bastyn-labs/bastyn-scan

Pre-deployment single-binary security assurance for autonomous AI and agent code.
Know what could let your AI agent act outside its intended controls before you deploy it.
BASTYN analyses AI agent, MCP and tool-enabled applications for unsafe action paths, risky permissions and missing control signals that conventional code scanners are not designed to understand.
Local-first · One executable, with no runtime · No account ·No LLM/API key · GitHub-native · SARIF-ready.
---
> **Status: alpha.** bastyn scan finds real issues today: 55 AST rules over Python, TypeScript and JavaScript across the OWASP GenAI and Anthropic Zero Trust categories, plus MCP manifest inspection, Dockerfile and Docker Compose inspection, a hidden-Unicode scan of agent instruction files, SKILL.md manifest scanning, and CVE matching against OSV. The embedded prompt-injection classifier is not built yet. See Measured coverage for what the test corpus does and does not prove, and Roadmap for what is missing.
Why BASTYN
BASTYN separates **provable defects from observations**. Your build only fails on problems BASTYN can substantiate, rather than assumptions about controls that may exist elsewhere in your architecture.
- **One static binary.** cargo build --release produces a self-contained executable. No interpreter, no node_modules, no container.
- **Defects and observations are separate.** A control the repository merely lacks is not filed as a bug and cannot fail your build. See Defects and observations.
- **Deterministic offline.** Sorted relative paths and a stable JSON contract, so --offline reports diff cleanly across runs and CI jobs. A default online run can differ as OSV's advisory data changes, even over unchanged code.
- **Fails loudly.** An unreadable directory is an error, not a quietly smaller result set. A security tool that under-reports is worse than one that stops.
What BASTYN checks
- **Unsafe autonomous actions** — dangerous paths from model-controlled input into consequential operations.
- **Agent and MCP tool controls** — excessive grants, wildcard access and unsafe tool configuration.
- **Missing control signals** — destructive or sensitive actions without detectable safeguards.
- **Execution trust boundaries** — privileged containers, exposed Docker sockets and unsafe runtime configuration.
- **AI-specific security defects** — prompt, secret, injection and dependency risks relevant to agent applications.
No wall-clock benchmark has been published, so this README does not claim one.
Install
Requires Rust 1.90 or newer (rustup.rs).
cargo install --path crates/bastyn-cli puts it on your PATH from a local checkout. Tagged releases also publish binaries for Linux, macOS and Windows on the releases page, and can be installed without cloning the repo:
Use it from a coding agent
This repository ships an Agent Skill at skills/bastyn-scan that teaches a coding agent how to run bastyn scan and report the result accurately, including what was not covered. It works with agents that support the Agent Skills format, such as Claude Code.
Then ask your agent: "Scan this repository with Bastyn and show me what to fix first."
The skill does not include the bastyn executable. If it is missing, the agent asks before installing it. By default the skill scans with --offline, and offers the dependency CVE lookup afterwards.
Usage
A complete run, pasted verbatim, over a three-file project: an agent.py that passes a model reply to eval() and asks for a completion with no token ceiling, a config.py holding a provider key as a literal, and a requirements.txt of three pinned dependencies.
The report reads top to bottom as four answers: what ran, what the verdict is, what to fix, and what the scan did not see. RESULT and Exit status come from the same value the process returns, so they cannot disagree with $?. No line exceeds 78 columns.
That run was captured with stdout redirected to a file, which is why the ticks, rules and daggers are [ok], - and *. In a terminal they are ✓, ─ and †, and typographic quotes and middots keep their Unicode too. NO_COLOR forces the same ASCII fold. --no-color is a separate question and only suppresses ANSI escapes.
When stdout is not carrying the text report, because it is redirected or --format json/--format sarif is in use, a one-line verdict goes to stderr instead:
✓ No defects found is the other half. --quiet suppresses both.
Defects and observations
A **defect** is wrong however you deploy. Running model output through eval is a defect in every architecture, so it is shown by default and it can fail your build.