{"slug": "900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool", "title": "900+ Downloads, 1 Star, 1 Comment: What I Learned Launching a Security Tool", "summary": "Dockfix Labs launched AgentGuard, an open-source static analysis tool for AI agent security, and analyzed its early traction. The tool received 920 downloads on PyPI with only 1 star and 1 comment, highlighting the challenge of building trust for new open-source projects. Key lessons include the importance of Dev.to for developer engagement, OWASP ASI Top 10 positioning, and the need for CI/CD integration from day one.", "body_md": "Two weeks ago I launched [AgentGuard](https://github.com/dockfixlabs/agentguard), an open-source static analysis tool for AI agent security. Here is what the data says.\n\n**PyPI discoverability is real.** The `pip install`\n\nflow means people find the package through PyPI search, not just GitHub. 920 downloads with 1 star means the conversion from \"found it\" to \"starred it\" is low, but the install-to-star ratio is normal for developer tools.\n\n**Dev.to drives traffic.** The \"Beyond Regex\" technical deep-dive got 44 views -- the most of any article. Developers want technical depth, not marketing. The MCP security guide got a real comment from a peer building a complementary tool.\n\n**OWASP ASI Top 10 is a strong positioning.** Nobody else covers all 10 categories in an open-source tool. That differentiation matters.\n\n**Awesome-list PRs are slow.** Two PRs submitted, both mergeable, neither merged after a week. Maintainers of these lists have their own priorities. Not a failure, just patience required.\n\n**Zero community contributions.** No PRs from external contributors. The good-first-issues are there (Go support, Java support) but nobody has picked them up. The project needs more visibility before contributors arrive.\n\n**The 0-stars problem is self-reinforcing.** Developers check star counts before trying a tool. 1 star does not signal \"trusted.\" This is the hardest loop to break for new open-source projects.\n\n**Launch with a comparison table.** AgentGuard vs. Semgrep vs. CodeQL for AI agent security. Developers want to know \"why not just use Semgrep?\" before they install anything.\n\n**Ship the GitHub Action on day one.** The `action.yml`\n\nwas added in v0.3.4 -- two weeks late. CI/CD integration is the #1 thing developers look for in a security tool.\n\n**Write a \"how to break an AI agent\" post first.** Show the vulnerability, then the tool. The MCP security guide performed best because it led with the problem, not the product.\n\nThe biggest engineering mistake was **scanning my own code**. AgentGuard's regex rules match patterns like `eval\\(`\n\nand `os\\.system`\n\n-- which appear in the rule definitions themselves. First self-scan: 94 findings, 69 critical. All false positives.\n\nThe fix: skip the `rules/`\n\ndirectory and test files by default. Add `--include-tests`\n\nfor explicit test scanning. Self-scan went from 94 to 2 (acceptable patterns in setup.py).\n\nLesson: **your security tool should be able to scan itself without screaming.** If it cannot, users will not trust it on their code either.\n\nThe next milestone is **AST-based taint tracking** (v0.4.0). Regex gets you 100% on a curated benchmark, but real codebases have patterns regex cannot see:\n\n```\n# Regex cannot track this\ntemplate = \"Answer: {input}\"\nprompt = template.format(input=user_data)\n```\n\nThis requires parsing the AST, tracking variable assignments, and following data flow from sources to sinks. Same approach as Semgrep and CodeQL, but specialized for LLM-specific sinks (`openai.chat.completions.create`\n\n, `messages`\n\n, `prompt`\n\n).\n\nIf you want to follow along or contribute: [github.com/dockfixlabs/agentguard](https://github.com/dockfixlabs/agentguard)\n\n*AgentGuard is MIT-licensed. Install with pip install dfx-agentguard.*", "url": "https://wpnews.pro/news/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool", "canonical_source": "https://dev.to/dockfixlabs/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool-1pc5", "published_at": "2026-06-30 22:40:08+00:00", "updated_at": "2026-06-30 22:48:41.592870+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools"], "entities": ["AgentGuard", "Dockfix Labs", "PyPI", "Dev.to", "OWASP", "Semgrep", "CodeQL", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool", "markdown": "https://wpnews.pro/news/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool.md", "text": "https://wpnews.pro/news/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool.txt", "jsonld": "https://wpnews.pro/news/900-downloads-1-star-1-comment-what-i-learned-launching-a-security-tool.jsonld"}}