Find and automatically fix guardrail gaps, unsafe tools, missing validation, and unbounded loops in Claude Agent SDK, OpenAI Agents SDK, Google ADK, LangChain, CrewAI, and MCP agents — before production.

Trustabl — find and fix AI agent reliability gaps

Find what will make your AI agent fail — then fix it with one command.

Trustabl scans an agent repository for the gaps that break agents in production: tool descriptions too vague for a model to know when to use them, missing retry and timeout handling, untyped parameters, absent guardrails, and tool grants that exceed what the agent claims to do. Then it applies the fix directly to your source.

Every other agent scanner hands you a report. Trustabl hands you a patch.

Reliability is engineered before deployment, not observed after it.

Scanning runs entirely on your machine. No cloud scanner, no account, no code upload, no LLM — deterministic static analysis.

docker run --rm -v "$PWD:/repo" ghcr.io/trustabl/trustabl:latest scan /repo   # try it, nothing installed

brew install trustabl/tap/trustabl                                            # macOS / Linux
scoop bucket add trustabl https://github.com/trustabl/scoop-bucket             # Windows
scoop install trustabl

trustabl scan .                                                               # find issues (fully local)
trustabl scan . --format json > scan.json
trustabl enrich --input scan.json --repo . --diff --apply                     # preview, then fix

9 SDKs · 7 languages · human, JSON, or SARIF 2.1.0 output · CI-friendly exit codes · also runs as a local stdio MCP server (trustabl mcp).

Deepest coverage for Claude Agent SDK, OpenAI Agents SDK, Google ADK, and MCP servers. Also scans LangChain / LangGraph, CrewAI, AutoGen / AG2, Pydantic AI, and the Vercel AI SDK — see COVERAGE.md for the full matrix.

Scanning needs no key and no network. Applying fixes uses your own Anthropic, OpenAI, or Google key.

What a scan looks like

Real output, scanning an agent repo that ships a Claude Agent SDK client, an MCP server, a subagent, and two skills:

$ trustabl scan .

Scan summary
  Languages:          typescript, javascript
  SDKs:               claude_agent_sdk
  Tool definitions:   2    (custom tools with function bodies)
  Agent tool grants:  14   (tool names the agent may call)
  MCP servers:        1    (createSdkMcpServer)
  Subagents:          1    (inbox-searcher)
  Skills:             2    (action-creator, listener-creator)
  Findings:           14
  Overall score:      66%

Surface readiness
  skill:action-creator          45%  (5 findings)
  skill:listener-creator        54%  (4 findings)
  agent:AIClient.queryStream    64%  (2 findings)
  subagent:inbox-searcher       79%  (1 finding)
  tool:search_inbox             98%  (1 finding)
  tool:read_emails             100%  (0 findings)

Findings
  inbox-searcher
    [CSDK-201]  HIGH  Subagent is granted Bash  (agent/.claude/agents/inbox-searcher.md:1-5)
        A subagent with shell access can run arbitrary commands if it is
        compromised or misdirected.
        fix: Remove `Bash` from the subagent's `tools:` list unless shell access
        is essential. Prefer specific tools (Read, Grep, Glob) for read-only roles.

Three things worth noticing:

• It scores each surface separately. A repo-wide number hides the problem; skill:action-creator at 45% tells you where to look first.
• Every finding carries a fix, not just a complaint — and trustabl enrich --apply writes those fixes to source.
• The exit code is the CI gate. 0 when nothing reaches medium severity, 1 when something does, so a pipeline can stop a bad agent from shipping.

AI agents pass their demo and fail in production

The failures are rarely exotic. They are the same handful of gaps, over and over:

• An agent holding shell tools with no input guardrails
• A tool making an HTTP call with no timeout, hanging the whole run
• Untyped tool parameters, so the model guesses and guesses wrong
• A tool description so vague the model calls the wrong tool — 56% of MCP tool descriptions fail to state their purpose clearly, and 97.1% carry at least one description defect (Hasan et al., MCP Tool Descriptions Are Smelly!, arXiv 2602.14878 — 856 tools across 103 servers)
• A subagent granted Bash despite a read-only description
• A skill that auto-approves unrestricted shell access
• No retry handling, so one transient 500 fails the task
• An agent loop with no iteration bound, burning tokens until it is killed
• A user-controlled URL flowing into a fetch — SSRF, from your agent

Every one of these is visible in the source before the agent ever runs. Trustabl finds them in seconds, offline, with no LLM — and fixes them.

The rest of this document explains what Trustabl reasons about and how the scan works, then covers building and running it. For the full implementation reference see ARCHITECTURE.md; for the at-a-glance SDK coverage matrix see COVERAGE.md.

What it analyzes — the five-scope model

Trustabl does not treat a repository as one undifferentiated blob. Every rule is classified into exactly one of five scopes, and each scope receives a different typed input: