SafeAI – Open-Source Static AI Risk Analyzer for AI Agents

SafeAI is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.

🌐

[safeai-analyzer.ikaruscareer.com]— project landing page

Traditional application security tools (SAST, SCA, IaC scanning) are not designed for AI agent systems. AI applications introduce new risk surfaces:

Prompt injection— untrusted input flows into model prompts** Agent tool misuse**— agents with filesystem, shell, or database access** Capability sprawl**— frameworks expose capabilities without visibility** MCP exposure**— Model Context Protocol endpoints and tools** Governance gaps**— missing authentication, permissions, audit trails

SafeAI fills this gap by analyzing frameworks, agents, tools, capabilities, and MCP integrations at rest—before deployment.

SafeAI analyzes AI applications without executing them, helping developers discover capabilities, identify potential risks, and improve governance early in the software lifecycle.

Designed to be lightweight, explainable, and community-driven, SafeAI aims to become an open foundation for AI capability and risk analysis.

SafeAI sits before runtime guardrails and red-teaming tools in the security lifecycle. It scans agent source code at commit time — detecting framework-specific capabilities, MCP misconfigurations, and prompt injection patterns — before you ever deploy an agent to staging. It does not replace runtime tools (Microsoft AGT), evaluation frameworks (LangSmith, DeepEval), or red-teaming scanners (Promptfoo, Garak). It complements them: find the risk in code first, then validate at runtime.

Source Code
    │
    ▼
Framework Detection — identifies AI frameworks via imports, configs, deps
    │
    ▼
Static Analysis — AST parsing, capability patterns, dependency scanning
    │
    ▼
Capability Mapping — maps framework objects to normalized risk categories
    │
    ▼
Risk Rules — applies rule engine with configurable severity and weights
    │
    ▼
Trust Score — deterministic category-weighted scoring from 0–100
    │
    ▼
Reports — terminal, JSON, SARIF, HTML

LangGraph— detectsStateGraph

,add_edge

,bind_tools

, nodes, modelsCrewAI— detectsAgent

,Task

, tools, modelsLangChain— detectsAgentExecutor

,Chain

,Tool

,PromptTemplate

, modelsSemantic Kernel— detectsKernel.invoke

, plugins, functions, skills, memoryOpenAI Agents SDK— detectsAgent

, tools, handoffs, MCP referencesMicrosoft Agent Framework— detectsAgentClient

, tools, workflows, Azure modelsAzure AI Foundry— detects YAML configurations with Azure resources** Bedrock Agent**— detects JSON configurations with Bedrock resources

SafeAI fingerprints capabilities at the framework object level and via fallback regex patterns. Each capability includes evidence, confidence score, resolved definition, and provenance.

Note:Some capabilities (Browser, GitHub, Slack, Email, RAG, Human Approval) are detected primarily through MCP configuration analysis. Framework adapter detection for these capabilities is planned.

• Python 3.11 or 3.12
• PyYAML (for YAML configuration parsing)

git clone https://github.com/ikaruscareer/SafeAI.git
cd SafeAI
pip install -e .
pip install -e ".[dev]"
python -m safeai scan <directory> [options]

SafeAI Scan Summary
Files: 12
Frameworks: langgraph, crewai
MCP assets: 2
Overall AI Risk Score: 73
critical: 1
high: 3
medium: 5
Findings:
[critical] app.py:10 - Untrusted input interpolated into prompt
[high] app.py:22 - Capability detected: shell_execution
[high] mcp.json:1 - MCP configuration does not define authentication
{
  "Framework": "LangGraph",
  "Capabilities": ["Planner", "Memory", "Filesystem", "MCP"],
  "Risk Score": 73,
  "Findings": 9,
  "Critical": 1,
  "High": 3
}

A workflow is included at .github/workflows/ci.yml

. To use in your project:

jobs:
  safeai-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install SafeAI
        run: |
          pip install -e .
      - name: Run scan
        run: |
          python -m safeai scan . --sarif results.sarif --html report.html
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
safeai-scan:
  image: python:3.12
  script:
    - pip install -e .
    - safeai scan . --sarif results.sarif --html report.html
  artifacts:
    paths:
      - results.sarif
      - report.html
- task: PythonScript@0
  inputs:
    scriptSource: 'inline'
    script: |
      import subprocess
      subprocess.run(["pip", "install", "-e", "."])
      subprocess.run(["safeai", "scan", ".", "--sarif", "$(Build.ArtifactStagingDirectory)/results.sarif"])

SafeAI outputs SARIF 2.1.0 format, compatible with GitHub Advanced Security, Azure DevOps, and other SARIF-compliant tools.

See ROADMAP.md for the detailed roadmap covering all 5 phases:

Phase 1— Static AI Risk Scanner (OSS) —in active developmentPhase 1.5— AI Component Security** Phase 2**— AI Security Testing (optional future)** Phase 3**— Test Packs** Phase 4**— Enterprise (Commercial)** Phase 5**— Community Intelligence

SafeAI is released under the Apache 2.0 License.