AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
This report summarizes scanner evidence for microsoft/agent-governance-toolkit, a Python project with 6,417 GitHub stars. SynthScan examined 1,002,846 lines of code across 4417 source files, recording 22899 pattern matches distributed across 27 syntactic categories. The legacy adjusted pattern signal is 37.7 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 11975 finding(s).
Are imports declared and package/API names verified? 4019 finding(s).
Are wrappers, guards, and repeated structures necessary? 17170 finding(s).
Which changes need focused human review? 22899 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 22899 distinct pattern matches across 27 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 37 | # ── plumbing ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 81 | # ── 0. toolchain probe ──────────────────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 99 | # ── 1. build the AGT-vendored ACS Rust core ────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 117 | # ── 2. Python venv + ACS Python SDK + agt-policies wrapper ────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 132 | # ── 3. Node SDK build + pack + install ─────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 148 | # ── 4. .NET SDK build + pack + install ─────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 165 | # ── 5. End-to-end scenario: Python ────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 375 | # ── 6. End-to-end scenario: Rust ──────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 485 | # ── 7. End-to-end scenario: Node ──────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 578 | # ── 8. End-to-end scenario: .NET ──────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 854 | # ── 10. Migration tool ────────────────────────────────────────── | COMMENT |
| MEDIUM | policy-engine/scripts/demo_end_to_end.sh | 882 | # ── 11. Final summary ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/ProtocolFacetsTests.cs | 10 | // ── FacetRegistry ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/ProtocolFacetsTests.cs | 71 | // ── SQL ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/ProtocolFacetsTests.cs | 216 | // ── K8s ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/ProtocolFacetsTests.cs | 403 | // ── ExtractProtocolFacets default flow ──────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/ProtocolFacetsTests.cs | 453 | // ── PolicyEngine integration ────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 10 | // ── Policy.FromYaml ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 89 | // ── Condition evaluation ──────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 267 | // ── PolicyEngine management ───────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 326 | // ── Conflict resolution strategies ────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 442 | // ── File loading ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 472 | // ── Scope validation (#3536) ──────────────────────────────────── | COMMENT |
| MEDIUM | …net/tests/AgentGovernance.Tests/PolicyAdvancedTests.cs | 472 | // ── Scope validation (#3536) ──────────────────────────────────── | COMMENT |
| MEDIUM | …otnet/tests/AgentGovernance.Tests/AuditEmitterTests.cs | 169 | // ── Subscription order ───────────────────────────────────────── | COMMENT |
| MEDIUM | …otnet/tests/AgentGovernance.Tests/AuditEmitterTests.cs | 202 | // ── Unsubscription ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …otnet/tests/AgentGovernance.Tests/AuditEmitterTests.cs | 286 | // ── Concurrent subscribe / emit ───────────────────────────────── | COMMENT |
| MEDIUM | …tGovernance.Tests/GovernanceMiddlewareAdvancedTests.cs | 27 | // ── Input validation ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …tGovernance.Tests/GovernanceMiddlewareAdvancedTests.cs | 57 | // ── Rate limiting ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tGovernance.Tests/GovernanceMiddlewareAdvancedTests.cs | 113 | // ── Injection detection ───────────────────────────────────────── | COMMENT |
| MEDIUM | …tGovernance.Tests/GovernanceMiddlewareAdvancedTests.cs | 163 | // ── Audit events ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tGovernance.Tests/GovernanceMiddlewareAdvancedTests.cs | 270 | // ── Concurrency ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ce-dotnet/examples/Quickstart/wire-protocol-rules.yaml | 11 | # ── SQL ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ce-dotnet/examples/Quickstart/wire-protocol-rules.yaml | 33 | # ── Kubernetes ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tnet/src/AgentGovernance/Lifecycle/LifecycleManager.cs | 176 | // ── Convenience methods ────────────────────────────────────── | COMMENT |
| MEDIUM | …ce-dotnet/src/AgentGovernance/Policy/ProtocolFacets.cs | 167 | // ── SQL ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ce-dotnet/src/AgentGovernance/Policy/ProtocolFacets.cs | 534 | // ── Kubernetes ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 75 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 105 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_example_smoke.py | 107 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_example_smoke.py | 142 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_example_smoke.py | 144 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/unit/test_policy_test.py | 21 | # ── Helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/test_policy_test.py | 86 | # ── Fixture loading ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/unit/test_policy_test.py | 137 | # ── Replay engine ────────────────────────────────────────────────────── | STRING |
| MEDIUM | tests/unit/test_policy_test.py | 303 | # ── Report ───────────────────────────────────────────────────────────── | STRING |
| MEDIUM | tests/unit/test_policy_test.py | 348 | # ── Example fixture files ───────────────────────────────────────────────── | STRING |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 27 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 31 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 140 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 143 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 170 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/ci/test_regression_credential_boundary.py | 176 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | docs/workshop/labs/lab2_multi_agent_trust.py | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docs/workshop/labs/lab2_multi_agent_trust.py | 27 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docs/workshop/labs/lab2_multi_agent_trust.py | 46 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docs/workshop/labs/lab2_multi_agent_trust.py | 48 | # --------------------------------------------------------------------------- | COMMENT |
| 5114 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | policy-engine/tests/conformance/run_python.py | 55 | async def evaluate_intervention_point(self, request): | CODE |
| LOW | policy-engine/tests/conformance/run_python.py | 167 | def test_python_runner_cases_pass_or_skip(self): | CODE |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 54 | def test_every_emitted_host_reason_is_registered() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 64 | def test_every_registered_host_reason_is_documented() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 76 | def test_host_error_names_come_from_the_closed_agent_hooks_set() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 98 | def test_the_two_result_schema_copies_have_not_drifted() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 122 | def test_result_schema_matches_the_three_verdict_contract(verdict: dict, accepted: bool) -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 87 | def test_golden_happy_path_generates_valid_artifacts() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 105 | def test_openai_compatible_model_detects_azure_by_hostname_only() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 120 | def test_openai_compatible_model_api_version_forces_azure_mode() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 128 | def test_generator_package_includes_wire_schemas() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 147 | def test_packaged_schemas_match_canonical_spec_schemas() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 168 | def test_empty_annotation_from_defaults_to_policy_target() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 180 | def test_tools_are_derived_from_tool_identity_conditions() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 194 | def test_unconditional_blocking_rule_is_rejected_and_repaired() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 207 | def test_retry_recovers_from_schema_invalid_plan() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 218 | def test_retry_recovers_from_invalid_rego() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 230 | def test_undefined_annotator_surfaces_core_error() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 240 | def test_opa_missing_warns_and_strict_fails(monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 255 | def test_package_imports_without_credentials_or_network(monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 263 | def test_init_cli_generates_guided_artifact_shape(capsys: pytest.CaptureFixture[str]) -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 331 | def test_init_cli_help_documents_output_layout_and_strict_opa() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 342 | def test_init_cli_preserves_regex_commas_in_repeatable_flags() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 373 | def test_init_cli_reads_answers_from_stdin(capsys: pytest.CaptureFixture[str]) -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 393 | def test_init_cli_dry_run_does_not_create_requested_output() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 423 | def test_init_cli_rejects_invalid_intervention_point() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 435 | def test_init_cli_rejects_empty_name_and_points() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 455 | def test_init_cli_rejects_repeated_singleton_flags() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 478 | def test_init_cli_rejects_unsupported_answer_keys() -> None: | CODE |
| LOW | policy-engine/generator/tests/test_generator.py | 496 | def test_init_cli_requires_empty_output_without_force() -> None: | CODE |
| LOW | …icy-engine/generator/acs_generator/manifest_builder.py | 51 | def referenced_annotators_by_point(plan: PolicyPlan) -> dict[str, set[str]]: | CODE |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 286 | def _reject_repeated_singleton_flags(argv: list[str]) -> None: | CODE |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 430 | def test_generated_policy_accepts_sample_snapshot(point: str) -> None: | CODE |
| LOW | policy-engine/generator/acs_generator/rego_builder.py | 108 | def _render_transform_verdict(verdict: dict[str, Any], rule: RulePlan) -> tuple[str, list[str]]: | CODE |
| LOW | policy-engine/generator/acs_generator/rego_builder.py | 141 | def _normalize_transform_path(path: str) -> str: | CODE |
| LOW | policy-engine/generator/acs_generator/validation.py | 358 | def _membership_binding_terms(base: Any, assigns: dict[str, list]) -> list: | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 57 | async def evaluate_intervention_point(self, request): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 79 | async def evaluate_intervention_point(self, request): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 135 | async def test_litellm_public_stream_allow_reemits_verbatim_and_transform_synthesizes_once(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 165 | async def test_litellm_public_stream_deny_and_malformed_inputs_release_no_bytes(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 200 | async def test_litellm_public_stream_oversize_limits_fail_closed(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 210 | async def test_tool_call_streaming_many_fragments_parallel_indices_and_downstream_redaction(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 240 | async def test_escalate_approval_seam_receives_exact_context_and_rejects_deterministically(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 302 | async def test_runtime_and_adapter_failures_release_no_stream_bytes(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 364 | async def test_concurrent_streams_do_not_share_buffer_or_decision_state(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 381 | async def test_openai_raw_sse_chat_stream_is_guarded_and_responses_stream_fails_closed(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 404 | async def test_openai_sdk_object_stream_is_guarded_and_anthropic_stream_fails_closed(self): | CODE |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 473 | def test_annotator_dispatch_precedes_policy_evaluation(self): | CODE |
| LOW | …gine/sdk/python/tests/test_fail_closed_error_parity.py | 56 | def test_native_runtime_fail_closed_errors_match_shared_fixture(self): | CODE |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 185 | def test_string_validation_api_rejects_non_string_mapping_keys() -> None: | CODE |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 28 | def test_artifact_validation_matches_shared_parity_corpus() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 43 | def test_string_validation_api_returns_json_ready_success() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 73 | def test_string_validation_api_aggregates_manifest_and_rego_diagnostics() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 101 | def test_string_validation_api_parses_rego_modules_independently() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 125 | def test_string_validation_api_rejects_duplicate_manifest_keys() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 160 | def test_string_validation_api_does_not_coerce_mixed_case_boolean() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 169 | def test_string_validation_api_uses_runtime_merge_key_semantics() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 210 | def test_string_validation_api_accepts_runtime_prefixed_integer(value: str) -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 222 | def test_string_validation_api_rechecks_aliases_at_deeper_paths() -> None: | STRING |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 243 | def test_string_validation_api_bounds_alias_expansion() -> None: | STRING |
| 10175 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | policy-engine/tests/perf/extract_stats.py | 4 | CODE | |
| LOW | policy-engine/tests/perf/compare.py | 4 | CODE | |
| LOW | policy-engine/tests/conformance/run_python.py | 2 | CODE | |
| LOW | policy-engine/tests/conformance/run_python.py | 8 | CODE | |
| LOW | policy-engine/tests/conformance/run_python.py | 27 | CODE | |
| LOW | …licy-engine/tests/conformance/verify_release_claims.py | 2 | CODE | |
