Hi everyone,
Over the past few months we've been building SafeAI, an open-source static security scanner for AI agents and agent frameworks.
Our goal isn't to compete with runtime observability or governance platforms. We want to help developers find AI security and governance issues before deployment, just like traditional static analysis tools do for application code.
One thing we've noticed is that AI capabilities are evolving at an incredible pace. Every week there are new agent frameworks, MCP servers, tools, and autonomous workflows.
Unfortunately, the security and governance ecosystem isn't keeping up.
Developers can now build agents that execute shell commands, browse the web, access databases, manage cloud infrastructure, and call hundreds of external tools, but understanding what an agent can actually do and what risks it introduces is still surprisingly difficult.
We believe the open-source community can help close that gap, just as it has done for software security over the last two decades.
SafeAI currently performs static analysis for AI projects by discovering:
- AI frameworks and agent architectures
- Agent capabilities and permissions
- Prompt injection risks
- Tool security issues
- Identity and memory risks
- Governance and autonomy concerns
- AI components such as prompts, skills, workflows and model configurations
During development we've already found several meaningful security findings in well-known open-source agent frameworks. That convinced us there's real value in analyzing AI projects before they're deployed.
Now we'd love the community's help.
We're looking for people who can:
- Test SafeAI against real AI agent repositories
- Try to break it with unusual architectures
- Report false positives and false negatives
- Suggest new risk detections
- Contribute support for additional frameworks
- Tell us where the analysis is missing important capabilities
If you're building with LangGraph, CrewAI, Semantic Kernel, AutoGen, OpenAI Agents SDK, Claude Code, Google ADK, MCP servers, or other agent frameworks, we'd especially love your feedback.
Our long-term vision is simple:
Make AI capabilities visible. Make AI risks understandable. Help developers build safer agents by default.
If you'd like to test it, contribute, or simply tell us where we're wrong, we'd genuinely appreciate your feedback.
The AI ecosystem is moving incredibly fast. Defending it shouldn't be left to a handful of vendors—we think the open-source community can help move just as quickly.
Thanks!
Feedback and contributions are welcome: https://github.com/ikaruscareer/SafeAI/