wtf is safeai?

SafeAI is a security scanning tool built specifically for AI agent applications, the kind of software that lets an AI model take actions like running commands, accessing files, or calling databases. Regular code security scanners were not built with these systems in mind, so they miss risks that are unique to AI agents, such as untrusted text being fed into a model's prompt, or an agent quietly gaining access to a shell, a filesystem, or an external service without anyone noticing. The tool works by reading through a project's source code without ever running it or calling any AI model itself. It looks for signs that a project is using one of eight supported AI agent frameworks, including LangGraph, CrewAI, LangChain, and a few others, then maps out what capabilities each agent has, like shell access, database access, or the ability to hand off tasks to other agents. It also checks for common Model Context Protocol setup mistakes and scans prompt-handling code for injection style patterns and other risky behaviors. Along the way it flags hardcoded secrets, tokens, and API keys sitting in the code. Every finding gets sorted into one of several risk categories and combined into an overall trust score, so a team can see at a glance how risky an AI application is before it ever reaches production. Reports can be viewed in the terminal, or exported as JSON, SARIF, or HTML, and the tool is built to slot into CI/CD pipelines, so a check can run automatically every time code is pushed. The project positions itself as a step that happens early, at commit time, working alongside other tools that test AI systems while they are actually running, rather than replacing them. Support for each framework currently ranges from full detection down to partial or minimal capability analysis, and the project notes this is still an early preview. Installing it requires Python 3.11 or 3.12, and it can be installed straight from the source code with pip, then run as a command line scan against any project directory.