| LOW | …licy-engine/tests/conformance/verify_release_claims.py | 6 | CODE | |
| LOW | policy-engine/tests/conformance/run_parity.py | 2 | CODE | |
| LOW | policy-engine/tests/conformance/streaming/generate.py | 19 | CODE | |
| LOW | policy-engine/generator/tests/test_spec_artefacts.py | 14 | CODE | |
| LOW | policy-engine/generator/tests/test_generator.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/util.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/llm.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/engine.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/rego_builder.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/cli.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/vocabulary.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/report.py | 1 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 1 | CODE | |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 1 | CODE | |
| LOW | …e/sdk/python/tests/test_streaming_adapter_hardening.py | 33 | CODE | |
| LOW | …gine/sdk/python/tests/test_fail_closed_error_parity.py | 1 | CODE | |
| LOW | …gine/sdk/python/tests/test_fail_closed_error_parity.py | 12 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_validation.py | 4 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_parity_canonical.py | 21 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_foundry_adapter.py | 1 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_host.py | 5 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_real_packages.py | 12 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_escalation.py | 1 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_adapters.py | 1 | CODE | |
| LOW | …licy-engine/sdk/python/tests/test_litellm_guardrail.py | 4 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_orchestration.py | 1 | CODE | |
| LOW | …licy-engine/sdk/python/tests/test_adapter_mediation.py | 1 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_schemas.py | 5 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_native_runtime.py | 1 | CODE | |
| LOW | …e/sdk/python/tests/test_transform_evidence_identity.py | 1 | CODE | |
| LOW | …e/sdk/python/tests/test_transform_evidence_identity.py | 3 | CODE | |
| LOW | …e/sdk/python/tests/test_transform_evidence_identity.py | 7 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_telemetry.py | 1 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_telemetry.py | 563 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_telemetry.py | 442 | CODE | |
| LOW | …-engine/sdk/python/tests/test_streaming_conformance.py | 11 | CODE | |
| LOW | …python/examples/real_packages/foundry_agent_guarded.py | 36 | CODE | |
| LOW | …cy-engine/sdk/python/examples/real_packages/_common.py | 1 | CODE | |
| LOW | …-engine/sdk/python/examples/real_packages/telemetry.py | 11 | CODE | |
| LOW | …ine/sdk/python/examples/real_packages/autogen_agent.py | 1 | CODE | |
| LOW | …/python/examples/real_packages/openai_agents_runner.py | 1 | CODE | |
| LOW | …ngine/sdk/python/examples/real_packages/crewai_crew.py | 1 | CODE | |
| LOW | …ine/sdk/python/examples/real_packages/openai_client.py | 1 | CODE | |
| LOW | …ine/sdk/python/examples/real_packages/litellm_proxy.py | 1 | CODE | |
| LOW | …hon/examples/real_packages/semantic_kernel_function.py | 1 | CODE | |
| LOW | …/sdk/python/examples/real_packages/anthropic_client.py | 1 | CODE | |
| LOW | …dk/python/examples/real_packages/langchain_runnable.py | 1 | CODE | |
| LOW | …ne/sdk/python/examples/real_packages/foundry_agents.py | 62 | CODE | |
| LOW | …engine/sdk/python/examples/real_packages/mcp_server.py | 1 | CODE | |
| LOW | …ngine/sdk/python/agent_control_specification/_types.py | 1 | CODE | |
| LOW | …k/python/agent_control_specification/_orchestration.py | 1 | CODE | |
| LOW | …ine/sdk/python/agent_control_specification/__init__.py | 3 | CODE | |
| LOW | …ine/sdk/python/agent_control_specification/__init__.py | 3 | CODE | |
| 3820 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ternal-evaluator-handoff/external_evaluator_handoff.py | 62 | Build a deterministic, offline request for a downstream evaluator. Args: decisions: Reconstructed AGT decis | STRING |
| HIGH | …tions/langchain-agentmesh/langchain_agentmesh/tools.py | 108 | Invoke the tool with trust verification. Args: invoker_card: The invoking agent's card | STRING |
| HIGH | …tions/langchain-agentmesh/langchain_agentmesh/tools.py | 199 | Invoke a tool with trust verification. Args: tool: Tool name or TrustGatedTool instance | STRING |
| HIGH | …tions/langchain-agentmesh/langchain_agentmesh/trust.py | 696 | Add a delegation to the chain. Args: delegatee: The agent receiving the delegation capa | STRING |
| HIGH | …ns/langchain-agentmesh/langchain_agentmesh/identity.py | 149 | Sign data with this identity's private key. Args: data: String data to sign Returns: | STRING |
| HIGH | …nance-python/agent-compliance/schemas/policy_schema.py | 27 | Validate a governance policy dict against the schema. Args: data: Policy data dictionary. Returns: | STRING |
| HIGH | …hon/agent-compliance/src/agent_compliance/promotion.py | 319 | Evaluate all applicable gates for a proposed promotion. Args: agent_id: Agent identifier. | STRING |
| HIGH | …gent-compliance/src/agent_compliance/prompt_defense.py | 662 | Evaluate a system prompt for missing defenses. Args: prompt: The system prompt text to audit. | STRING |
| HIGH | …gent-compliance/src/agent_compliance/prompt_defense.py | 757 | Evaluate a system prompt read from a file. Args: path: Path to a text file containing the system pr | STRING |
| HIGH | …gent-os/examples/self-evaluating/src/wisdom_curator.py | 453 | Approve a review item. Args: review_id: ID of the review to approve re | STRING |
| HIGH | …gent-os/examples/self-evaluating/src/wisdom_curator.py | 473 | Reject a review item. Args: review_id: ID of the review to reject revi | STRING |
| HIGH | …s/examples/self-evaluating/src/universal_signal_bus.py | 452 | Ingest a raw signal and normalize it to a ContextObject. This is the main entry point. ANY sig | STRING |
| HIGH | …s/examples/self-evaluating/src/universal_signal_bus.py | 489 | Auto-detect signal type from raw signal structure. Args: raw_signal: Raw signal da | STRING |
| HIGH | …ent-os/examples/self-evaluating/src/agent_brokerage.py | 56 | Calculate cost based on usage. Note: This implementation allows for hybrid pricing models wher | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 115 | Create a new file in the file system. Args: path: Path where to create the file | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 169 | Read the content of a file. Args: path: Path of the file to read | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 201 | Update an existing file. Args: path: Path of the file to update conten | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 249 | Delete a file from the file system. Args: path: Path of the file to delete | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 308 | List files in a directory. Args: directory_path: Path of the directory to list | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 366 | Get information about a file without reading its content. Args: path: Path of the | STRING |
| HIGH | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 398 | Get the edit history of a file. Args: path: Path of the file | STRING |
| HIGH | …governance-python/agent-os/modules/emk/CONTRIBUTING.md | 170 | Generate searchable tags from an episode. Args: episode: The episode to generate tags from. | STRING |
| HIGH | …governance-python/agent-os/modules/emk/emk/hf_utils.py | 69 | Upload episodes to a Hugging Face Hub dataset repository. This function serializes episodes to JSONL forma | STRING |
| HIGH | …governance-python/agent-os/modules/emk/emk/hf_utils.py | 151 | Download episodes from a Hugging Face Hub dataset repository. Args: repo_id: The Hugging Face Hub | STRING |
| HIGH | …nance-python/agent-os/modules/amb/amb_core/hf_utils.py | 82 | Upload experiment logs or benchmark results to Hugging Face Hub. This function uploads a single file (typicall | STRING |
| HIGH | …nance-python/agent-os/modules/amb/amb_core/hf_utils.py | 160 | Download a dataset file from Hugging Face Hub. Args: repo_id: Repository ID on HF Hub (e.g., "microsof | STRING |
| HIGH | …governance-python/agent-os/modules/amb/amb_core/bus.py | 146 | Publish a message to a topic. This method supports both "fire and forget" (default) and | STRING |
| HIGH | …governance-python/agent-os/modules/amb/amb_core/bus.py | 327 | Send a request and wait for a response. This implements the request-response pattern for cases | STRING |
| HIGH | …governance-python/agent-os/modules/amb/amb_core/bus.py | 420 | Replay persisted messages from a topic (AMB-001). Args: topic: Topic to replay mes | STRING |
| HIGH | …ernance-python/agent-os/modules/amb/amb_core/broker.py | 41 | Publish a message to the broker. Args: message: The message to publish | STRING |
| HIGH | …ernance-python/agent-os/modules/amb/amb_core/broker.py | 59 | Subscribe to a topic and register a handler. Args: topic: Topic to subscribe to | STRING |
| HIGH | …ernance-python/agent-os/modules/amb/amb_core/broker.py | 89 | Send a request and wait for a response (request-response pattern). Args: message: | STRING |
| HIGH | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 319 | Send a request and wait for response. Args: message: Request message t | STRING |
| HIGH | …ernance-python/agent-os/modules/amb/amb_core/schema.py | 30 | Validate a payload against the schema. Args: payload: The payload to validate | STRING |
| HIGH | …ernance-python/agent-os/modules/amb/amb_core/schema.py | 253 | Validate a payload for a given topic. Args: topic: Topic the message is for | STRING |
| HIGH | …governance-python/agent-os/modules/amb/amb_core/dlq.py | 225 | Retry processing a failed message. Args: message_id: Message ID to retry | STRING |
| HIGH | …t-governance-python/agent-os/modules/nexus/registry.py | 230 | Verify a peer agent before IATP handshake. This is the core viral mechanism - unverified peers | STRING |
| HIGH | …ent-governance-python/agent-os/modules/nexus/client.py | 142 | Verify a peer agent before IATP handshake. This is the core viral mechanism - unverified peers | STRING |
| HIGH | …overnance-python/agent-os/modules/atr/atr/injection.py | 142 | Register a dependency. Args: key: Type, name string, or InjectionToken. value: The valu | STRING |
| HIGH | …overnance-python/agent-os/modules/atr/atr/injection.py | 339 | Resolve injection markers in function parameters. Args: func: The function being called. | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/registry.py | 196 | Retrieve a tool specification by name and optional version constraint. Args: name: The tool name | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/registry.py | 280 | Get all registered versions of a tool. Args: name: The tool name Returns: List | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/registry.py | 298 | Get the callable function for a tool. This returns the function object but does NOT execute it. The cal | STRING |
| HIGH | …overnance-python/agent-os/modules/atr/atr/decorator.py | 91 | Extract parameter specifications from function signature. Args: func: The function to analyze Returns: | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/hf_utils.py | 68 | Upload experiment results to Hugging Face Hub. Creates or updates a dataset repository with experiment logs. A | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/hf_utils.py | 153 | Download experiment results from Hugging Face Hub. Args: repo_id: The Hugging Face repo ID. output_ | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 3 | ATR - Agent Tool Registry. A decentralized marketplace for agent capabilities. ATR provides a standardized interface fo | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 284 | Register a function as a tool in the Agent Tool Registry. This decorator transforms a Python function into a discov | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 364 | Retrieve a tool specification from the global registry. Args: name: The unique tool identifier. ver | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 392 | Get a ToolHandle for executing a tool with all policies applied. The ToolHandle provides a convenient interface for | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 420 | Get all registered versions of a tool. Args: name: The unique tool identifier. Returns: List o | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 516 | Get the callable function for a registered tool. This returns the function object but does NOT execute it. The | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/__init__.py | 548 | Execute a registered tool with optional sandboxing. This is a convenience function that retrieves a tool and execut | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/policies.py | 157 | Parse a rate limit string like '10/minute'. Args: rate_string: String in format 'N/period' where pe | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/policies.py | 318 | Execute a function with retry policy. Args: policy: The retry policy to use. func: The function to | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/policies.py | 362 | Execute an async function with retry policy. Args: policy: The retry policy to use. func: The async | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/executor.py | 42 | Execute a callable function. Args: func: The callable function to execute. args | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/executor.py | 72 | Execute a callable function directly on the host. Args: func: The callable function to exec | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/executor.py | 165 | Execute a callable function in a Docker container. The function is serialized and executed inside an ep | STRING |
| HIGH | …governance-python/agent-os/modules/atr/atr/executor.py | 340 | Parse execution result from container logs. Args: logs: Container logs output. | STRING |
| 139 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | policy-engine/tests/conformance/run_python.py | 135 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | policy-engine/generator/acs_generator/llm.py | 74 | except Exception: # noqa: BLE001 - fall back to the bare status line | CODE |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 425 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | policy-engine/generator/acs_generator/validation.py | 540 | except Exception as exc: # noqa: BLE001 - preserve core diagnostics verbatim. | CODE |
| LOW | policy-engine/sdk/python/tests/test_real_packages.py | 123 | except Exception: # noqa: BLE001 | CODE |
| LOW | …e/sdk/python/agent_control_specification/_telemetry.py | 324 | except Exception: # noqa: BLE001 - one sink must not break the others | CODE |
| LOW | …e/sdk/python/agent_control_specification/_telemetry.py | 335 | except Exception: # noqa: BLE001 - flush is best effort | CODE |
| LOW | …e/sdk/python/agent_control_specification/_telemetry.py | 346 | except Exception: # noqa: BLE001 - shutdown is best effort | CODE |
