suggest new risk detections
• Contribute support for additional frameworks
• Tell us where the analysis is missing important capabilities

If you're building with LangGraph, CrewAI, Semantic Kernel, AutoGen, OpenAI Agents SDK, Claude Code, Google ADK, MCP servers, or other agent frameworks, we'd especially love your feedback.

Our long-term vision is simple:

Make AI capabilities visible. Make AI risks understandable. Help developers build safer agents by default.

If you'd like to test it, contribute, or simply tell us where we're wrong, we'd genuinely appreciate your feedback.

The AI ecosystem is moving incredibly fast. Defending it shouldn't be left to a handful of vendors—we think the open-source community can help move just as quickly.

Thanks!

Feedback and contributions are welcome: github/ikaruscareer/SafeAI