SafeAI
A static analysis and attack-surface scanner for AI agents that maps an agent's tool access, prompt risks, and MCP integrations from source code, then turns material authority changes into CI/CD pass, review, or block decisions.
SafeAI statically scans AI application source code to build an evidence-backed model of what an agent can actually do: which tools, MCP servers, filesystems, shell access, databases, APIs, destinations, memory, and delegation it has, and what autonomy and approval controls exist. It never executes the agent or calls a language model itself, and by default performs no network activity except through explicitly enabled commands such as posting a pull-request comment.
Its three functions are discovering an agent's current authority, comparing that authority against an approved baseline to find changes such as a new tool, a permission widening from read to write, or a removed approval gate, and making a deterministic pass, review-required, block, or accepted-exception decision for CI/CD based on those changes. The project frames this as visibility into agent authority before deployment, not a runtime guardrail or a certification that an agent is safe.