| LOW | …k/python/agent_control_specification/_orchestration.py | 225 | except Exception: # noqa: BLE001 - telemetry must never break enforcement | CODE |
| LOW | …k/python/agent_control_specification/_orchestration.py | 402 | except Exception as exc: # noqa: BLE001 - a failing resolver must fail closed | CODE |
| LOW | …k/python/agent_control_specification/_orchestration.py | 741 | except Exception: # noqa: BLE001 - best effort, must not break construction | CODE |
| LOW | …k/python/agent_control_specification/_orchestration.py | 770 | except Exception: # noqa: BLE001 - label lookup must never break construction | CODE |
| LOW | …engine/sdk/python/agent_control_specification/_host.py | 418 | except Exception: # noqa: BLE001 - a broken resolver must not permit | CODE |
| MEDIUM | …engine/sdk/python/agent_control_specification/_host.py | 62 | def _runner() -> None: | CODE |
| LOW | …gine/sdk/python/agent_control_specification/_client.py | 270 | except Exception: # noqa: BLE001 - label lookup must never break construction | CODE |
| LOW | …gine/sdk/python/agent_control_specification/_client.py | 289 | except Exception: # noqa: BLE001 - best effort, like policy_labels | CODE |
| LOW | …ent_control_specification/_adapters/semantic_kernel.py | 179 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | …ent_control_specification/_adapters/semantic_kernel.py | 203 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | …ent_control_specification/_adapters/semantic_kernel.py | 212 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | …ython/agent_control_specification/_adapters/_shared.py | 196 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 321 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 325 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 445 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 451 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 458 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …python/agent_control_specification/_adapters/openai.py | 464 | except Exception: # noqa: BLE001 | CODE |
| LOW | …hon/agent_control_specification/_adapters/langchain.py | 298 | except Exception as exc: | CODE |
| LOW | …ython/agent_control_specification/_adapters/foundry.py | 355 | except Exception as exc: # noqa: BLE001 - isolate a single tool failure | CODE |
| LOW | …ython/agent_control_specification/_adapters/foundry.py | 442 | except Exception: # noqa: BLE001 - fall back to the dict shape the SDK also accepts | CODE |
| LOW | policy-engine/examples/from_agentshield/validate_all.py | 161 | except Exception as exc: # noqa: BLE001 - surface the diagnostic verbatim | CODE |
| LOW | …ine/benchmarks/agentdojo/acs_agentdojo_bench/runner.py | 78 | except Exception as exc: | CODE |
| MEDIUM | …ine/benchmarks/agentdojo/acs_agentdojo_bench/runner.py | 71 | def acs_unavailable_reason() -> str | None: | CODE |
| LOW | …e/benchmarks/agentdojo/acs_agentdojo_bench/pipeline.py | 124 | except Exception as exc: | CODE |
| LOW | …e/benchmarks/agentdojo/acs_agentdojo_bench/pipeline.py | 195 | except Exception as exc: | CODE |
| LOW | policy-engine/scripts/demo_end_to_end.sh | 276 | except Exception as exc: | CODE |
| LOW | docs/tutorials/36-govern-quickstart.md | 88 | except Exception as e: | STRING |
| LOW | docs/tutorials/11-saga-orchestration.md | 159 | except Exception as e: | CODE |
| LOW | docs/tutorials/11-saga-orchestration.md | 484 | except Exception: | CODE |
| LOW | docs/tutorials/11-saga-orchestration.md | 617 | except Exception as e: | CODE |
| LOW | docs/tutorials/05-agent-reliability.md | 214 | except Exception: | CODE |
| LOW | docs/tutorials/05-agent-reliability.md | 641 | except Exception as exc: | CODE |
| MEDIUM | docs/tutorials/05-agent-reliability.md | 688 | print(f"Error budget remaining: {slo.error_budget.remaining_percent:.1f}%") | CODE |
| LOW | examples/acs-atr-annotator/atr_adapter.py | 155 | except Exception: | CODE |
| LOW | examples/flowise-governance/governance_server.py | 145 | except Exception: | CODE |
| LOW | examples/mcp-trust-verified-server/server.py | 115 | except Exception: | CODE |
| LOW | examples/pipeline-governance/test_demo.py | 166 | except Exception as e: | CODE |
| LOW | …rflow-governed/test_deerflow_middleware_integration.py | 65 | except Exception as exc: | CODE |
| LOW | …s/deerflow-governed/provider/deerflow_agt_guardrail.py | 22 | except Exception: # pragma: no cover - exercised when DeerFlow is not installed | CODE |
| LOW | …s/deerflow-governed/provider/deerflow_agt_guardrail.py | 82 | except Exception as exc: | CODE |
| LOW | scripts/verify_tutorials_01_34.py | 14 | except Exception as e: | CODE |
| MEDIUM | scripts/credential_audit.py | 56 | print("Error: set GITHUB_TOKEN or authenticate with `gh auth login`", file=sys.stderr) | CODE |
| LOW⚡ | scripts/verify_tutorials.py | 25 | except Exception as e: | CODE |
| MEDIUM | scripts/contributor_check.py | 63 | print("Error: set GITHUB_TOKEN or authenticate with `gh auth login`", file=sys.stderr) | CODE |
| LOW | scripts/contributor_check.py | 349 | except Exception: | CODE |
| LOW | scripts/contributor_check.py | 553 | except Exception: | CODE |
| LOW | scripts/contributor_check.py | 1086 | except Exception: | CODE |
| LOW | scripts/contributor_check.py | 1100 | except Exception: | CODE |
| LOW | scripts/contributor_check.py | 1287 | except Exception: | CODE |
| LOW | scripts/check_dependency_confusion.py | 535 | except Exception: | CODE |
| LOW | scripts/contributor_check_action.py | 80 | except Exception: | CODE |
| 859 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | policy-engine/sdk/python/tests/test_real_packages.py | 123 | except Exception: # noqa: BLE001 | CODE |
| HIGH | policy-engine/sdk/python/tests/test_telemetry.py | 443 | except ImportError: | CODE |
| HIGH | …ython/agent_control_specification/_adapters/_shared.py | 196 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …python/agent_control_specification/_adapters/openai.py | 458 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …python/agent_control_specification/_adapters/openai.py | 445 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …python/agent_control_specification/_adapters/openai.py | 451 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …python/agent_control_specification/_adapters/openai.py | 321 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …ython/agent_control_specification/_adapters/foundry.py | 442 | except Exception: # noqa: BLE001 - fall back to the dict shape the SDK also accepts | CODE |
| HIGH | …e/benchmarks/agentdojo/acs_agentdojo_bench/pipeline.py | 54 | except (ValueError, SyntaxError): | CODE |
| HIGH | examples/acs-atr-annotator/atr_adapter.py | 155 | except Exception: | CODE |
| HIGH | scripts/verify_tutorials_01_34.py | 171 | except ImportError: | CODE |
| HIGH | scripts/credential_audit.py | 52 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | scripts/verify_tutorials.py | 359 | except GovernanceDenied: | CODE |
| HIGH | scripts/verify_tutorials.py | 713 | except GovernanceDenied: | CODE |
| HIGH | scripts/contributor_check.py | 349 | except Exception: | CODE |
| HIGH | scripts/contributor_check.py | 59 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | scripts/contributor_check.py | 798 | except (ValueError, TypeError): | CODE |
| HIGH | scripts/contributor_check.py | 553 | except Exception: | CODE |
| HIGH | scripts/contributor_check_action.py | 195 | except HTTPError: | CODE |
| HIGH | scripts/contributor_check_action.py | 212 | except Exception: | CODE |
| HIGH | scripts/cluster_detect.py | 51 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | scripts/generate_sbom.py | 62 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | …-python/agent-sandbox/tests/test_docker_integration.py | 67 | except Exception: | CODE |
| HIGH | …/agent-sandbox/tests/test_azure_sandbox_integration.py | 110 | except Exception: | CODE |
| HIGH | …t_sandbox/aca_sandbox_provider/aca_sandbox_provider.py | 344 | except Exception: | CODE |
| HIGH | …t_sandbox/aca_sandbox_provider/aca_sandbox_provider.py | 664 | except ImportError: | CODE |
| HIGH | …ox/src/agent_sandbox/nono_sandbox_provider/provider.py | 221 | except Exception: # pragma: no cover - defensive | CODE |
| HIGH | …ox/src/agent_sandbox/nono_sandbox_provider/provider.py | 550 | except Exception: # pragma: no cover - defensive | CODE |
| HIGH | …dbox/src/agent_sandbox/hyperlight_provider/provider.py | 568 | except ImportError: | CODE |
| HIGH | …box/src/agent_sandbox/mxc_sandbox_provider/provider.py | 759 | except OSError: # pragma: no cover - defensive | CODE |
| HIGH | …-sandbox/src/agent_sandbox/docker_provider/provider.py | 400 | except Exception: | CODE |
| HIGH | …-sandbox/src/agent_sandbox/docker_provider/provider.py | 973 | except Exception: | CODE |
| HIGH | …-sandbox/src/agent_sandbox/docker_provider/provider.py | 582 | except ImportError: | CODE |
| HIGH | …sh-integrations/langgraph-trust/tests/test_identity.py | 66 | except ValueError: | CODE |
| HIGH | …s/mcp-receipt-governed/mcp_receipt_governed/adapter.py | 53 | except ImportError: | CODE |
| HIGH | …sh-integrations/openai-agents-trust/tests/test_core.py | 56 | except ValueError: | CODE |
| HIGH | …/agent-compliance/src/agent_compliance/supply_chain.py | 656 | except (urllib.error.URLError, OSError, json.JSONDecodeError, KeyError): | CODE |
| HIGH | …hon/agent-compliance/src/agent_compliance/integrity.py | 377 | except ImportError: | CODE |
| HIGH | …nt-compliance/src/agent_compliance/security/scanner.py | 464 | except (OSError, UnicodeDecodeError): | CODE |
| HIGH | …ompliance/src/agent_compliance/cli/credential_audit.py | 54 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | …mpliance/src/agent_compliance/cli/contributor_check.py | 413 | except Exception: | CODE |
| HIGH | …mpliance/src/agent_compliance/cli/contributor_check.py | 58 | except (FileNotFoundError, subprocess.TimeoutExpired): | CODE |
| HIGH | …mpliance/src/agent_compliance/cli/contributor_check.py | 617 | except Exception: | CODE |
| HIGH | …agent-discovery/src/agent_discovery/scanners/config.py | 223 | except (PermissionError, OSError): | CODE |
| HIGH | …agent-discovery/src/agent_discovery/scanners/github.py | 348 | except Exception: # noqa: S110 | CODE |
| HIGH | …e-python/agent-os/tests/test_semantic_policy_engine.py | 702 | except PolicyDenied: | CODE |
| HIGH | …vernance-python/agent-os/tests/test_mcp_integration.py | 228 | except (KeyError, ValueError): | CODE |
| HIGH | …vernance-python/agent-os/tests/test_kernel_critical.py | 201 | except (FileNotFoundError, KeyError): | CODE |
| HIGH | …vernance-python/agent-os/tests/test_kernel_critical.py | 210 | except (PermissionError, ValueError, KeyError, FileNotFoundError): | CODE |
| HIGH | …vernance-python/agent-os/tests/test_kernel_critical.py | 284 | except RuntimeError: | CODE |
| HIGH | …nce-python/agent-os/examples/crewai-governance/demo.py | 37 | except ImportError: | CODE |
| HIGH | …nce-python/agent-os/examples/crewai-governance/demo.py | 257 | except PermissionError: | CODE |
| HIGH | …nce-python/agent-os/examples/crewai-governance/demo.py | 70 | except ValueError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 32 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 37 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 48 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 56 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 65 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 70 | except ImportError: | CODE |
| HIGH | …thon/agent-os/examples/self-evaluating/src/__init__.py | 79 | except ImportError: | CODE |
| 127 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …shield/moderation/azure-content-safety/app/run_demo.py | 0 | deterministic host stand-in for the external classifier. | STRING |
| HIGH | …om_agentshield/moderation/lakera-guard/app/run_demo.py | 0 | deterministic host stand-in for the external classifier. | STRING |
| HIGH | …entshield/moderation/openai-moderation/app/run_demo.py | 0 | deterministic host stand-in for the external classifier. | STRING |
| HIGH | …rom_agentshield/moderation/llama-guard/app/run_demo.py | 0 | deterministic host stand-in for the external classifier. | STRING |
| HIGH | …agentshield/moderation/perspective-api/app/run_demo.py | 0 | deterministic host stand-in for the external classifier. | STRING |
| HIGH | agent-governance-dotnet/README.md | 0 | permit( principal, action == action::"readdata", resource ); | STRING |
| HIGH | …ts/AgentGovernance.Tests/OpaPolicyBackendAsyncTests.cs | 0 | permit( principal, action == action::"readdata", resource ); | STRING |
| HIGH | agent-governance-python/agent-mesh/tests/test_cedar.py | 0 | permit( principal, action == action::"readdata", resource ); | STRING |
| HIGH | …tnet/tests/AgentGovernance.Tests/PolicyBackendTests.cs | 0 | permit( principal, action == action::"readdata", resource ); permit( principal, action == action::"listfiles", resource | STRING |
| HIGH | …ent-governance-python/agent-mesh/tests/test_backend.py | 0 | permit( principal, action == action::"readdata", resource ); permit( principal, action == action::"listfiles", resource | STRING |
| HIGH | agent-governance-python/agent-mesh/tests/test_cedar.py | 0 | permit( principal, action == action::"readdata", resource ); permit( principal, action == action::"listfiles", resource | STRING |
| HIGH | …nance.Tests/AgentFrameworkGovernanceAdapterRunTests.cs | 0 | apiversion: governance.toolkit/v1 version: "1.0" name: allow-all-policy default_action: allow rules: [] | STRING |
| HIGH | …nance.Tests/AgentFrameworkGovernanceExtensionsTests.cs | 0 | apiversion: governance.toolkit/v1 version: "1.0" name: allow-all-policy default_action: allow rules: [] | STRING |
| HIGH | ….Tests/AgentFrameworkGovernanceAdapterFunctionTests.cs | 0 | apiversion: governance.toolkit/v1 version: "1.0" name: allow-all-policy default_action: allow rules: [] | STRING |
| HIGH | docs/tutorials/33-offline-verifiable-receipts.md | 0 | permit(principal, action == action::"readdata", resource); permit(principal, action == action::"listfiles", resource); f | STRING |
| HIGH | …/agentmesh-integrations/mcp-receipt-governed/README.md | 0 | permit(principal, action == action::"readdata", resource); permit(principal, action == action::"listfiles", resource); f | STRING |
| HIGH | …ntegrations/mcp-receipt-governed/tests/test_adapter.py | 0 | permit(principal, action == action::"readdata", resource); permit(principal, action == action::"listfiles", resource); f | STRING |
| HIGH | examples/quickstart/mcp_receipts_in_60_seconds.py | 0 | permit(principal, action == action::"readdata", resource); permit(principal, action == action::"listfiles", resource); f | STRING |
| HIGH | scripts/verify_tutorials.py | 0 | apiversion: governance.toolkit/v1 name: legacy-no-stage agents: ["*"] default_action: allow rules: - name: block-delete | STRING |
| HIGH | …nt-governance-python/agent-mesh/tests/test_advisory.py | 0 | apiversion: governance.toolkit/v1 name: legacy-no-stage agents: ["*"] default_action: allow rules: - name: block-delete | STRING |
