Guardana CLI
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
- 212 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Active checks send real adversarial requests to the chosen endpoint and can cost money or trigger provider abuse detection
- Reads models, code and agent traces that can contain secrets and personal data
- With `--reporter server://` it sends results to the chosen collector
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/guardanaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Active checks send real adversarial requests to the chosen endpoint and can cost money or trigger provider abuse detection
- Reads models, code and agent traces that can contain secrets and personal data
- With `--reporter server://` it sends results to the chosen collector
This is third-party code. Review the repository files before installing.
What it does
Guardana is a command-line tool for security and platform engineers. It works outside the request path: it is not an inline filter, a general code scanner or a compliance certification. Output is split into what it found, what it could not verify and what it could not check, and the absence of findings is not passed off as a clean result. The `guardana scan` command statically checks models and code with no network and no model: dangerous pickle operations, `torch.load` calls without `weights_only=True`, remote-code configs, dependencies and secrets. `guardana probe` sends test requests to a live endpoint, an MCP server or an A2A agent. `guardana analyze-trace` examines a recorded agent run, `guardana diff` compares two saved runs, and `guardana import-observations` accepts garak and promptfoo results marked as unverified. It ships 58 rules, 19 for artifacts and 39 for runtime. They map to the OWASP LLM Top 10, OWASP lists for agentic applications and MCP, MITRE ATLAS and NIST AI 100-2e2025. Reports come out as SARIF, JSON, JUnit and text, and the exit code is usable in CI.
Who it is for. For teams that ship models, agents or MCP servers and want to check them before release with reproducible evidence, including in CI.
Good fit when
- The repository holds model files and you need to catch pickle loads with dangerous calls before anyone opens them
- Before releasing an MCP server you want to check authentication, token audience, sessions and registry entries: the `guardana.mcp.*` rules cover that
- An agent keeps a call log and you need to search it for credential leaks, consent bypasses and unapproved actions
- Run results must be compared between versions and a release blocked when things get worse: `guardana diff` does that
- A report has to show up in GitHub code scanning: the scanner emits SARIF 2.1.0 and ships as a GitHub Action
Not a fit when
- You need a filter in the request stream: Guardana verifies from outside and is not on-the-fly protection
- You need a general SAST or CVE search across all code: the tool states it does not replace them
- You need compliance certification: the output gives evidence for a decision, not an auditor's opinion
- The target service is paid or belongs to someone else: active checks send real requests and can cost money or trigger abuse detection
- You need one passing run to prove a system is secure: untested areas and the selected rules limit what can be concluded
Example request
Scan the models folder with Guardana, show findings by severity and explain which ones block the releaseLimitations
The project is released as stable version 1.0.2. Testing is documented for Python 3.11–3.13; the author reports test failures on 3.14. After installation, static analysis needs no model or network unless an external report collector is enabled.
Active probes have no default request ceiling. Set `--max-requests` and `--max-duration`, adding token and rate limits where needed. These are not provider spending caps. Probes send real requests, so use an authorized staging target.
Allowed third-party plugins execute Python code. Traces and reports may contain sensitive data; automatic redaction does not replace inspection before sharing. The license is Apache-2.0.
How to disable. Remove the package with `pip uninstall guardana-cli` or `uv remove guardana-cli`; a uvx run installs nothing permanent. In CI delete the step using guardana/guardana and the guardana.yaml file.
FAQ
How do I run Guardana without installing it?
Run `uvx --from guardana-cli guardana scan .` with uv installed. The command is guardana while the PyPI package is guardana-cli. Static checks need no network, key or model once the package is downloaded.
What does guardana scan check?
Models and code: dangerous pickle operations, loading through `torch.load` without `weights_only=True`, configs that pull in someone else's code, dependency risks, secrets and package provenance. In the vulnerable model example it also flags an import of a non-existent package that looks like slopsquatting.
How do I check an MCP server with Guardana?
Use `guardana probe` with the server address: the `guardana.mcp.*` rules check authentication, discovery, token audience, sessions, scope, caching and registry entries. Make a plan first with `guardana plan probe` and set a budget in the profile.
How do I wire Guardana into GitHub Actions?
Add a step `uses: guardana/guardana@v1.0` with contents: read and security-events: write permissions to upload SARIF. The v1.0 tag moves, so pin a commit hash if your rules require it.
What does an empty result mean?
No findings does not mean every check ran. Inspect coverage gaps, errors and unverified observations. Exit status depends on the command and termination reason: an exhausted budget returns 6, while an invalid comparison returns 2. Use the project’s exit-code table for CI.
Discussion
No questions or reviews yet.
Related
CLI toolsA static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
HOL Guard checks an AI agent's shell commands, secret reads, MCP calls and package installs before they run and holds risky actions until you decide
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Guardana (this card) | no | 212 | |
| MCP Scanner | yes | 1,109 | Cisco's scanner for MCP servers with three engines, while Guardana is broader: models, endpoints, agent traces |
| Promptfoo | no | 26,875 | testing and red teaming of LLM apps with model comparison, while Guardana stresses reproducible evidence and artifact checks |
| OPFOR | no | 584 | attack emulation against agents and MCP by OWASP catalogs, while Guardana also checks model files and recorded traces |
README in short
Beyond individual runs, the tool supports saved-result comparison, agent-trace analysis and scheduled checks. Imported observations retain their provenance and are not presented as Guardana’s own verification.