Looking for contributors and reviewers: SafeAI, an Apache-2.0 static analyzer for AI-agent risk and capabilities

Reddit r/AI_Agents Tools
static-analysis ai-agents open-source security mcp dev-tools

Summary

SafeAI is an Apache-2.0 static analyzer for AI-agent applications that scans source and configuration for capabilities, risks, tools, MCP integrations, secrets, and governance signals, producing a versioned KYA manifest and CI gating. The author is seeking contributors and reviewers.

Before merging or deploying an agent, can a team quickly see what capabilities it declares, what tools it binds, which MCP integrations it uses, and what changed since the last approved version? I’ve been building SafeAI, an Apache-2.0 static analyzer for AI-agent applications. The latest beta adds a local-first KYA — Know Your Agent workflow. A normal scan now produces: Static findings for agent capabilities, prompt risks, tools, memory, MCP configuration, secrets, and governance signals safeai-manifest.json, a versioned portable KYA artifact Stable finding fingerprints, confidence, provenance, remediation guidance, and finding lifecycle states Baseline comparison and --fail-on-new CI gating SARIF, JSON, HTML, and terminal reports A local SQLite registry at .safeai/registry.db The important boundary: this is static source/configuration evidence, not a claim about deployed permissions, live runtime behaviour, or compliance. It does not run agents, call LLMs, upload source, or require a server/account. Feedback and contributions are welcome at GitHub/SafeAI
Original Article

Similar Articles

Open Code Review – An AI-powered code review CLI tool

Hacker News Top

Alibaba has open-sourced Open Code Review, an AI-powered CLI tool for code review that combines deterministic engineering with LLM agent capabilities. Originally an internal tool serving tens of thousands of developers and identifying millions of defects, it reads Git diffs and produces structured, line-level review comments using a configurable model endpoint.