| HIGH | …e-python/agent-mesh/tests/test_multi_stage_pipeline.py | 0 | apiversion: governance.toolkit/v1 name: legacy-no-stage agents: ["*"] default_action: allow rules: - name: block-delete | STRING |
| HIGH | …ox/src/agent_sandbox/nono_sandbox_provider/provider.py | 0 | create the native acs session used for host-side execution gates. | STRING |
| HIGH | …dbox/src/agent_sandbox/hyperlight_provider/provider.py | 0 | create the native acs session used for host-side execution gates. | STRING |
| HIGH | …box/src/agent_sandbox/mxc_sandbox_provider/provider.py | 0 | create the native acs session used for host-side execution gates. | STRING |
| HIGH | …ndex-agentmesh/llama_index/agent/agentmesh/identity.py | 0 | cryptographic signature from a verification identity. | STRING |
| HIGH | …ns/langchain-agentmesh/langchain_agentmesh/identity.py | 0 | cryptographic signature from a verification identity. | STRING |
| HIGH | …ernance-python/agentmesh-integrations/dify/identity.py | 0 | cryptographic signature from a verification identity. | STRING |
| HIGH | …gent-os/examples/self-evaluating/docs/UPGRADE_PURGE.md | 0 | you are a helpful ai assistant. your goal is to provide accurate and useful responses to user queries. you have access t | STRING |
| HIGH | …ples/self-evaluating/examples/example_upgrade_purge.py | 0 | you are a helpful ai assistant. your goal is to provide accurate and useful responses to user queries. you have access t | STRING |
| HIGH | …agent-os/examples/self-evaluating/src/model_upgrade.py | 0 | you are a helpful ai assistant. your goal is to provide accurate and useful responses to user queries. you have access t | STRING |
| HIGH | …governance-python/agent-os/modules/amb/amb_core/bus.py | 0 | unsubscribe from a topic. args: subscription_id: subscription id | STRING |
| HIGH | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 0 | unsubscribe from a topic. args: subscription_id: subscription id | STRING |
| HIGH | …agent-os/modules/amb/amb_core/adapters/kafka_broker.py | 0 | unsubscribe from a topic. args: subscription_id: subscription id | STRING |
| HIGH | …nt-os/modules/amb/amb_core/adapters/rabbitmq_broker.py | 0 | unsubscribe from a topic. args: subscription_id: subscription id | STRING |
| HIGH | …-governance-python/agent-os/src/agent_os/server/app.py | 0 | parse, validate, and return cors origins. rejects ``*`` when credentials are enabled, and validates that each origin has | STRING |
| HIGH | …overnance-python/agent-sre/src/agent_sre/api/server.py | 0 | parse, validate, and return cors origins. rejects ``*`` when credentials are enabled, and validates that each origin has | STRING |
| HIGH | …e-python/agent-hypervisor/src/hypervisor/api/server.py | 0 | parse, validate, and return cors origins. rejects ``*`` when credentials are enabled, and validates that each origin has | STRING |
| HIGH | …/agent-os/src/agent_os/integrations/autogen_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …gent-os/src/agent_os/integrations/langchain_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …nt-os/src/agent_os/integrations/pydantic_ai_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/crewai_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …ent-os/src/agent_os/integrations/llamaindex_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …/agent-os/src/agent_os/integrations/mistral_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …thon/agent-os/src/agent_os/integrations/maf_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/gemini_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …ent-os/src/agent_os/integrations/smolagents_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …/agent-os/src/agent_os/integrations/bedrock_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …gent-os/src/agent_os/integrations/anthropic_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …ent-os/src/agent_os/integrations/google_adk_adapter.py | 0 | return the v5 :class:`adapterruntime` for this kernel. | STRING |
| HIGH | …/agent-os/src/agent_os/integrations/autogen_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …gent-os/src/agent_os/integrations/langchain_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …nt-os/src/agent_os/integrations/pydantic_ai_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/crewai_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …ent-os/src/agent_os/integrations/llamaindex_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …/agent-os/src/agent_os/integrations/mistral_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …thon/agent-os/src/agent_os/integrations/maf_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/gemini_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| HIGH | …ent-os/src/agent_os/integrations/smolagents_adapter.py | 0 | public access to the agt ``input`` intervention point evaluation. | STRING |
| 79 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …e/sdk/python/agent_control_specification/_telemetry.py | 510 | __all__ = [ | CODE |
| LOW | …ine/sdk/python/agent_control_specification/__init__.py | 91 | __all__ = [ | CODE |
| LOW | …engine/sdk/python/agent_control_specification/_host.py | 496 | __all__ = ["HostSession", "SnapshotBuilder", "run_sync"] | CODE |
| LOW | …thon/agent_control_specification/_adapters/__init__.py | 67 | __all__ = [ | CODE |
| LOW⚡ | …ent_control_specification/_adapters/semantic_kernel.py | 209 | def _set_context_arguments(context: Any, effective_args: JsonValue) -> None: | CODE |
| LOW | …ython/agent_control_specification/_adapters/litellm.py | 624 | def _set_message_content(message: Any, content: JsonValue) -> None: | CODE |
| LOW | …ython/agent_control_specification/_adapters/litellm.py | 690 | def _set_tool_call_args(call: Any, args: JsonValue) -> None: | CODE |
| LOW | …e/benchmarks/agentdojo/acs_agentdojo_bench/__init__.py | 3 | __all__ = ["__version__"] | CODE |
| LOW | tests/e2e_python/support/__init__.py | 19 | __all__ = [ | CODE |
| LOW | …e2e_python/scenarios/policy_allow/test_policy_allow.py | 33 | def update_visit_notes(self, **arguments: Any) -> None: | CODE |
| LOW | examples/aegis-governance-profile/compile.py | 95 | __all__ = [ | CODE |
| LOW | …s/deerflow-governed/provider/deerflow_agt_guardrail.py | 309 | __all__ = ["AGTGuardrailProvider"] | CODE |
| LOW | scripts/contributor_check_action.py | 102 | def _set_output(name: str, value: str) -> None: | CODE |
| LOW | …nce-python/agent-sandbox/src/agent_sandbox/__init__.py | 113 | __all__ = [ | CODE |
| LOW⚡ | …e-python/agent-sandbox/src/agent_sandbox/_hardening.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | …on/agent-sandbox/src/agent_sandbox/sandbox_provider.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | …t_sandbox/aca_sandbox_provider/aca_sandbox_provider.py | 70 | logger = logging.getLogger(__name__) | CODE |
| LOW | …box/src/agent_sandbox/aca_sandbox_provider/__init__.py | 20 | __all__ = [ | CODE |
| LOW | …dbox/src/agent_sandbox/nono_sandbox_provider/config.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ox/src/agent_sandbox/nono_sandbox_provider/provider.py | 65 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ox/src/agent_sandbox/nono_sandbox_provider/__init__.py | 24 | __all__ = [ | CODE |
| LOW | …dbox/src/agent_sandbox/hyperlight_provider/provider.py | 56 | logger = logging.getLogger(__name__) | CODE |
| LOW | …dbox/src/agent_sandbox/hyperlight_provider/__init__.py | 26 | __all__ = [ | CODE |
| LOW | …ndbox/src/agent_sandbox/mxc_sandbox_provider/config.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | …box/src/agent_sandbox/mxc_sandbox_provider/provider.py | 70 | logger = logging.getLogger(__name__) | CODE |
| LOW | …box/src/agent_sandbox/mxc_sandbox_provider/__init__.py | 25 | __all__ = [ | CODE |
| LOW | …-sandbox/src/agent_sandbox/docker_provider/provider.py | 42 | logger = logging.getLogger(__name__) | CODE |
| LOW | …-sandbox/src/agent_sandbox/docker_provider/__init__.py | 22 | __all__ = [ | CODE |
| LOW | …ent-sandbox/src/agent_sandbox/docker_provider/state.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | …sh-integrations/a2a-protocol/a2a_agentmesh/__init__.py | 22 | __all__ = [ | CODE |
| LOW | …grations/crewai-agentmesh/crewai_agentmesh/__init__.py | 18 | __all__ = [ | CODE |
| LOW | …ndex-agentmesh/llama_index/agent/agentmesh/__init__.py | 24 | __all__ = [ | CODE |
| LOW | …-integrations/adk-agentmesh/src/adk_agentmesh/audit.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | …tegrations/adk-agentmesh/src/adk_agentmesh/__init__.py | 16 | __all__ = [ | CODE |
| LOW | …egrations/adk-agentmesh/src/adk_agentmesh/evaluator.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | …h-integrations/langgraph-trust/langgraph_trust/gate.py | 55 | def set_score(self, agent: str, score: float) -> None: | CODE |
| LOW | …ability-export/audit_accountability_export/__init__.py | 11 | __all__ = [ | CODE |
| LOW | …integrations/cedarling-acs/cedarling_acs/dispatcher.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | …h-integrations/cedarling-acs/cedarling_acs/__init__.py | 23 | __all__ = ["CedarlingPolicyDispatcher", "CedarlingConfig"] | CODE |
| LOW | …-integrations/mcp-trust-proxy/mcp_trust_proxy/proxy.py | 147 | def set_tool_policy(self, tool_name: str, policy: ToolPolicy) -> None: | CODE |
| LOW | …tegrations/mcp-trust-proxy/mcp_trust_proxy/__init__.py | 12 | __all__ = ["TrustProxy", "ToolPolicy", "AuthResult"] | CODE |
| LOW | …ions/template-agentmesh/template_agentmesh/__init__.py | 23 | __all__ = [ | CODE |
| LOW | …/mcp-receipt-governed/mcp_receipt_governed/__init__.py | 30 | __all__ = [ | CODE |
| LOW | …i-agents-agentmesh/openai_agents_agentmesh/__init__.py | 18 | __all__ = [ | CODE |
| LOW | …enai-agents-agentmesh/openai_agents_agentmesh/trust.py | 183 | def set_threshold(self, function_name: str, min_trust: int) -> None: | CODE |
| LOW | …ns/langchain-agentmesh/langchain_agentmesh/__init__.py | 23 | __all__ = [ | CODE |
| LOW | …tions/langchain-agentmesh/langchain_agentmesh/trust.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ernance-python/agentmesh-integrations/dify/__init__.py | 11 | __all__ = [ | CODE |
| LOW | …governance-python/agentmesh-integrations/dify/trust.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | …governance-python/agentmesh-integrations/dify/trust.py | 60 | def set_identity(self, identity: VerificationIdentity) -> None: | CODE |
| LOW | …ernance-python/agentmesh-integrations/dify/identity.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | …nance-python/agentmesh-integrations/dify/middleware.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW | …governance-python/agent-compliance/schemas/__init__.py | 4 | __all__ = ["PolicySchema", "validate_policy"] | CODE |
| LOW | …n/agent-compliance/src/agent_compliance/policy_test.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | …hon/agent-compliance/src/agent_compliance/promotion.py | 49 | logger = logging.getLogger(__name__) | CODE |
| LOW | …python/agent-compliance/src/agent_compliance/verify.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | …hon/agent-compliance/src/agent_compliance/integrity.py | 38 | logger = logging.getLogger(__name__) | CODE |
| LOW | …nt-compliance/src/agent_compliance/security/scanner.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | …t-compliance/src/agent_compliance/security/__init__.py | 28 | __all__ = [ | CODE |
| LOW | …python/agent-discovery/src/agent_discovery/__init__.py | 26 | __all__ = [ | CODE |
| 426 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 32 | [](docs/compliance/owas | CODE |
| MEDIUM | docs/COMPARISON.md | 15 | When evaluating agent security tooling, developers often encounter [NeMo Guardrails](https://github.com/NVIDIA/NeMo-Guar | CODE |
| MEDIUM | docs/COMPARISON.md | 45 | > ¹ **OWASP scoring methodology:** Each tool was assessed against the ten [OWASP Agentic Top 10 (2026)](https://genai.ow | CODE |
| MEDIUM | docs/COMMUNITY.md | 38 | | [Policy-as-Code vs Prompt Engineering — When Guardrails Need Governance](https://dev.to/kanishtyagii/policy-as-code-vs | CODE |
| MEDIUM | docs/COMMUNITY.md | 44 | | [OWASP Agentic Top 10 — What Every AI Developer Should Know in 2026](https://dev.to/zhangzeyu/owasp-agentic-top-10-wha | CODE |
| MEDIUM | docs/COMMUNITY.md | 69 | | [Comparing Agent Governance Approaches](https://github.com/microsoft/agent-governance-toolkit/blob/main/agent-governan | CODE |
| MEDIUM | docs/COMMUNITY.md | 88 | | [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Security ri | CODE |
| MEDIUM | docs/FAQ.md | 713 | | OWASP Agentic Top 10 | https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ | | CODE |
| MEDIUM | docs/modern-agent-architecture-overview.md | 320 | | OWASP Compliance | [../docs/compliance/owasp-agentic-top10-architecture.md](https://github.com/microsoft/agent-governa | CODE |
| MEDIUM | docs/index.md | 16 | # Ship autonomous agents with enforceable guardrails | COMMENT |
| MEDIUM | docs/specs/AGENT-HYPERVISOR-EXECUTION-CONTROL-1.0.md | 43 | 15. [Saga Orchestration](#15-saga-orchestration) | CODE |
| MEDIUM | docs/compliance/mcp-owasp-top10-mapping.md | 399 | | [OWASP Agentic Top 10 (2026)](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Mapp | CODE |
| MEDIUM | docs/compliance/owasp-agentic-top10-architecture.md | 22 | The [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applicati | CODE |
| MEDIUM | docs/compliance/owasp-asi-policy-mapping.md | 19 | - [OWASP Top 10 for Agentic Applications (2026)](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications- | CODE |
| MEDIUM | docs/compliance/owasp-asi-policy-mapping.md | 169 | **OWASP reference:** [OWASP Top 10 for Agentic Applications (2026)](https://genai.owasp.org/resource/owasp-top-10-for-ag | CODE |
| MEDIUM | docs/compliance/nist-rfi-2026-00206.md | 75 | - Risk mapping and mitigation examples: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.m | CODE |
| MEDIUM | docs/compliance/nist-rfi-2026-00206.md | 78 | ### 1(b) Variation by model capability, scaffold, deployment, hosting, use case | COMMENT |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 114 | - Human-in-the-loop policies: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https:/ | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 115 | - Sandboxing / hypervisor: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://gi | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 117 | ### 2(b) Effectiveness variation by model/scaffold/deployment | COMMENT |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 121 | - Identity alternatives: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://gith | CODE |
| MEDIUM | docs/compliance/nist-rfi-2026-00206.md | 140 | - Identity frameworks: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://github | CODE |
| MEDIUM | docs/compliance/nist-rfi-2026-00206.md | 153 | - Telemetry/tracing: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://github.c | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 185 | - Hypervisor / sandbox designs: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 186 | - ResourceGovernor usage: [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://git | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 191 | - **Evidence:** [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://github.com/micr | CODE |
