guardana/guardana

Guardana is an open-source AI security verification tool for security and platform engineers. It checks code and model artifacts, live AI systems, and recorded runs. It reports what it found, what it could not verify, and what it could not check. It verifies outside the request path; it is not an inline guardrail, a general SAST or CVE scanner, or a compliance certification.
Quickstart · Features · Rule catalog · Docs · Status & limits · Current work · Changelog · Get involved
---
**58 built-in security checks; add checks for your application.** The count comes from the generated rule summary. Built-in artifact checks need no network. scan --reporter server:// sends results to a collector; active checks contact the target you choose. Guardana needs no account and has no automatic telemetry or phone-home.
Quickstart
The command is guardana; the distribution is guardana-cli. An uncached uvx run or an install downloads the distribution. For a source checkout, clone and run uv sync as described in docs/install.md.
Start with an offline result:
Its README walks through a failing scan, the fix, a saved run, and a check of your own. Once Guardana is installed, it needs no account, key, model, or network.
Scan the bundled vulnerable model directory for another example:
That run exits 1, so it can gate CI. To check your own work:
Choose a guide for your own project, a run your application recorded, or the application your users talk to.
Every published distribution has signed, keyless build provenance verifiable with gh attestation verify, plus a PEP 740 attestation on PyPI.
What it checks
The generated rule summary counts 58 built-in rules: 19 artifact rules and 39 runtime rules. The runtime rules span live endpoints, live MCP servers, live A2A agents, seeded applications, and recorded traces. A single endpoint does not exercise all 39. Rules map to both editions of the OWASP LLM Top 10, the OWASP Top 10 for Agentic Applications, the OWASP MCP Top 10, OWASP ML Top 10, MITRE ATLAS v5.6.0, and NIST AI 100-2e2025. References include their edition.
| Family | Rules | Surface | What it covers |
|---|---|---|---|
| guardana.supply_chain.* | 16 | build | unsafe loading, remote code, model formats, dependencies, transport, secrets, and provenance |
| guardana.prompt.* | 7 | build + runtime | hidden instructions, tool poisoning, injection, jailbreaks, prompt leakage, and resource consumption |
| guardana.agent.* | 7 | runtime | tool-result injection, credential exfiltration, broad arguments, excessive use, memory poisoning, tool schemas, and MCP server manifests |
| guardana.mcp.* | 10 | runtime | authentication, discovery, audience, session, scope, issuer, cache handling, task listings, and registry entries |
| guardana.a2a.* | 3 | runtime | agent cards, callers without a credential, and one caller's view of another's tasks |
| guardana.trace.* | 9 | runtime | recorded credential, identity, consent, policy, approval, retrieval, effect, and handoff boundaries |
| guardana.scenario.* | 2 | runtime | multi-turn jailbreak and indirect-injection scenarios |
| guardana.tenancy.* | 1 | runtime | another tenant's seeded data reaching a reply, asked through the application's own index |
| guardana.retrieval.* | 1 | runtime | an instruction planted in a seeded document being followed |
| guardana.output.* | 1 | runtime | secrets in model output |
| guardana.training.* | 1 | build | training-data integrity |
The 19 static rules need no model or network. The generated rule catalog lists built-in rule ids, severities, surfaces, and framework mappings. guardana rules shows rules admitted in the current installation, including trusted third-party rules. See FEATURES.md for the capability overview and the generated detection limits for what each finding establishes.
How results gate a run
Guardana keeps four outcomes separate:
- findings: a check reached a negative verdict;
- unverified: it ran but could not decide;
- errors: it could not run;
- coverage shortfalls: required evidence was unavailable, or the scan observed a model file that no running rule examined.