Open Source Apache 2.0

Trustabl Agent Analyzer

Static analysis for reliable, safe, and production-ready AI agents.

View on GitHub

Install & Scan in 60 seconds

Trusted by forward-deployed AI engineers & platform teams

brew install trustabl/tap/trustabl

scoop bucket add trustabl https://github.com/trustabl/scoop-bucket
scoop install trustabl

docker run --rm -v "$PWD:/repo" ghcr.io/trustabl/trustabl:latest scan /repo

THE AGENT RELIABILITY GAP

Your agents work in demos. They break in production.

Most agent code is “vibe coded” — tools with missing schemas, subagents granted dangerous permissions, shell access without guardrails, and no traceability between agents and capabilities.

Trustabl Agent Analyzer brings deterministic, SDK-aware static analysis to the agent layer - the missing foundation for Trust as Code.

Major SDKs supported

Claude • OpenAI • Google ADK • MCP

Runtime required

Pure static • Single binary • Offline

Output formats

Human • JSON • SARIF 2.1

100%

Deterministic

Byte-stable scans for reliable CI

WHAT MAKES IT DIFFERENT

Purpose-built for agentic systems

SDK-Aware Analysis

Understands the specific idioms of Claude Agent SDK, OpenAI Agents SDK, Google ADK, and MCP. Rules only apply where they make sense.

Full Agent Graph Modeling

Discovers tools, agents, subagents, skills, slash commands, and the relationships between them — not just isolated functions.

Actionable Findings

Every issue includes a clear explanation, suggested remediation, confidence score, and exact code location. No vague warnings.

Per-Tool Readiness Scores

Get a production readiness score for every tool definition. Overall score is the minimum across your inventory — surfaces the weakest links.

CI-Native & Deterministic

Byte-stable output, SARIF support, and clear exit codes (0/1/2). Perfect for GitHub Actions, pre-commit hooks, and policy gates.

Single Binary. Zero Dependencies.

No daemon, no server, no cloud. Install via Homebrew, Scoop, Docker, or Go. Runs fully offline after initial rule cache.

HOW IT WORKS

Four steps. Minutes, not days.

Scan your repo

Point the analyzer at any agent codebase. It reads your tool definitions, schemas, and implementation files.

Analyze findings

Static rules run across every tool, checking for validation gaps, missing retry logic, observability holes, and guardrail issues.

Generate report

Get a prioritized report with a Production Readiness Score, severity-ranked findings, and SARIF/JSON/human-readable output.

Improve & harden

Use findings to guide manual fixes today. Free automated remediation via VS Code, Cursor, and Skill.md is coming soon.

QUICKSTART

Up and running in seconds

brew install trustabl/tap/trustabl

scoop bucket add trustabl https://github.com/trustabl/scoop-bucket
scoop install trustabl

docker run --rm -v "$PWD:/repo" ghcr.io/trustabl/trustabl:latest scan /repo

Scan

trustabl scan ./path/to/agent-repo

# local repo

trustabl scan https://github.com/org/repo

# remote repo

trustabl scan ./repo --format json

# JSON output

trustabl rules pull

# update rules

Also available as a GitHub Action · Direct binary download

Trustabl Agent Analyzer

Your agents work in demos. They break in production.

Purpose-built for agentic systems

Four steps. Minutes, not days.

Up and running in seconds

Starting with open source. Growing into a full platform.

Why we're shipping open source first

Ready to make your agents production-grade?