Ease AIASIScan
asiscan.dev ↗A static analysis security scanner built specifically for AI agent codebases.
The problem
Conventional static analysis was designed before anything in your codebase could call a tool, follow an instruction embedded in fetched text, or decide to spend money. As ASIScan puts it: your SAST scanner doesn't know what a tool call is.
Why you’d use it
Because enterprise procurement now asks. Security questionnaires have grown AI-specific sections, and the honest position for most teams is that nobody can answer question 26 — walk us through your kill switch — with anything they would put in writing. ASIScan audits an agent codebase against the OWASP Top 10 for Agentic Applications, the OWASP LLM Top 10 and EU AI Act Article 50, and produces a dated report you can attach to the questionnaire instead of a paragraph of reassurance. The scanner itself is free and MIT-licensed, so finding out where you stand costs nothing but the time to run it.
Who it’s for
- Companies shipping agent features into enterprise accounts
- Agencies delivering agent work who need a repeatable, billable assessment
- Teams who have been asked for AI security evidence and had nothing to send
What it does
- 18 rules covering the ASI risks plus the overlap with the LLM Top 10
- Detects invisible instruction smuggling — zero-width characters, bidirectional overrides, Unicode tag exploits
- Reads TypeScript, JavaScript, Python, Go, Rust, Java, C#, PHP, JSON, YAML, TOML, shell and Dockerfiles
- Output as terminal, markdown, JSON or SARIF 2.1.0
- GitHub Action with pull-request gates and weekly re-scanning
- Runs fully offline with no telemetry — nothing leaves your machine
- Free and MIT licensed: npx asiscan .
Pricing
Scanner free and MIT licensed. Assessment $490 one-off, Continuous $2,400/year, Consultancy $6,000/year.
What it does not do
It reads source code, not runtime behaviour, IAM policies, network topology or model output. It is regex-based rather than AST-based, and its own site reports roughly 75% measured precision after tuning against fifteen open-source agent frameworks. It is not a certification, not a conformity assessment and not legal advice — which is why a 47-item manual review checklist ships alongside it.
What building it demonstrates
- Deep familiarity with how AI systems actually fail in production
- Tooling built to survive enterprise security review
- A published, defensible accuracy figure rather than a marketing claim