| MEDIUM⚡ | docs/compliance/nist-rfi-2026-00206.md | 201 | - **Evidence:** [agent-governance-python/agent-compliance/docs/analyst/owasp-agentic-mapping.md](https://github.com/micr | CODE |
| MEDIUM | docs/compliance/index.md | 60 | | Singapore Model AI Governance Framework (MGF) | [`agent-governance-python/agent-compliance/docs/compliance/singapore-m | CODE |
| MEDIUM⚡ | docs/compliance/atf-conformance-assessment.md | 354 | - [ATF Specification](https://github.com/massivescale-ai/agentic-trust-framework) | CODE |
| MEDIUM⚡ | docs/compliance/atf-conformance-assessment.md | 355 | - [ATF Conformance Specification v0.9.0](https://github.com/massivescale-ai/agentic-trust-framework/blob/main/CONFORMANC | CODE |
| MEDIUM⚡ | docs/compliance/atf-conformance-assessment.md | 357 | - [OWASP Agentic Security Top 10](https://owasp.org/www-project-agentic-security/) | CODE |
| MEDIUM | docs/case-studies/TEMPLATE.md | 240 | OWASP Agentic System Integrity (ASI) is a security project and framework focused on identifying and mitigating the uniqu | CODE |
| MEDIUM | docs/packages/agent-sre.md | 442 | │ │ ├── indicators.py # 7 built-in SLIs (task success, cost, hallucination, etc.) | CODE |
| MEDIUM | docs/packages/agent-compliance.md | 27 | [Architecture](#architecture) • [Quick Start](#quick-start) • [Components](#components) • [Why Unified?](#why-a-unified- | CODE |
| MEDIUM | docs/packages/agent-compliance.md | 231 | The agent governance stack covers **10 of 10** risks from the [OWASP Top 10 for Agentic Applications (2026)](https://gen | CODE |
| MEDIUM | docs/packages/agent-os.md | 464 | # Create a governed multi-agent session | COMMENT |
| MEDIUM | docs/packages/agent-hypervisor.md | 557 | | [Agent SRE](https://github.com/microsoft/agent-governance-toolkit) | SLO, chaos, and cost guardrails | | CODE |
| MEDIUM | docs/tutorials/24-cost-and-token-budgets.md | 197 | # Allocate a context window for an agent | COMMENT |
| MEDIUM | docs/tutorials/24-cost-and-token-budgets.md | 387 | # 2. Allocate context window | COMMENT |
| MEDIUM | docs/tutorials/11-saga-orchestration.md | 39 | 9. [Real-World Example: Multi-Agent Data Pipeline](#9-real-world-example-multi-agent-data-pipeline) | CODE |
| MEDIUM | docs/tutorials/16-protocol-bridges.md | 55 | | [Multi-Protocol Orchestration](#8-multi-protocol-orchestration) | Agents communicating via different protocols | | CODE |
| MEDIUM | docs/tutorials/README.md | 190 | ### 🤖 "I'm building multi-agent systems" | COMMENT |
| MEDIUM | docs/tutorials/06-execution-sandboxing.md | 33 | 5. [Saga Orchestration](#5-saga-orchestration) | CODE |
| MEDIUM | docs/tutorials/06-execution-sandboxing.md | 450 | ### 5.4 Programmatic saga orchestration | COMMENT |
| MEDIUM | docs/i18n/README.es.md | 39 | [](../compliance/owasp- | CODE |
| MEDIUM | docs/i18n/README.ja.md | 22 | [](../compliance/owasp-ag | CODE |
| MEDIUM | docs/i18n/README.zh-TW.md | 20 | [](../compliance/owasp-ag | CODE |
| MEDIUM | docs/i18n/README.zh-CN.md | 20 | [](../compliance/owasp-ag | CODE |
| MEDIUM | docs/i18n/README.ko.md | 38 | [](../compliance/owasp-ag | CODE |
| MEDIUM | docs/reference/comparison.md | 15 | When evaluating agent security tooling, developers often encounter [NeMo Guardrails](https://github.com/NVIDIA/NeMo-Guar | CODE |
| MEDIUM | docs/reference/comparison.md | 45 | > ¹ **OWASP scoring methodology:** Each tool was assessed against the ten [OWASP Agentic Top 10 (2026)](https://genai.ow | CODE |
| MEDIUM | docs/proposals/COSAI-WS4-PROPOSAL.md | 9 | **Submission:** [cosai-oasis/ws4-secure-design-agentic-systems#42](https://github.com/cosai-oasis/ws4-secure-design-agen | CODE |
| MEDIUM | docs/proposals/COSAI-WS4-PROPOSAL.md | 9 | **Submission:** [cosai-oasis/ws4-secure-design-agentic-systems#42](https://github.com/cosai-oasis/ws4-secure-design-agen | CODE |
| MEDIUM | docs/proposals/COSAI-WS4-PROPOSAL.md | 110 | - [OWASP Agentic Top 10 Compliance Mapping](https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/complia | CODE |
| MEDIUM | docs/proposals/COSAI-WS4-PROPOSAL.md | 114 | - [CoSAI Secure MCP Tool Design](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/practical-gu | CODE |
| MEDIUM | docs/proposals/ANTHROPIC-INTEGRATION-PROPOSAL.md | 59 | │ └── policy-init.md # /policy-init — scaffold governance config | CODE |
| MEDIUM | docs/proposals/OWASP-ASI-PROPOSAL.md | 88 | - Full compliance mapping: [OWASP-COMPLIANCE.md](https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/co | CODE |
| MEDIUM | docs/proposals/OWASP-ASI-PROPOSAL.md | 95 | - [OWASP Agentic Top 10](https://owasp.org/www-project-agentic-ai-threats-and-mitigations/) | CODE |
| MEDIUM | docs/proposals/LFAI-PROPOSAL.md | 112 | - [OWASP Compliance Mapping](https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/compliance/owasp-agent | CODE |
| MEDIUM | docs/proposals/README.md | 25 | | **CoSAI/OASIS WS4** | [cosai-oasis/ws4#86](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/issues/86) | CODE |
| 111 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/TESTING_GUIDE.md | 39 | ### Step 1: Clone and install | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 50 | ### Step 2: Set your LLM API key | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 68 | ### Step 3: Run the demo | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 83 | ### Step 4: Run adversarial attacks | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 110 | ### Step 1: Install | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 116 | ### Step 2: Create a policy file | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 149 | ### Step 3: Use the toolkit in your code | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 189 | ### Step 4: Add to a LangChain/CrewAI/ADK agent | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 205 | ### Step 1: Install | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 211 | ### Step 2: Run the SQL policy tests | COMMENT |
| LOW | docs/TESTING_GUIDE.md | 226 | ### Step 3: Test with custom YAML config | COMMENT |
| LOW | docs/modern-agent-architecture-overview.md | 198 | ### Step 1: Install | COMMENT |
| LOW | docs/modern-agent-architecture-overview.md | 206 | ### Step 2: Your First Governed Agent | COMMENT |
| LOW | docs/modern-agent-architecture-overview.md | 233 | ### Step 3: Wrap an Existing Framework | COMMENT |
| LOW | docs/modern-agent-architecture-overview.md | 251 | ### Step 4: Verify OWASP Coverage | COMMENT |
| LOW⚡ | docs/integrations/mcp-trust-guide.md | 704 | # Step 1: Authorization | COMMENT |
| LOW⚡ | docs/integrations/mcp-trust-guide.md | 714 | # Step 2: Tool definition scan | COMMENT |
| LOW⚡ | docs/integrations/mcp-trust-guide.md | 721 | # Step 3: Runtime interception | COMMENT |
| LOW⚡ | docs/integrations/mcp-trust-guide.md | 726 | # Step 4: Execute the tool (your MCP server call here) | COMMENT |
| LOW⚡ | docs/integrations/mcp-trust-guide.md | 729 | # Step 5: Update trust based on outcome | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 72 | ## Step 1: Basic Budget Setup | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 90 | ## Step 2: Pre-Task Budget Check | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 106 | ## Step 3: Record Costs and Get Alerts | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 131 | ## Step 4: Watch Alerts Escalate | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 162 | ## Step 5: Organization-Wide Budget | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 186 | ## Step 6: Cost Anomaly Detection | COMMENT |
| LOW | docs/tutorials/51-cost-governance.md | 206 | ## Step 7: Cost Optimization Suggestions | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 79 | ## Step 1: Set Up Signal Sources | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 121 | ## Step 2: Reconstruct a Single Decision | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 169 | ## Step 3: Add Trust Context | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 214 | ## Step 4: Full BOM with All Sources | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 247 | ## Step 5: Batch Reconstruction | COMMENT |
| LOW | docs/tutorials/50-decision-bom.md | 273 | ## Step 6: Export for Audit | COMMENT |
| LOW | docs/tutorials/19-dotnet-sdk.md | 469 | // Step 1: Create a cloud resource | STRING |
| LOW | docs/tutorials/19-dotnet-sdk.md | 487 | // Step 2: Update the configuration database | STRING |
| LOW | docs/tutorials/35-policy-composition.md | 32 | ## Step 1: Create the Org Baseline | COMMENT |
| LOW | docs/tutorials/35-policy-composition.md | 63 | ## Step 2: Create Platform Shared Controls | COMMENT |
| LOW | docs/tutorials/35-policy-composition.md | 91 | ## Step 3: Create App-Specific Policy | COMMENT |
| LOW | docs/tutorials/35-policy-composition.md | 123 | ## Step 4: Load and Evaluate | COMMENT |
| LOW | docs/tutorials/35-policy-composition.md | 149 | ## Step 5: Test Additive-Only Enforcement | COMMENT |
| LOW | docs/tutorials/35-policy-composition.md | 166 | ## Step 6: Use with govern() | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 57 | ## Step 1 - Create a policy file | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 80 | ## Step 2 - Register the governed server | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 108 | ## Step 3 - Register tools | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 174 | ## Step 4 - Understand runtime behavior | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 208 | ## Step 5 - Tune the options | COMMENT |
| LOW | docs/tutorials/42-csharp-mcp-extension.md | 257 | ## Step 6 - Use authenticated agent IDs | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 75 | ## Step 1: Create a Basic Rate Limit | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 103 | ## Step 2: Record Actions and Evaluate | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 133 | ## Step 3: Limit Concurrent Agents | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 168 | ## Step 4: Alert Without Blocking | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 190 | ## Step 5: Load Policies from Configuration | COMMENT |
| LOW | docs/tutorials/49-multi-agent-policies.md | 223 | ## Step 6: Monitor with Window Stats | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 40 | ## Step 1: Install | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 53 | ## Step 2: Scan Local Processes | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 82 | ## Step 3: Scan Filesystem for Config Artifacts | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 107 | ## Step 4: Build an Inventory with Deduplication | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 140 | ## Step 5: Reconcile Against Your Registry | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 186 | ## Step 6: Use the CLI | COMMENT |
| LOW | docs/tutorials/29-agent-discovery.md | 212 | ## Step 7: Write a Custom Scanner | COMMENT |
| 216 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | policy-engine/tests/artifact_enforcement_probe.py | 141 | CODE | |
| LOW | …icy-engine/generator/acs_generator/manifest_builder.py | 65 | CODE | |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 297 | CODE | |
| LOW | policy-engine/generator/acs_generator/init_flow.py | 350 | CODE | |
| LOW | policy-engine/generator/acs_generator/rego_builder.py | 51 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 170 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 210 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 280 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 316 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 337 | CODE | |
| LOW | policy-engine/generator/acs_generator/validation.py | 371 | CODE | |
| LOW | …gine/sdk/python/tests/test_fail_closed_error_parity.py | 56 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_real_packages.py | 415 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_real_packages.py | 441 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_telemetry.py | 538 | CODE | |
| LOW | policy-engine/sdk/python/tests/test_telemetry.py | 551 | CODE | |
| LOW | …k/python/agent_control_specification/_orchestration.py | 686 | CODE | |
| LOW | …e/sdk/python/agent_control_specification/validation.py | 83 | CODE | |
| LOW | …ython/agent_control_specification/_adapters/litellm.py | 715 | CODE | |
| LOW | …python/agent_control_specification/_adapters/openai.py | 398 | CODE | |
| LOW | …dk/python/agent_control_specification/_adapters/mcp.py | 205 | CODE | |
| LOW | …e/benchmarks/agentdojo/acs_agentdojo_bench/pipeline.py | 264 | CODE | |
| LOW | policy-engine/scripts/lint_logging.py | 195 | CODE | |
| LOW | tests/redteam/benchmark/benchmark.py | 189 | CODE | |
| LOW | tests/ci/test_regression_credential_boundary.py | 88 | CODE | |
| LOW | …mples/physical-attestation-governed/getting_started.py | 104 | CODE | |
| LOW | …les/aegis-governance-profile/tests/test_compilation.py | 489 | CODE | |
| LOW | …les/aegis-governance-profile/tests/test_compilation.py | 512 | CODE | |
| LOW | examples/mcp-receipt-governed/demo.py | 21 | CODE | |
| LOW | examples/pipeline-governance/demo.py | 390 | CODE | |
| LOW | examples/pipeline-governance/demo.py | 182 | CODE | |
| LOW | examples/pipeline-governance/demo.py | 204 | CODE | |
| LOW | examples/k8s-agent-sandbox-governed/run_agent.py | 124 | CODE | |
| LOW | benchmarks/prompt-injection/harness/generate-corpus.py | 384 | CODE | |
| LOW | benchmarks/prompt-injection/harness/generate-corpus.py | 732 | CODE | |
| LOW | benchmarks/prompt-injection/harness/check-corpus.py | 135 | CODE | |
| LOW | scripts/check_lockfile_integrity.py | 860 | CODE | |
| LOW | scripts/check_release_age.py | 140 | CODE | |
| LOW | scripts/check_release_age.py | 203 | CODE | |
| LOW | scripts/check_release_age.py | 301 | CODE | |
| LOW | scripts/check_license_headers.py | 104 | CODE | |
| LOW | scripts/credential_audit.py | 215 | CODE | |
| LOW | scripts/contributor_check.py | 514 | CODE | |
| LOW | scripts/contributor_check.py | 601 | CODE | |
| LOW | scripts/contributor_check.py | 803 | CODE | |
| LOW | scripts/sync-version.py | 167 | CODE | |
| LOW | scripts/check_install_scripts.py | 235 | CODE | |
| LOW | scripts/check_install_scripts.py | 262 | CODE | |
| LOW | scripts/check_install_scripts.py | 352 | CODE | |
| LOW | scripts/check_vendor_imports.py | 38 | CODE | |
| LOW | scripts/check_vendor_imports.py | 53 | CODE | |
| LOW | scripts/check_dependency_confusion.py | 389 | CODE | |
| LOW | scripts/check_dependency_confusion.py | 415 | CODE | |
| LOW | scripts/check_dependency_confusion.py | 425 | CODE | |
| LOW | scripts/check_dependency_confusion.py | 496 | CODE | |
| LOW | scripts/_supply_chain_common.py | 191 | CODE | |
| LOW | scripts/check_dependency_scorecard.py | 199 | CODE | |
| LOW | scripts/check_dependency_scorecard.py | 426 | CODE | |
| LOW | scripts/check_dependency_scorecard.py | 639 | CODE | |
| LOW | scripts/cluster_detect.py | 159 | CODE | |
| 338 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …python/examples/real_packages/foundry_agent_guarded.py | 98 | # Create the hosted agent with the tool definitions but WITHOUT enabling | COMMENT |
| MEDIUM | examples/terraform-azure/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | examples/mcp-receipt-governed/demo.py | 39 | # Create the adapter | COMMENT |
| MEDIUM | examples/terraform-aws/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …/agent-compliance/src/agent_compliance/cli/red_team.py | 286 | # Create a chaos experiment with all adversarial fault types registered | COMMENT |
| MEDIUM | …-governance-python/agent-os/tests/nexus/test_client.py | 198 | # Create a transfer | COMMENT |
| MEDIUM⚡ | …overnance-python/agent-os/examples/copilot_governed.py | 309 | # Create a temporary workspace | STRING |
| MEDIUM⚡ | …agent-os/examples/crewai-safe-mode/crewai_safe_mode.py | 360 | # Create the crew | COMMENT |
| MEDIUM⚡ | …-python/agent-os/examples/carbon-auditor/demo_audit.py | 79 | # Create a trace context for distributed tracing (AMB-004) | COMMENT |
| MEDIUM | …ples/carbon-auditor/data/projects/sample-projects.yaml | 6 | # This file contains synthetic data modeled after real projects. | COMMENT |
| MEDIUM | …vernance-python/agent-os/examples/hello-world/agent.py | 18 | # Create a stateless kernel (includes read_only, no_pii, strict policies) | COMMENT |
| MEDIUM | …/agent-os/examples/self-evaluating/tests/test_agent.py | 23 | # Create a test memory file using tempfile for cross-platform compatibility | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_decoupled.py | 51 | # Create a test stream file | COMMENT |
| MEDIUM | …mples/self-evaluating/tests/test_polymorphic_output.py | 373 | # Create a component with nested children | COMMENT |
| MEDIUM | …xamples/self-evaluating/tests/test_intent_detection.py | 120 | # Create a test stream file | COMMENT |
| MEDIUM | …s/self-evaluating/tests/test_constraint_engineering.py | 362 | # Create a custom rule using constraint_engine module | COMMENT |
| MEDIUM | …s/examples/self-evaluating/tests/test_orchestration.py | 33 | # Create a valid workflow | COMMENT |
| MEDIUM | …s/examples/self-evaluating/tests/test_orchestration.py | 205 | # Create a simple worker | COMMENT |
| MEDIUM | …s/examples/self-evaluating/tests/test_orchestration.py | 218 | # Create a simple single-step workflow | COMMENT |
| MEDIUM⚡ | …s/examples/self-evaluating/tests/test_orchestration.py | 363 | # Create a worker that fails | COMMENT |
| MEDIUM⚡ | …s/examples/self-evaluating/tests/test_orchestration.py | 367 | # Create a fallback worker | COMMENT |
| MEDIUM | …/examples/self-evaluating/tests/test_wisdom_curator.py | 95 | # Create a design check review | COMMENT |
| MEDIUM | …/examples/self-evaluating/tests/test_wisdom_curator.py | 151 | # Create a strategic sample | COMMENT |
| MEDIUM | …lf-evaluating/tests/test_wisdom_curator_integration.py | 45 | # Create an event that will trigger learning | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 25 | # Create a basic event | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 68 | # Create a temporary file | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 89 | # Create a temporary file | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 125 | # Create a temporary file | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 161 | # Create a temporary file | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 198 | # Create a temporary file | COMMENT |
| MEDIUM | …nt-os/examples/self-evaluating/tests/test_telemetry.py | 233 | # Create a temporary file | COMMENT |
| MEDIUM | …s/self-evaluating/tests/test_evaluation_engineering.py | 105 | # Create a temporary file | COMMENT |
| MEDIUM | …s/self-evaluating/tests/test_evaluation_engineering.py | 272 | # Create a simple dataset | COMMENT |
| MEDIUM | …s/self-evaluating/tests/test_evaluation_engineering.py | 287 | # Create a simple rubric | COMMENT |
| MEDIUM | …s/self-evaluating/tests/test_evaluation_engineering.py | 297 | # Create a simple AI function that always returns "4" | COMMENT |
| MEDIUM | …self-evaluating/examples/example_polymorphic_output.py | 329 | # Create a chart response | COMMENT |
| MEDIUM | …les/self-evaluating/examples/example_agent_metadata.py | 37 | # Create a metadata manifest for a specialized agent | COMMENT |
| MEDIUM | …les/self-evaluating/examples/example_wisdom_curator.py | 58 | # Create a design check review | COMMENT |
| MEDIUM | …thon/agent-os/examples/self-evaluating/src/observer.py | 614 | # Create a critique based on intent-specific failure | STRING |
| MEDIUM | …s/examples/self-evaluating/src/universal_signal_bus.py | 162 | # Create a query that describes the change | COMMENT |
| MEDIUM | agent-governance-python/agent-os/scripts/quickstart.sh | 38 | # Create a simple agent | COMMENT |
| MEDIUM⚡ | …agent-os/modules/caas/tests/test_metadata_injection.py | 26 | # Create a simple section | COMMENT |
| MEDIUM⚡ | …agent-os/modules/caas/tests/test_metadata_injection.py | 33 | # Create a mock document | COMMENT |
| MEDIUM | …agent-os/modules/caas/tests/test_metadata_injection.py | 68 | # Create an HTML document with hierarchy | COMMENT |
| MEDIUM | …agent-os/modules/caas/tests/test_metadata_injection.py | 202 | # Create a document with explicit parent relationships | COMMENT |
| MEDIUM | …os/modules/caas/tests/test_structure_aware_indexing.py | 24 | # Create a code document with different tier content | COMMENT |
| MEDIUM | …-python/agent-os/modules/caas/tests/test_time_decay.py | 113 | # Create a document store | COMMENT |
| MEDIUM | …-python/agent-os/modules/caas/tests/test_time_decay.py | 195 | # Create a recent document | COMMENT |
| MEDIUM | …on/agent-os/modules/caas/tests/test_pragmatic_truth.py | 237 | # Create a document with conflicting sections | COMMENT |
| MEDIUM | …ernance-python/agent-os/modules/caas/tests/test_vfs.py | 26 | # Create a file | COMMENT |
| MEDIUM | …thon/agent-os/modules/caas/tests/test_functionality.py | 116 | # Create a test document | COMMENT |
| MEDIUM | …ce-python/agent-os/modules/caas/src/caas/enrichment.py | 79 | # Create a new section with enriched content | COMMENT |
| MEDIUM | …python/agent-os/modules/caas/src/caas/storage/store.py | 315 | # Create a list of sections with adjusted weights (don't mutate original) | COMMENT |
| MEDIUM | …python/agent-os/modules/caas/src/caas/storage/store.py | 319 | # Create a shallow copy of the section and adjust weight | COMMENT |
| MEDIUM | …ce-python/agent-os/modules/emk/examples/basic_usage.py | 20 | # Create a temporary file for storage using secure method | COMMENT |
| MEDIUM | …nce-python/agent-os/modules/amb/tests/test_features.py | 450 | # Create an already-expired message | COMMENT |
| MEDIUM⚡ | …ance-python/agent-os/modules/amb/tests/test_tracing.py | 44 | # Create a trace context and publish message within it | COMMENT |
| MEDIUM | …hon/agent-os/modules/amb/examples/advanced_features.py | 30 | # Define a schema for fraud alerts | COMMENT |
| MEDIUM | …hon/agent-os/modules/amb/examples/advanced_features.py | 126 | # Create a child span | COMMENT |
| MEDIUM | …governance-python/agent-os/modules/atr/atr/executor.py | 185 | # Import required modules | COMMENT |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-hooks.yaml | 1 | # Pre-commit hooks for Agent Governance Toolkit. | COMMENT |
| LOW | .gitleaks.toml | 1 | # Gitleaks configuration for the AGT monorepo. | COMMENT |
| LOW | .cspell-repo-terms.txt | 1 | COMMENT | |
| LOW | .cspell-repo-terms.txt | 21 | # --- West/North Africa regulatory policy terms --- | COMMENT |
| LOW | policy-engine/core/tests/committed_manifests.rs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | policy-engine/core/src/lib.rs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | policy-engine/core/src/lib.rs | 21 | //! | `InterventionPointResult` | `runtime::EvaluationResult` | | COMMENT |
| LOW | policy-engine/core/src/telemetry_sinks.rs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | policy-engine/core/src/identity.rs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | policy-engine/core/src/manifest_yaml.rs | 21 | pub use agent_control_spec::SUPPORTED_VERSIONS; | COMMENT |
| LOW | …ine/integrations/annotators/examples/live_llm_judge.rs | 1 | //! Live exercise of the reference annotators against real endpoints. | COMMENT |
| LOW | policy-engine/integrations/annotators/src/lib.rs | 1 | //! Reference annotator dispatchers for Agent Control Specification. | COMMENT |
| LOW | policy-engine/integrations/rig/src/lib.rs | 1 | //! Real [Rig](https://docs.rig.rs) integration for Agent Control Specification. | COMMENT |
| LOW | policy-engine/generator/acs_generator/rego_builder.py | 101 | def _read_expr_for_path(path: str) -> str: | COMMENT |
| LOW | …hon/examples/real_packages/foundry_governance.acs.yaml | 1 | # Committed ACS manifest for the Azure AI Foundry tool-governance example. | COMMENT |
| LOW | policy-engine/sdk/rust/src/lib.rs | 1 | //! Agent Control Specification — Rust SDK. | COMMENT |
| LOW | policy-engine/sdk/rust/src/ffi.rs | 441 | } | COMMENT |
| LOW | policy-engine/sdk/rust/src/ffi.rs | 461 | unsafe { write_err(err, "null builder") }; | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/evaluation.rs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/evaluation.rs | 41 | /// Discharge the host obligations over a raw engine result. | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 121 | agent_control_spec::OpaPolicyDispatcher::with_runner( | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 201 | /// range, and DNS rebinding between this check and the connect, need a | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 241 | "URL '{url}' targets a blocked destination ({detail}); manifest fetches must \ | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 261 | /// instead of following it. `ureq` never raises a redirect error at this | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 281 | /// fetcher follows redirects inside its HTTP client without re-checking each | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/mod.rs | 441 | Self::from_manifest_with_dispatchers_and_limits( | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/snapshot.rs | 21 | // AGT D1: transform permits the action. The engine never applies | COMMENT |
| LOW | policy-engine/sdk/rust/src/host/tests.rs | 1201 | // re-running the guard and exposes no hook, so a vetted public URL could | COMMENT |
| LOW | …ControlSpecification.Tests/Agt1TransformGateHarness.cs | 1 | using System.Text.Json; | COMMENT |
| LOW | …sdk/dotnet/src/AgentControlSpecification/Primitives.cs | 121 | /// </summary> | COMMENT |
| LOW | …sdk/dotnet/src/AgentControlSpecification/Primitives.cs | 141 | } | COMMENT |
| LOW | policy-engine/scripts/demo_end_to_end.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | policy-engine/scripts/demo_end_to_end.sh | 21 | # clear status banner. Stops at the first failure and surfaces the | COMMENT |
| LOW | …otnet/tests/AgentGovernance.Tests/PolicyEngineTests.cs | 221 | Assert.Empty(engine.ListPolicies()); | COMMENT |
| LOW | …dotnet/tests/AgentGovernance.Tests/AuditLoggerTests.cs | 221 | Assert.True(logger.Verify()); | COMMENT |
| LOW | …gentGovernance.Tests/PolicyBackendArgumentListTests.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | …ts/AgentGovernance.Tests/OpaPolicyBackendAsyncTests.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | …examples/AspNetMiddleware/GovernanceCheckMiddleware.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | …amples/AspNetMiddleware/Controllers/ItemsController.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | agent-governance-dotnet/examples/Quickstart/Program.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 21 | /// </summary> | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 41 | /// </summary> | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 61 | /// Defaults to <c>false</c>. | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 81 | public CircuitBreakerConfig? CircuitBreakerConfig { get; init; } | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 101 | /// Console.WriteLine($"Blocked: {result.Reason}"); | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 121 | COMMENT | |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 141 | /// </summary> | COMMENT |
| LOW | …ernance-dotnet/src/AgentGovernance/GovernanceKernel.cs | 161 | COMMENT | |
| LOW | …dotnet/src/AgentGovernance/Security/CredentialVault.cs | 121 | /// cannot probe vault contents via deny shape. | COMMENT |
| LOW | …dotnet/src/AgentGovernance/Security/CredentialVault.cs | 481 | /// Workflow-policy allowlist of handle names eligible for substitution | COMMENT |
| LOW | …entGovernance/Security/HealthcareIdentifierDetector.cs | 61 | /// </summary> | COMMENT |
| LOW | …src/AgentGovernance/Security/PromptDefenseEvaluator.cs | 21 | /// Human-readable vector name. | COMMENT |
| LOW | …src/AgentGovernance/Security/PromptDefenseEvaluator.cs | 41 | /// <summary> | COMMENT |
| LOW | …src/AgentGovernance/Security/PromptDefenseEvaluator.cs | 61 | /// <summary> | COMMENT |
| LOW | …src/AgentGovernance/Security/PromptDefenseEvaluator.cs | 81 | /// <summary> | COMMENT |
| LOW | …rc/AgentGovernance/Integration/GovernanceMiddleware.cs | 21 | public bool Allowed { get; init; } | COMMENT |
| LOW | …rc/AgentGovernance/Integration/GovernanceMiddleware.cs | 41 | /// Agents call <see cref="EvaluateToolCall"/> before executing any tool to enforce | COMMENT |
| LOW | …overnance-dotnet/src/AgentGovernance/Mcp/McpGateway.cs | 81 | /// Gateway pipeline for governed MCP traffic. | COMMENT |
| LOW | …e-dotnet/src/AgentGovernance/Mcp/IResponseSanitizer.cs | 1 | // Copyright (c) Microsoft Corporation. Licensed under the MIT License. | COMMENT |
| LOW | …ce-dotnet/src/AgentGovernance/Audit/GovernanceEvent.cs | 41 | { | COMMENT |
| 226 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/ci/test_regression_credential_boundary.py | 272 | # The catch-all or any non-Slack arm must not unconditionally return false | COMMENT |
| HIGH | tests/ci/test_regression_ci_test_swallow.py | 8 | pip install ... --require-hashes -r ci-test.txt 2>/dev/null || true | STRING |
| HIGH | tests/ci/test_regression_ci_test_swallow.py | 41 | f"failures via `2>/dev/null || true`. Window:\n{window}" | CODE |
| HIGH | examples/k8s-agent-sandbox-governed/test_run_agent.py | 24 | "echo ok && rm -rf /", | CODE |
| HIGH | examples/k8s-agent-sandbox-governed/test_run_agent.py | 26 | "cd /tmp && rm -rf ./build", | CODE |
| HIGH⚡ | examples/k8s-agent-sandbox-governed/test_run_agent.py | 86 | "echo hello && ls -la", | CODE |
| HIGH | scripts/ci/generate_workflows.py | 353 | " group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}", | CODE |
| HIGH | scripts/tests/test_supply_chain_common.py | 452 | """Removed file (+++ /dev/null) must not become a current_file.""" | STRING |
| HIGH | …sh-integrations/cedarling-acs/tests/test_dispatcher.py | 311 | ' context has device && context.device != "mobile"\n' | CODE |
| HIGH⚡ | …nt-compliance/src/agent_compliance/security/scanner.py | 282 | - line: Line number (integer or null) | STRING |
