v0.8.2 — 88% Verified Precision · LGPL v3

The First Security Scanner
Built for AI Agent Code

AgentGuard is a static analysis tool purpose-built for AI agent security. It detects 22 vulnerability classes across 7 frameworks — including 6 novel attack vectors beyond the OWASP ASI Top 10. Every rule maps to CWE. Every finding gets a CVSS score. No other SAST tool does this.

↓ Get Started View on GitHub PyPI ↗
agentguard scan ./langchain
$ pip install dfx-agentguard
$ agentguard . --format sarif | tee results.sarif

{
"findings": 436,
"files_scanned": 1831,
"confirmed": 132,
"severity": {
"critical": 8,
"high": 21,
"medium": 67,
"low": 36
},
"framework": "LangChain 0.3.x",
"top_finding": "ASI07: Hardcoded API key in tools/shell_tool.py:142",
"top_finding": "ASI02: os.system() on user input in tools/python_repl.py:89",
"top_finding": "ASI-MEMORY-POISON: Untrusted upsert in memory/vector_store.py:203",
"precision_verified": true,
"false_positive_rate": "12%"
}
$
7
Frameworks Audited
LangChain, LlamaIndex, AutoGen, CAMEL, CrewAI, Qwen-Agent, Dify
9,000
Files Analyzed
Python, JavaScript, TypeScript, YAML, TOML, JSON
951
CONFIRMED Findings
88% precision · 7 frameworks · 5,605 raw before filtering
88%
Verified Precision
44 TP / 6 FP on independent sample of 50
✓
OWASP ASI Top 10
Full Coverage
⚡
CWE Mapped
Every Rule
★
CVSS Scored
3.1 Calculator
⚙
139 Tests
3.10 / 3.11 / 3.12
LGPL
LGPL v3
Free for OSS
Detection Engine

22 Rules. CWE Mapped. CVSS Scored.

Every rule is backed by a real vulnerability class. Read the formal security specification.

OWASP ASI Top 10 — Full Coverage

ASI01
Prompt Injection
Untrusted input concatenated into LLM prompts via f-strings, format(), template engines. AST taint-tracks from user input to prompt construction.
CWE-77CVSS 8.1
ASI02
Unrestricted Tool Execution
os.system(), subprocess.run(), exec(), eval() on untrusted or agent-generated input. Shell tool middleware without sandboxing.
CWE-94CVSS 9.8
ASI03
Information Disclosure
API keys, bearer tokens, secrets written to log output. Visible to any observer of agent execution. Detects print(), logging, stdout patterns.
CWE-532CVSS 7.5
ASI04
Agent Goal Manipulation
Dynamic prompt templates allow external input to override agent objectives, instructions, and safety constraints.
CWE-912CVSS 8.8
ASI05
Supply Chain Poisoning
Untrusted tool registration from external sources. Dynamic imports. Unpinned dependencies. Unverified pip install in agent code.
CWE-427CVSS 8.6
ASI06
Cross-Agent Interference
Race conditions in shared mutable state between concurrent agents. State corruption via unsynchronized access to global objects.
CWE-362CVSS 7.0
ASI07
Credential Exposure
Hardcoded API keys (sk-, ghp_, AKIA, AIza, xox), private keys, passwords, and connection strings in source and config files.
CWE-798CVSS 9.8
ASI08
Excessive Agency
Agent granted system-level permissions (sudo, filesystem mount, network bind) beyond declared scope. No sandbox isolation.
CWE-250CVSS 8.4
ASI09
Insecure Output Handling
Agent tool outputs consumed without validation. LLM output rendered in HTML/JSX/DOM. Missing sanitization between tool returns and downstream use.
CWE-79CVSS 6.1
ASI10
Unbounded Consumption
Agent operations without rate limits, timeouts, or resource caps. Infinite loops. Recursive calls without depth guards. DoS by design.
CWE-400CVSS 7.5

Novel Rules — Beyond OWASP ASI

Six attack vectors discovered during real codebase audits. These exist in no other SAST tool or security standard.

