Skip to main content
Drako scans your AI agent project for governance and security gaps — entirely offline, with no signup or API key required. Every finding is reproducible: same code, same result, every time.

​
How it works

Drako uses AST-based static analysis to parse your Python (and optionally TypeScript/JavaScript) source code into an abstract syntax tree, then evaluates 97 deterministic rules against it. There is no LLM in the evaluation loop. The analysis runs in your local process — no network calls, no cloud dependency, no data leaving your machine. When you run drako scan ., Drako:
  1. Discovers all agent source files and configuration.
  2. Generates an Agent BOM — a full inventory of agents, tools, models, and permissions.
  3. Evaluates all 97 rules against the parsed AST.
  4. Performs reachability analysis to separate actively used tools from unreferenced ones.
  5. Calculates two governance scores and renders the findings report.

​
Running a scan

The simplest invocation scans the current directory: 
drako scan .
All flags and their effects: 
drako scan .                       # Full scan, both scores
drako scan . --details             # Code snippets + fix suggestions per finding
drako scan . --benchmark           # Compare your score against 100 scanned projects
drako scan . --baseline            # Save current state; future scans show only new findings
drako scan . --format sarif        # SARIF output for GitHub Code Scanning
drako scan . --fail-on critical    # Exit 1 if any CRITICAL finding exists (CI gate)
drako scan . --share               # Generate a shareable score card
drako scan . --diff HEAD~1         # Only scan files changed since HEAD~1

# See full details with code snippets and fix suggestions
drako scan . --details

​
Understanding the output

A typical scan produces output like this: 
┌─ Drako Scan ─────────────────────────────────────────────┐
│ my-project  │  crewai 0.86.0  │  0.4s                    │
└──────────────────────────────────────────────────────────┘

  Agent BOM: 3 agents │ 12 tools │ 2 models │ 4 prompts

  GOVERNANCE:  42/100 [D] ▰▰▰▰▰▰▰▰▱▱▱▱▱▱▱▱▱▱▱▱  42%
  DETERMINISM: 34/100 [F] ▰▰▰▰▰▰▰▱▱▱▱▱▱▱▱▱▱▱▱▱  34%

  Better than 28% of scanned projects

  CRITICAL  3  │  HIGH  5  │  MEDIUM  4  │  LOW  2

  SEC-001  API key hardcoded in source           (src/main.py)
           ⚠ REACHABLE — used by agent 'researcher'
           Related: DRAKO-ABSS-2026-003
           Impact: Attacker inherits all agent permissions
           Ref: CWE-798, OWASP LLM06

  SEC-005  Arbitrary code execution in tool      (tools/runner.py)
           ○ UNREACHABLE — no agent references this tool

  DET-001  LLM temperature not set               (agents/writer.py)
           Impact: Non-deterministic outputs between runs

​
Two scores, two audiences

Governance speaks to security teams: are your agents safe? It reflects how well the project controls what agents can do, what they have access to, and whether there are audit trails and human oversight mechanisms. Determinism speaks to engineers: will your agents behave the same way twice? It reflects whether agents are configured for reproducible outputs — temperature, seeds, timeouts, iteration limits. Both scores use the same grading scale:
GradeScore rangeWhat it means
A90–100Strong governance posture
B75–89Minor gaps, low risk
C60–74Moderate risk, address soon
D40–59Significant gaps, prioritize remediation
F0–39Critical issues present

​
Severity levels

Each finding is assigned one of four severity levels:
SeverityPoints deductedCap
CRITICAL−15 per finding−60 total
HIGH−8 per finding−40 total
MEDIUM−3 per finding−20 total
LOW−1 per finding−10 total
Caps prevent a single category from monopolizing the score, so a project with 20 MEDIUM findings isn’t penalized more than one with 7.

​
Next steps

Scan rules

Browse all 97 deterministic rules across 16 categories — security, governance, compliance, and more.

Reachability analysis

Learn how Drako uses AST traversal to separate real risks from theoretical ones.

Build docs developers (and LLMs) love

Get started for freeTalk to us