| HIGH⚡ | …nt-compliance/src/agent_compliance/security/scanner.py | 283 | - cve: CVE identifier (string or null) | STRING |
| HIGH⚡ | …nt-compliance/src/agent_compliance/security/scanner.py | 284 | - expires: ISO 8601 datetime (string or null) | STRING |
| HIGH⚡ | …ce-python/agent-os/tests/test_conversation_guardian.py | 174 | score, _ = d.score_message("pip install flask-unsign && flask-unsign --decode") | CODE |
| HIGH | …vernance-python/agent-os/examples/hello-world/agent.py | 7 | Run with: pip install agent-os-kernel && python agent.py | STRING |
| HIGH | …-python/agent-os/examples/quickstart/my_first_agent.py | 7 | Run with: pip install agent-os-kernel && python my_first_agent.py | STRING |
| HIGH | …n/agent-os/services/cloud-board/api/routes/registry.py | 97 | (verification_key || proof_timestamp) with the private key | STRING |
| HIGH | …overnance-python/agent-os/src/agent_os/cli/__init__.py | 127 | suggestion="Run: agentos init && agentos secure", | CODE |
| HIGH | …thon/agt-policies/tests/test_migrate_snapshot_guard.py | 5 | ``input.snapshot`` is absent, null, or a non-object, every field accessor is | STRING |
| HIGH | …thon/agt-policies/tests/test_migrate_snapshot_guard.py | 6 | undefined, no ``_match_i`` rule fires, and evaluation would fall through to the | STRING |
| HIGH⚡ | …e-python/agt-policies/tests/test_migrate_resolution.py | 1394 | assert out == 'object.get(input.snapshot, ["content_hash"], null)' | CODE |
| HIGH⚡ | …e-python/agt-policies/tests/test_migrate_resolution.py | 1399 | assert out == 'object.get(input.snapshot, ["tool_call", "content_hash"], null)' | CODE |
| HIGH⚡ | …e-python/agt-policies/tests/test_migrate_resolution.py | 1412 | assert out == 'object.get(input.snapshot, ["a", "b", "c"], null)' | CODE |
| HIGH⚡ | …e-python/agt-policies/tests/test_migrate_resolution.py | 1525 | assert 'object.get(input.snapshot, ["tool_call", "content_hash"], null)' in rego | CODE |
| HIGH | …e-python/agt-policies/tests/test_migrate_resolution.py | 581 | "deny and[eq null, ne X] fires on region==null; child allow eq null " | CODE |
| HIGH | …e-python/agt-policies/tests/test_migrate_resolution.py | 543 | """Deny ``and[eq null, ne X]`` fires on an absent field; overlap must drop child. | STRING |
| HIGH | …cenarios/test_null_and_string_predicate_fail_closed.py | 9 | ``object.get(..., null)`` default collapses absent and present-null, so a | STRING |
| HIGH | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 334 | # null, or not an object, every field accessor is undefined, no _match_i | COMMENT |
| HIGH | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 340 | # itself undefined), so the absent-snapshot case would leak through to | COMMENT |
| HIGH | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 356 | "\"message\": \"input.snapshot is absent, null, or not an object; " | CODE |
| HIGH | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 390 | return f"object.get(input.snapshot, {json.dumps(parts)}, null)" | CODE |
| HIGH⚡ | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 431 | # field and a genuinely present null, collapsing the two, so a | COMMENT |
| HIGH⚡ | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 438 | if accessor.endswith(", null)"): | CODE |
| HIGH⚡ | …/agt-policies/src/agt/cli/_migrate_resolution/build.py | 440 | accessor[: -len(", null)")] | CODE |
| HIGH⚡ | …n/agent-hypervisor/tests/unit/test_command_denylist.py | 138 | result = self.enforcer.check_command("curl && rm -rf /") | CODE |
| HIGH | agent-governance-python/agent-mesh/tests/test_x3dh.py | 193 | """Associated data is initiator IK || responder IK.""" | STRING |
| HIGH | …ython/agent-mesh/examples/trust-dashboard/dashboard.py | 163 | let histChart=null, tierChart=null; | CODE |
| HIGH | …ython/agent-mesh/examples/trust-dashboard/dashboard.py | 238 | datasets.push({ | CODE |
| HIGH | …nce-python/agent-mesh/src/agentmesh/encryption/x3dh.py | 367 | KDF input = F || KM | STRING |
| HIGH | …python/agent-mesh/src/agentmesh/server/trust_engine.py | 74 | proof: str = Field(..., description="Base64 Ed25519 signature over (public_key || proof_timestamp)") | CODE |
| HIGH | …e-python/agent-mesh/src/agentmesh/governance/policy.py | 1019 | f"rego source (data.{package} is undefined) — every " | CODE |
| HIGH | …ance-python/agent-mesh/src/agentmesh/governance/opa.py | 336 | # declaration — which is undefined, not a Rego error: opa eval | COMMENT |
| HIGH | …-python/agent-mesh/src/agentmesh/reward/trust_decay.py | 341 | """KL(P || Q) with Laplace smoothing.""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | …ance-python/agent-sandbox/tests/test_docker_sandbox.py | 1625 | provider._client.containers.run.return_value.exec_run.assert_not_called() | CODE |
| CRITICAL | …/src/main/kotlin/com/agentos/plugin/actions/Actions.kt | 104 | val toolWindowManager = com.intellij.openapi.wm.ToolWindowManager.getInstance(project) | CODE |
| CRITICAL | …/src/main/kotlin/com/agentos/plugin/actions/Actions.kt | 116 | com.intellij.openapi.options.ShowSettingsUtil.getInstance() | CODE |
| CRITICAL | …/src/main/kotlin/com/agentos/plugin/actions/Actions.kt | 147 | com.intellij.openapi.vfs.LocalFileSystem.getInstance().refreshAndFindFileByPath(configFile.absolutePath) | CODE |
| CRITICAL | …python/agent-os/extensions/chrome/devtools/devtools.js | 35 | chrome.devtools.panels.elements.onSelectionChanged.addListener(() => { | CODE |
| CRITICAL⚡ | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 436 | return self._client.beta.threads.messages.list( | CODE |
| CRITICAL⚡ | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 691 | return self._client.beta.threads.runs.submit_tool_outputs( | CODE |
| CRITICAL | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 418 | message = self._client.beta.threads.messages.create( | CODE |
| CRITICAL | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 497 | run = self._client.beta.threads.runs.create(**run_kwargs) | CODE |
| CRITICAL | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 529 | with self._client.beta.threads.runs.stream( | CODE |
| CRITICAL | …n/agent-os/src/agent_os/integrations/openai_adapter.py | 571 | run = self._client.beta.threads.runs.retrieve( | CODE |
| CRITICAL | …icies/tests/scenarios/test_openai_adapter_scenarios.py | 134 | client.beta.threads.messages.create.assert_called_once() | CODE |
| CRITICAL | …icies/tests/scenarios/test_openai_adapter_scenarios.py | 161 | client.beta.threads.messages.create.assert_not_called() | CODE |
| CRITICAL | …icies/tests/scenarios/test_openai_adapter_scenarios.py | 187 | client.beta.threads.messages.create.assert_called_once() | CODE |
| CRITICAL | …icies/tests/scenarios/test_openai_adapter_scenarios.py | 217 | client.beta.threads.messages.create.assert_called_once() | CODE |
| CRITICAL | …icies/tests/scenarios/test_openai_adapter_scenarios.py | 236 | client.beta.threads.messages.create.assert_not_called() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/ci/test_regression_credential_boundary.py | 214 | # Check if this arm opens a block | COMMENT |
| LOW⚡ | examples/cost-governance/cost_governance_demo.py | 64 | # Check if killed | COMMENT |
| LOW | examples/pipeline-governance/demo.py | 176 | # Check if this is a bare forbid (no when clause) | COMMENT |
| LOW | scripts/contributor_check.py | 460 | # Check if created within 48-hour windows | COMMENT |
| LOW | scripts/ci/security-audit-required.sh | 28 | # Check if any capability paths are touched | COMMENT |
| LOW | scripts/ci/no-unauthed-registration.sh | 37 | # Check if the file has proof-of-possession verification | COMMENT |
| LOW | …tions/langchain-agentmesh/langchain_agentmesh/trust.py | 805 | # Check if delegation is still valid | COMMENT |
| LOW | …s/langchain-agentmesh/langchain_agentmesh/callbacks.py | 187 | # Check if tool requires verification | COMMENT |
| LOW | …s/langchain-agentmesh/langchain_agentmesh/callbacks.py | 189 | # Check if invoker is in verified peers | COMMENT |
| LOW | …governance-python/agentmesh-integrations/dify/trust.py | 188 | # Check if we have historical score | COMMENT |
| LOW | …mpliance/src/agent_compliance/cli/contributor_check.py | 524 | # Check if created within 48-hour windows | COMMENT |
| LOW | …ce-python/agent-os/tests/test_layer2_infrastructure.py | 12 | # Check if optional packages are installed | COMMENT |
| LOW | …ernance-python/agent-os/tests/test_layer3_framework.py | 10 | # Check if control plane submodules are installed | COMMENT |
| LOW | …vernance-python/agent-os/tests/test_kernel_critical.py | 20 | # Check if optional modules are available | COMMENT |
| LOW | …rnance-python/agent-os/tests/test_layer1_primitives.py | 10 | # Check if optional packages are installed | COMMENT |
| LOW | agent-governance-python/agent-os/examples/run-demo.sh | 41 | # Check if demo exists | COMMENT |
| LOW | …nce-python/agent-os/examples/pharma-compliance/demo.py | 366 | # Check if draft claims stronger significance than actual | COMMENT |
| LOW | …rnance-python/agent-os/examples/iot-smart-home/main.py | 186 | # Check if in private room that's occupied | COMMENT |
| LOW | …vernance-python/agent-os/examples/legal-review/main.py | 383 | # Check if clause type is present | COMMENT |
| LOW | …vernance-python/agent-os/examples/legal-review/main.py | 509 | # Check if user is authorized | COMMENT |
| LOW | …ernance-python/agent-os/examples/hr-recruiting/main.py | 92 | # Check if key relates to protected characteristics | COMMENT |
| LOW | …t-os/examples/self-evaluating/tests/test_ghost_mode.py | 117 | os.close(fd) # Close the file descriptor immediately | CODE |
| LOW | …t-os/examples/self-evaluating/tests/test_ghost_mode.py | 452 | # Check if pattern was learned | COMMENT |
| LOW | …-evaluating/examples/example_evaluation_engineering.py | 172 | # Check if expected date is in the output | COMMENT |
| LOW | …les/self-evaluating/examples/example_agent_metadata.py | 316 | # Check if fetcher output matches transformer input | COMMENT |
| LOW | …les/self-evaluating/examples/example_agent_metadata.py | 325 | # Check if transformer output matches reporter input | COMMENT |
| LOW | …s/self-evaluating/examples/example_orchestration_ai.py | 294 | # Display results | COMMENT |
| LOW | …ples/self-evaluating/examples/example_orchestration.py | 238 | # Display results | COMMENT |
| LOW | …thon/agent-os/examples/self-evaluating/src/observer.py | 273 | # Check if issue was resolved (last event success status) | STRING |
| LOW | …on/agent-os/examples/self-evaluating/src/ghost_mode.py | 377 | # Check if we should surface this observation | COMMENT |
| LOW | …on/agent-os/examples/self-evaluating/src/ghost_mode.py | 538 | # Check if this matches a known pattern | COMMENT |
| LOW | …ent-os/examples/self-evaluating/src/circuit_breaker.py | 245 | # Check if metrics meet thresholds | COMMENT |
| LOW | …gent-os/examples/self-evaluating/src/prioritization.py | 187 | # Check if similar correction exists | COMMENT |
| LOW | …gent-os/examples/self-evaluating/src/prioritization.py | 229 | # Check if preference exists | COMMENT |
| LOW | …gent-os/examples/self-evaluating/src/prioritization.py | 263 | # Check if correction is recent | COMMENT |
| LOW | …gent-os/examples/self-evaluating/src/prioritization.py | 268 | # Check if correction is relevant to this user | COMMENT |
| LOW | …-python/agent-os/examples/self-evaluating/src/agent.py | 911 | # Check if score meets threshold | STRING |
| LOW⚡ | …-os/examples/self-evaluating/src/polymorphic_output.py | 174 | # Check if it's code | COMMENT |
| LOW⚡ | …-os/examples/self-evaluating/src/polymorphic_output.py | 181 | # Check if it's time series (list of dicts with timestamp) | COMMENT |
| LOW⚡ | …-os/examples/self-evaluating/src/polymorphic_output.py | 184 | # Check if it's tabular (list of dicts with same keys) | COMMENT |
| LOW | …nce-python/agent-os/examples/tool-using-agent/agent.py | 103 | # Check if agent wants to use a tool | COMMENT |
| LOW | …thon/agent-os/modules/caas/src/caas/pragmatic_truth.py | 285 | # Check if sections are about similar topics | COMMENT |
| LOW | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 294 | # Check if this path is a child of the directory | COMMENT |
| LOW | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 337 | # Check if this file is in the requested directory | COMMENT |
| LOW | …ce-python/agent-os/modules/caas/src/caas/api/server.py | 230 | # Read file content | COMMENT |
| LOW | …governance-python/agent-os/modules/amb/amb_core/bus.py | 265 | # Check if message is expired (AMB-007) | COMMENT |
| LOW⚡ | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 141 | # Check if there are messages to deliver | COMMENT |
| LOW⚡ | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 149 | # Check if this is a response message | COMMENT |
| LOW | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 198 | # Check if queue is at max capacity | COMMENT |
| LOW | …-python/agent-os/modules/amb/amb_core/memory_broker.py | 221 | # Check if this is a response message for request-response pattern | COMMENT |
| LOW⚡ | …dules/amb/amb_core/adapters/azure_servicebus_broker.py | 206 | # Check if message matches topic filter | COMMENT |
| LOW | …t-governance-python/agent-os/modules/nexus/registry.py | 103 | # Check if already registered | COMMENT |
| LOW | …t-governance-python/agent-os/modules/nexus/registry.py | 248 | # Check if registered | COMMENT |
| LOW | …overnance-python/agent-os/modules/atr/atr/injection.py | 370 | # Check if default is an injection marker | COMMENT |
| LOW | …overnance-python/agent-os/modules/atr/atr/decorator.py | 56 | # Check if it's a Union (which includes Optional) | COMMENT |
| LOW | …governance-python/agent-os/modules/atr/atr/policies.py | 222 | # Check if we can make a call | COMMENT |
| LOW | …governance-python/agent-os/modules/atr/atr/policies.py | 268 | # Check if we can make a call | COMMENT |
| LOW | …governance-python/agent-os/modules/atr/atr/executor.py | 262 | # Check if it's a timeout | COMMENT |
| LOW | …governance-python/agent-os/modules/atr/atr/executor.py | 326 | " # Print result with marker for parsing", | CODE |
| LOW | …hon/agent-os/modules/atr/atr/tools/safe/file_reader.py | 108 | # Check if within sandbox | COMMENT |
| 52 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | examples/mcp-trust-verified-server/server.py | 51 | # Step 1: Configure the trust proxy with per-tool policies. | COMMENT |
| LOW | examples/mcp-trust-verified-server/server.py | 73 | # Step 2: Register tool fingerprints for rug-pull detection. | COMMENT |
| LOW⚡ | scripts/credential_audit.py | 323 | # Step 1: Find merges | COMMENT |
| LOW⚡ | scripts/credential_audit.py | 329 | # Step 2: Find spray citations | COMMENT |
| LOW⚡ | scripts/credential_audit.py | 333 | # Step 3: Calculate spray window | COMMENT |
| LOW⚡ | .github/pipelines/esrp-publish.yml | 1251 | # Step 4: Push signed package to NuGet.org | COMMENT |
| LOW | .github/pipelines/esrp-publish.yml | 1153 | # Step 1: Authenticode sign DLLs inside the NuGet package | COMMENT |
| LOW | .github/pipelines/esrp-publish.yml | 1208 | # Step 2: Sign the .nupkg with ESRP NuGet Signing (CP-401405) | COMMENT |
