guardana

Guardana is an open‑source tool that lets security and platform engineers verify AI model artifacts, live endpoints, MCP servers, and recorded agent traces. It runs scans entirely offline, produces reproducible evidence, and integrates with continuous‑integration pipelines.

The core workflow starts with a scan of model files or code bundles using `guardana scan PATH`. The scanner applies a set of deterministic build‑time rules, 19 in the stable release, to detect issues such as unsafe pickle unpickling, unguarded `torch.load` calls, and hidden configuration code. Results are reported with severity levels (critical, high, etc.) and cause the command to exit with a non‑zero status when problems are found. For live services, `guardana probe` can test a model endpoint, an agent, or an MCP server, while `guardana monitor` allows scheduled repeats. Recorded executions can be graded with `guardana grade RECORDING`, which checks the captured replies against runtime rules without invoking the application again. Finally, `guardana diff BEFORE AFTER` compares two saved runs and reports whether the later run is worse, better, unchanged, or incomparable.

Guardana is aimed at teams that need to assess their own AI assets throughout development and deployment. If you maintain model files on a training box or laptop, you can point the scanner at those files and get immediate feedback on supply‑chain risks. Multi‑tenant retrieval applications can be evaluated by probing the service with fixtures and grading recorded answers, which helps surface tenant‑boundary violations or poisoned‑document instructions. For agents that use external tools, the `analyze-trace` command inspects recorded traces, checking for tool result injection or unauthorized side effects. The tool does not observe live traffic beyond the explicit probes, so it cannot detect issues that only appear in production usage.

The rule system is extensible. You can create new policy packs with `guardana new-pack` and define checks in declarative YAML or Python. Each rule includes a severity, target kind (e.g., endpoint, artifact), and optional evaluators that decide whether an attack succeeded. The repository lists 58 rules covering both build‑time surfaces (pickle opcode, keras lambda, remote code config, hard‑coded secrets, hidden instructions) and runtime surfaces (system prompt leak, gradual jailbreak, agent tool result injection, token audience mismatches, unapproved side effects). No telemetry is sent, and the project is licensed under Apache‑2.0.

Key features