Static security scanner for AI agents
Catch infinite loops, token bombing, and prompt injection before deployment

curl -fsSL https://inkog.io/install.sh | sh

Other methods:

# Get your API key at https://app.inkog.io
export INKOG_API_KEY=sk_live_your_key_here

# Scan your agent code
inkog .

Comprehensive detection for:

• OWASP LLM Top 10 — Prompt injection, insecure output handling, and more
• OWASP Agentic Security — Tool misuse, identity spoofing, resource overload
• EU AI Act — Article 12, 14, 15 compliance checks
• Governance Violations — AGENTS.md manifest validation

View vulnerability patterns →

Code-First: LangChain · LangGraph · CrewAI · AutoGen · OpenAI Agents · Semantic Kernel · Azure AI Foundry · LlamaIndex · Haystack · DSPy · Phidata · Smolagents · PydanticAI · Google ADK

No-Code: n8n · Flowise · Langflow · Dify · Microsoft Copilot Studio · Salesforce Agentforce

- uses: inkog-io/inkog@v1
  with:
    api-key: ${{ secrets.INKOG_API_KEY }}
    sarif-upload: true

Full GitHub Action docs →

Filter findings by security policy:

# Low noise - only proven vulnerabilities
inkog . --policy low-noise

# Governance-focused (Article 14 controls)
inkog . --policy governance

# EU AI Act compliance
inkog . --policy eu-ai-act

Learn more about policies →

Native integration for AI coding assistants. Scan agent code directly from Claude, ChatGPT, or Cursor.

npx -y @inkog-io/mcp

7 Security Tools:

• inkog-scan - Vulnerability scanning
• inkog-explain - Remediation guidance
• inkog-governance - AGENTS.md verification
• inkog-compliance - EU AI Act, NIST, OWASP reports
• inkog-mlbom - ML Bill of Materials
• inkog-mcp-audit - First tool to audit MCP servers for security before installation
• inkog-a2a-audit - Multi-agent security - Detect infinite delegation loops, privilege escalation in CrewAI, Swarm, LangGraph

Multi-Agent Security (A2A): For topology analysis and agent delegation auditing, use the MCP server integration. Ask your AI assistant: "Audit my CrewAI agents for security issues" or "How many agents are in my LangGraph workflow?"

MCP Integration Docs → | A2A Security Tutorial →

• CLI Reference
• MCP Server Integration
• Vulnerability Patterns
• GitHub Action
• AGENTS.md Governance

See CONTRIBUTING.md

Apache 2.0 — See LICENSE