Open Source
Apache 2.0
Trustabl Agent Analyzer
Static analysis for reliable, safe, and production-ready AI agents.
brew install trustabl/tap/trustablscoop bucket add trustabl https://github.com/trustabl/scoop-bucket
scoop install trustabldocker run --rm -v "$PWD:/repo" ghcr.io/trustabl/trustabl:latest scan /repoTHE AGENT RELIABILITY GAP
Your agents work in demos. They break in production.
Most agent code is “vibe coded” — tools with missing schemas, subagents granted dangerous permissions, shell access without guardrails, and no traceability between agents and capabilities.
Trustabl Agent Analyzer brings deterministic, SDK-aware static analysis to the agent layer - the missing foundation for Trust as Code.
9
SDKS SUPPORTED
9 SDKs • 7 languages
0
Runtime required
Pure static • Single binary • Offline
3
Output formats
Human • JSON • SARIF 2.1
100%
Deterministic
Byte-stable scans for reliable CI
WHAT MAKES IT DIFFERENT
Purpose-built for agentic systems
SDK-Aware Analysis
Understands Claude Agent SDK, OpenAI Agents SDK, Google ADK, MCP, LangChain/LangGraph, CrewAI, AutoGen/AG2, Pydantic AI, and Vercel AI.
Full Agent Graph Modeling
Discovers tools, agents, subagents, skills, slash commands, and the relationships between them — not just isolated functions.
Actionable Findings
Every issue includes a clear explanation, suggested remediation, confidence score, and exact code location. No vague warnings.
Per-Tool Readiness Scores
Get a production readiness score for every tool definition. The overall score is breadth-aware and weighted so weak surfaces stand out without one issue zeroing the whole repository.
CI-Native & Deterministic
Byte-stable output, SARIF support, and clear exit codes (0/1/2). Perfect for GitHub Actions, pre-commit hooks, and policy gates.
Single Binary. Zero Dependencies.
No daemon, no server, no cloud. Install via Homebrew, Scoop, Docker, or Go. Runs fully offline after initial rule cache.
HOW IT WORKS
Four steps. Minutes, not days.
01
Scan your repo
Point the analyzer at any agent codebase. It reads your tool definitions, schemas, and implementation files.
02
Analyze findings
Static rules run across every tool, checking for validation gaps, missing retry logic, observability holes, and guardrail issues.
03
Generate report
Get a prioritized report with a Production Readiness Score, severity-ranked findings, and SARIF/JSON/human-readable output.
04
Improve & harden
Run trustabl enrich with your own Anthropic, OpenAI, or Google key to review proposed patches and apply approved fixes. Also works with Claude Code, Codex, Gemini CLI, VS Code, Cursor, and CI.
QUICKSTART
Up and running in seconds
brew install trustabl/tap/trustablscoop bucket add trustabl https://github.com/trustabl/scoop-bucket
scoop install trustabldocker run --rm -v "$PWD:/repo" ghcr.io/trustabl/trustabl:latest scan /repo
Scan
$
trustabl scan ./path/to/agent-repo# local repo
$
trustabl scan https://github.com/org/repo# remote repo
$
trustabl scan ./repo --format json# JSON output
$
trustabl rules pull# update rules
Also available as a GitHub Action · Direct binary download
PRODUCT ROADMAP
Starting with open source. Growing into a full platform.
Trustabl ships the open-source analyzer today and continues to expand rules, integrations, and governance capabilities.
Now
Trustabl Agent Analyzer
OPEN SOURCE
Static analysis, rule-based detection, scoring, SARIF/JSON/human output, GitHub Action ready. Available today on GitHub.
Enrich + developer integrations
AVAILABLE TODAY
Generate reviewed fixes with trustabl enrich using your own Anthropic, OpenAI, or Google key. Available in Claude Code, OpenAI Codex, Gemini CLI, VS Code, Cursor, and CI workflows.
Trustabl Console
Commercial team workflows for policy generation, compliance mapping, and signed governance snapshots.
WHY OPEN SOURCE
Why we're shipping open source first
01
Trust through transparency
Every rule is auditable, forkable, and improvable by the community. No black boxes — see exactly what we check and why.
02
Set the standard early
Establish the de-facto standard for agent reliability analysis before adding paid layers. The community shapes the foundation.
03
No gatekeeping
Every AI engineer and platform team can start hardening agents immediately. Reliability tooling shouldn't be locked behind a paywall.
Ready to make your agents production-grade?
Scan locally, review every finding, and apply approved fixes with your own LLM key.
Questions? Reach out on GitHub Issues or join our waitlist for early platform access.