Back to packageRELEASE DETAILS

0.1.0

PyPI

agentgov-scanner

Discover AI agents, map their capabilities, and flag security risk. Read-only static analysis.

Published10 Sept 2026

Direct dependencies1

Transitive dependenciesNot calculated

README

Version 0.1.0 documentation

AgentGov Scanner

Read-only static analysis that discovers AI agents across frameworks, maps each agent's tools into a capability graph, and produces an evidence-backed risk register. Never imports or executes the code it scans.

Zero runtime dependencies (Python stdlib only). Python 3.10+.

Frameworks

Framework	Agents recognised	Tools recognised
MCP	`FastMCP(...)`, `Server(...)`	`@mcp.tool` / `@server.tool()`
LangChain	`AgentExecutor`, `create_*_agent`, `initialize_agent`	`@tool`
CrewAI	`Agent(role=..., llm=...)`	`@tool`
OpenAI	`assistants.create(...)` (synthetic)	function schemas `{"type":"function",...}`

Rules

ID	Severity	What
AGT001	critical	Tool parameter reaches a shell / code-exec call
AGT002	high	Tool parameter reaches an outbound HTTP call (SSRF)
AGT003	high	Tool parameter reaches a filesystem call (path traversal)
AGT004	medium	Tool description advertises unbounded capability
AGT005	medium	Tool parameter not constrained by the generated input schema
AGT010	critical	Tool carries a hardcoded secret
AGT020	high/med	Tool exposes a destructive/financial/send/deploy capability with no approval gate

Use

pip install agentgov-scanner
agentgov path/to/repo                 # terminal risk register
agentgov path/to/repo --format json   # machine form: inventory + graph + findings
agentgov path/to/repo --format markdown > report.md
agentgov path/to/repo --fail-on high  # exit 1 if any high+ finding (CI gate)

Exit codes: 0 clean, 1 findings at/above --fail-on, 2 usage error.

Develop

cd scanner
python3 -m venv .venv && .venv/bin/pip install pytest
.venv/bin/python -m pytest -q

Lineage

The engine is lifted from mcpscan (taint tracking, dataflow rules, report) and oiscan (secret patterns), widened from "one MCP server" to "agents across frameworks". See the root CLAUDE.md.

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 1

Native requirements

1 direct targetsNot calculated transitive count

Package / target	Requirement	Relationship
pytest Environment { "extras": "", "marker": "extra == \"dev\"", "requires_python": ">=3.10", "evaluation": "NOT_EVALUATED" }	`pytest>=7; extra == "dev"`	runtime