ASI-MEMORY-POISON
Agent Memory Poisoning
Adversarial content injected into vector databases (Chroma, Pinecone, FAISS, Weaviate). 26 distinct sink patterns. RAG pipeline contamination.
CWE-502CVSS 8.2
ASI-TOOL-TRUST
Blind Tool Output Trust
Agent consumes tool output without verification. A compromised tool injects payloads that pass to downstream operations undetected.
CWE-345CVSS 8.6
ASI-CHAIN-AMPLIFY
Chain Amplification
Destructive operations inside unbounded loops. A single prompt injection triggers infinite destructive execution. 22 confirmed instances in audit.
CWE-834CVSS 7.5
ASI-AGENT-COLLUSION
Multi-Agent Collusion
Coordinated behavior using shared memory, message queues, or filesystem as covert channel. Bypasses individual agent safety constraints.
CWE-265CVSS 6.8
ASI-PROMPT-TEMPLATE
Prompt Template Injection
Injection via Jinja2, f-string, and string.Template in prompt construction. Template rendering on attacker-controlled input before it reaches the LLM.
CWE-74CVSS 8.8
ASI-STEGANO-INJECT
Steganographic Injection
Encoded command injection via base64, hex, ROT13 in tool parameters. Detects decode-execute chains that bypass simple string filters.
CWE-506CVSS 9.0
Independent Validation

88% Precision. Verified. Not Self-Reported.

Precision was measured on 50 findings randomly sampled from 951 CONFIRMED results — completely disjoint from the development sample. Every finding inspected at the source line.

88%
Verified Precision
44 true positives / 6 false positives
50
Independent Sample
Randomly drawn from 951 CONFIRMED
32
FP Patterns Eliminated
Systematic filter — from 36% → 88%
7
Frameworks in Sample
CAMEL, Qwen-Agent, LangChain, CrewAI, AutoGen, LlamaIndex, Dify
ⓘ All 6 remaining FPs traced to a single pattern (def _update_prompts in ASI10). The FP filter has been updated to catch this. Next independent validation round will target 95%+. We publish the real number — not a hand-picked sample.
Sovereign Security Audit 2026

Every Number is Reproducible

Run pip install dfx-agentguard && agentguard . on any of these frameworks and verify for yourself. Full methodology in the Audit Report.

FrameworkTypeFilesRaw FindingsCONFIRMEDRisk Score
DifyLLM Platform2,0301,68721612,570
CrewAIRole-Based Agent1,0421,317996,392
LlamaIndexData Framework2,9511,0802946,341
AutoGenMulti-Agent553696982,696
LangChainAgent Framework1,8314361322,653
Qwen-AgentAssistant238242501,325
CAMELMulti-Agent35514762946
TOTAL—9,0005,60595132,923

5,605 total raw findings across 7 frameworks (pre-filtering). Classification tiers: CONFIRMED (high-confidence true positive) · INVESTIGATE (needs manual review) · BEST_PRACTICE (advisory) · LIKELY_FP (filtered).

Active Disclosures

Real Vulnerabilities. Real Impact.

Found in production code. 3 GitHub Security Advisories (GHSAs) filed against LangChain + 2 technical issues reported to AutoGen. All through responsible disclosure.

GHSA · CVSS 10.0
Unrestricted Host Command Execution
LangChain · ShellToolMiddleware
GHSA · Awaiting maintainer response
GHSA · CVSS 8.6
Tool Registration Without Validation
LangChain · Tool Registry
GHSA · In triage
GHSA · CVSS 7.8
Agent Memory Store Injection
LangChain · Vector Store
GHSA · In triage
Also Reported to AutoGen
Additionally, 2 GitHub Issues filed with AutoGen (not GHSAs — these are public technical reports): #7917 — Unrestricted Tool Execution and #7918 — Credential Exposure via Agent Logging. Active technical discussion with the AutoGen team.

Additional tools (MCP Scanner, GitHub App, VS Code extension) in development.

Get Started

Three Ways to Run AgentGuard

🛡️ Pre-commit Hook
pip install dfx-agentguard
agentguard install --pre-commit

Blocks insecure agent code at commit time. Works with any Git repository. Zero CI config.

🐳 Docker
docker run --rm \
  -v $(pwd):/workspace \
  ghcr.io/dockfixlabs/agentguard \
  .

Zero-install. Works in any CI/CD pipeline. ghcr.io published on every release.

⚡ GitHub Action
- uses: dockfixlabs/agentguard@v0.8.2
  with:
    path: .
    format: sarif

Native GitHub Code Scanning integration. SARIF auto-uploads. PR annotations.