| LOW | .github/pipelines/esrp-publish.yml | 1238 | # Step 3: Verify the signed NuGet package | COMMENT |
| LOW⚡ | …agent-compliance/examples/prompt_defense_governance.py | 180 | # Step 1: Evaluate prompt defense | COMMENT |
| LOW⚡ | …agent-compliance/examples/prompt_defense_governance.py | 185 | # Step 2: Governance verification (if toolkit installed) | COMMENT |
| LOW⚡ | …agent-compliance/examples/prompt_defense_governance.py | 208 | # Step 3: Deployment decision | COMMENT |
| LOW⚡ | …ompliance/src/agent_compliance/cli/credential_audit.py | 382 | # Step 1: Find merges | COMMENT |
| LOW⚡ | …ompliance/src/agent_compliance/cli/credential_audit.py | 388 | # Step 2: Find spray citations | COMMENT |
| LOW⚡ | …ompliance/src/agent_compliance/cli/credential_audit.py | 392 | # Step 3: Calculate spray window | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 480 | // Step 1: Fetch data from sources | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 483 | // Step 2: Process data | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 486 | // Step 3: Send to outputs | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 585 | // Step 1: Fetch data from sources | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 593 | // Step 2: Process data | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 601 | // Step 3: Send to outputs | COMMENT |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 389 | # Step 1: Fetch data from sources | STRING |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 392 | # Step 2: Process data | STRING |
| LOW⚡ | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 395 | # Step 3: Send to outputs | STRING |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 28 | // Step 1: Template selection | COMMENT |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 32 | // Step 2: Agent configuration | COMMENT |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 39 | // Step 3: Policy selection | COMMENT |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 50 | // Step 1: Template Selection | COMMENT |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 53 | // Step 2: Agent Configuration | COMMENT |
| LOW⚡ | …/kotlin/com/agentos/plugin/agents/AgentWizardDialog.kt | 56 | // Step 3: Policy Selection | COMMENT |
| LOW⚡ | …ance-python/agent-os/examples/customer-service/main.py | 595 | # Step 1: Classify | COMMENT |
| LOW⚡ | …ance-python/agent-os/examples/customer-service/main.py | 601 | # Step 2: Check escalation | COMMENT |
| LOW⚡ | …ance-python/agent-os/examples/customer-service/main.py | 642 | # Step 5: Verification | COMMENT |
| LOW⚡ | …ance-python/agent-os/examples/customer-service/main.py | 648 | # Step 6: Determine if human review needed | COMMENT |
| LOW | …ance-python/agent-os/examples/customer-service/main.py | 618 | # Step 3: Search knowledge base | COMMENT |
| LOW | …ance-python/agent-os/examples/customer-service/main.py | 631 | # Step 4: Policy check | COMMENT |
| LOW⚡ | …rnance-python/agent-os/examples/carbon-auditor/demo.py | 214 | # Step 1: Extract claim | COMMENT |
| LOW⚡ | …rnance-python/agent-os/examples/carbon-auditor/demo.py | 218 | # Step 2: Fetch satellite observation | COMMENT |
| LOW⚡ | …rnance-python/agent-os/examples/carbon-auditor/demo.py | 222 | # Step 3: Audit with CMVK | COMMENT |
| LOW | …ent-os/examples/carbon-auditor/src/agents/geo_agent.py | 89 | # Step 1: Fetch satellite imagery using atr tool | COMMENT |
| LOW | …ent-os/examples/carbon-auditor/src/agents/geo_agent.py | 105 | # Step 2: Calculate NDVI using atr tool | COMMENT |
| LOW | …ent-os/examples/carbon-auditor/src/agents/geo_agent.py | 119 | # Step 3: Build observation object | COMMENT |
| LOW⚡ | …-os/examples/carbon-auditor/src/agents/claims_agent.py | 71 | # Step 1: Parse PDF using atr tool | COMMENT |
| LOW⚡ | …-os/examples/carbon-auditor/src/agents/claims_agent.py | 80 | # Step 2: Extract structured data using atr tool | COMMENT |
| LOW⚡ | …-os/examples/carbon-auditor/src/agents/claims_agent.py | 87 | # Step 3: Build claim object | COMMENT |
| LOW | …es/self-evaluating/examples/sample_full_stack_agent.py | 96 | # Step 1: Normalize the input signal | COMMENT |
| LOW | …es/self-evaluating/examples/sample_full_stack_agent.py | 108 | # Step 2: Execute the task | COMMENT |
| LOW | …es/self-evaluating/examples/sample_full_stack_agent.py | 122 | # Step 3: Generate polymorphic output (if enabled) | COMMENT |
| LOW⚡ | …es/self-evaluating/examples/sample_full_stack_agent.py | 164 | # Step 4: Emit telemetry event (if enabled) | COMMENT |
| LOW⚡ | …es/self-evaluating/examples/sample_full_stack_agent.py | 181 | # Step 5: Return comprehensive result | COMMENT |
| LOW⚡ | …evaluating/examples/example_omnichannel_integration.py | 96 | # Step 1: Normalize Input | COMMENT |
| LOW⚡ | …evaluating/examples/example_omnichannel_integration.py | 103 | # Step 2: Agent Processing (simulated) | COMMENT |
| LOW⚡ | …evaluating/examples/example_omnichannel_integration.py | 109 | # Step 3: Generate Polymorphic Output | COMMENT |
| LOW | …evaluating/examples/example_omnichannel_integration.py | 131 | # Step 4: Generate UI Component | COMMENT |
| LOW | …/agent-os/examples/self-evaluating/src/orchestrator.py | 383 | # Step 1: Product Manager creates specs | COMMENT |
| LOW | …/agent-os/examples/self-evaluating/src/orchestrator.py | 395 | # Step 2: Coder implements | COMMENT |
| LOW | …/agent-os/examples/self-evaluating/src/orchestrator.py | 407 | # Step 3: Reviewer reviews | COMMENT |
| LOW⚡ | …agent-os/examples/self-evaluating/src/model_upgrade.py | 493 | # Step 1: Audit | STRING |
| LOW⚡ | …agent-os/examples/self-evaluating/src/model_upgrade.py | 501 | # Step 2: Purge (if auto_purge enabled) | STRING |
| LOW⚡ | …t-os/modules/control-plane/examples/getting_started.py | 144 | # Step 1: Create control plane | COMMENT |
| 16 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …e/tests/conformance/cases/spec-16-effects.case-04.json | 18 | "text": "Email jane@example.com and john@example.org" | CODE |
| LOW | …ield/policies/workiq-collaboration-dlp/app/run_demo.py | 64 | await check(control, InterventionPoint.PRE_TOOL_CALL, {"document_sensitivity": "internal", "email_read_this_turn": T | CODE |
| LOW | docs/javascripts/site.js | 9 | input.setAttribute('placeholder', 'Search or filter'); | CODE |
| LOW | …les/aegis-governance-profile/tests/test_compilation.py | 674 | "resource": 'Resource::"placeholder"', | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 48 | "placeholder": "Please Fill Out The Form", | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 59 | "placeholder": "Complete all fields below to continue", | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 103 | "placeholder": "Label for the input" | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 109 | "placeholder": "Variable name for the input (must be camel case)", | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 151 | "placeholder": "Foo" | CODE |
| LOW | examples/flowise-governance/flowise-flow.json | 157 | "placeholder": "Bar", | CODE |
| LOW | examples/adk-governed/adk_governance_demo.py | 104 | tool_args={"to": "user@example.com"}, | CODE |
| LOW | agent-governance-typescript/tests/mcp.test.ts | 194 | description: 'Lorem ipsum dolor sit amet. '.repeat(30), | CODE |
| LOW | agent-governance-typescript/tests/mcp.test.ts | 194 | description: 'Lorem ipsum dolor sit amet. '.repeat(30), | CODE |
| LOW | …on/agent-sandbox/tests/test_ring_enforcement_wiring.py | 369 | fake_detector.trip("agent1", "placeholder") # Will be overridden below | CODE |
| LOW⚡ | …ernance-python/agent-os/tests/test_mcp_session_auth.py | 20 | token = authenticator.create_session("did:mesh:agent-001", user_id="user@example.com") | CODE |
| LOW⚡ | …ernance-python/agent-os/tests/test_mcp_session_auth.py | 24 | assert session.user_id == "user@example.com" | CODE |
| LOW⚡ | …ernance-python/agent-os/tests/test_mcp_session_auth.py | 37 | token = authenticator.create_session("did:mesh:agent-001", user_id="user@example.com") | CODE |
| LOW⚡ | …ernance-python/agent-os/tests/test_mcp_session_auth.py | 43 | assert session.user_id == "user@example.com" | CODE |
| LOW | …ent-governance-python/agent-os/tests/test_stateless.py | 719 | params={"to": "user@example.com"}, | CODE |
| LOW⚡ | agent-governance-python/agent-os/tests/test_server.py | 26 | token = authenticator.create_session("test-agent", user_id="user@example.com") | CODE |
| LOW⚡ | …on/agent-os/tests/test_mcp_pii_and_response_gateway.py | 216 | decision = gw.intercept_tool_response('a1', 'tool', 'user@example.com') | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 834 | ("email", "user@example.com"), | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 863 | assert "user@example.com" not in redacted | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 869 | assert "user@example.com" in secrets_only | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 874 | "profile": {"email": "user@example.com"}, | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 880 | assert default["profile"]["email"] == "user@example.com" | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 885 | assert "user@example.com" not in scrubbed["profile"]["email"] | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 891 | payload = {"email": "user@example.com"} | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 892 | assert CredentialRedactor.redact_dictionary(payload)["email"] == "user@example.com" | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 893 | assert CredentialRedactor.redact_mapping(payload)["email"] == "user@example.com" | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 895 | "user@example.com" | CODE |
| LOW⚡ | …ance-python/agent-os/tests/test_credential_redactor.py | 899 | "user@example.com" | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 127 | result = FakeResult(data={"email": "user@example.com", "count": 5}) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 129 | assert "user@example.com" not in str(redacted.data) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 137 | result = FakeResult(data={"user@example.com": "ok"}) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 141 | assert "user@example.com" not in str(redacted.data) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 175 | result = FakeResult(data=Record("user@example.com", "keep me")) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 179 | assert "user@example.com" not in str(redacted.data) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 193 | result = FakeResult(data=Pair("user@example.com", "keep me")) | CODE |
| LOW⚡ | …nt-governance-python/agent-os/tests/test_mute_agent.py | 197 | assert "user@example.com" not in str(redacted.data) | CODE |
| LOW | …python/agent-os/docs/tutorials/message-bus-adapters.md | 236 | payload={"user_id": "123", "email": "user@example.com"} | CODE |
| LOW | …ent-os/extensions/mcp-server/src/tools/deploy-agent.ts | 111 | approvers: ['admin@example.com'], // Would come from config | CODE |
| LOW | …nce-python/agent-os/examples/ecommerce-support/main.py | 358 | name="Jane Doe", | CODE |
| LOW | …s/self-evaluating/tests/test_constraint_engineering.py | 203 | "recipient": "user@example.com" | CODE |
| LOW | …-evaluating/examples/example_constraint_engineering.py | 233 | "recipient": "user@example.com", | CODE |
| LOW⚡ | …thon/agent-os/modules/caas/tests/test_trust_gateway.py | 122 | allowed_users=["admin@example.com", "user@example.com"] | CODE |
| LOW⚡ | …thon/agent-os/modules/caas/tests/test_trust_gateway.py | 122 | allowed_users=["admin@example.com", "user@example.com"] | CODE |
| LOW⚡ | …thon/agent-os/modules/caas/tests/test_trust_gateway.py | 129 | user_id="admin@example.com" | CODE |
| LOW | …thon/agent-os/modules/caas/tests/test_trust_gateway.py | 342 | user_id="user@example.com", | CODE |
| LOW | …thon/agent-os/modules/caas/tests/test_trust_gateway.py | 377 | user_id="admin@example.com" | CODE |
| LOW | …hon/agent-os/modules/iatp/examples/integration_demo.py | 155 | payload={"to": "user@example.com"}, | CODE |
| LOW | …hon/agent-os/modules/iatp/examples/integration_demo.py | 171 | payload={"to": "user@example.com"}, | CODE |
| LOW⚡ | …e-python/agent-os/modules/iatp/examples/demo_client.py | 103 | "customer_name": "John Doe" | CODE |
| LOW⚡ | …e-python/agent-os/modules/iatp/examples/demo_client.py | 122 | "customer_name": "Jane Doe" | CODE |
| LOW | …nt-os/src/agent_os/integrations/agentshield_adapter.py | 31 | result = kernel.validate_tool_call("send_email", {"to": "user@example.com"}) | STRING |
| LOW | …/tests/scenarios/test_agentshield_adapter_scenarios.py | 256 | "send_email", {"to": "user@example.com"} | CODE |
| LOW⚡ | …/tests/scenarios/test_agentshield_adapter_scenarios.py | 280 | "send_email", {"to": "user@example.com"} | CODE |
| LOW⚡ | …t-governance-python/agent-mesh/tests/test_authority.py | 262 | sponsor="admin@example.com", | CODE |
| LOW⚡ | …t-governance-python/agent-mesh/tests/test_authority.py | 277 | sponsor="admin@example.com", | CODE |
| LOW⚡ | …t-governance-python/agent-mesh/tests/test_authority.py | 287 | sponsor="user@example.com", | CODE |
| 13 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/policies/conversation-guardian.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/cli-security-rules.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/sql-safety.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/semantic-policy.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/mcp-security.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/pii-detection.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/sandbox-safety.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | examples/policies/prompt-injection-safety.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | …les/marketplace-governance/policies/plugin-safety.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM⚡ | …arketplace-governance/policies/marketplace-policy.yaml | 6 | # that these rules are comprehensive or sufficient for your security | COMMENT |
| MEDIUM | .github/workflows/supply-chain-check.yml | 311 | # the prompt-injection benchmark harness), which reuse policy-engine/deny.toml. | COMMENT |
| MEDIUM | .github/workflows/ai-security-scan.yml | 3 | # Posts comprehensive audit results as a GitHub issue. | COMMENT |
| MEDIUM | …nce-python/agent-sandbox/src/agent_sandbox/__init__.py | 62 | # symmetry with ``DockerSandboxProvider`` and to remain robust against | COMMENT |
| MEDIUM | …/agent-compliance/src/agent_compliance/cli/red_team.py | 393 | """Generate a comprehensive red-team assessment report. | STRING |
| MEDIUM⚡ | …es/self-evaluating/examples/sample_full_stack_agent.py | 181 | # Step 5: Return comprehensive result | COMMENT |
| MEDIUM | …rnance-python/agent-os/templates/policies/pci-dss.yaml | 262 | saq_type: "SAQ-D" # Most comprehensive | CODE |
| LOW⚡ | …nce-python/agent-os/modules/atr/tests/test_executor.py | 174 | # But we'll just return a value to verify execution works | COMMENT |
| MEDIUM | …e-python/agent-os/modules/control-plane/pyproject.toml | 70 | # SQL AST parsing for robust policy enforcement (recommended) | COMMENT |
| MEDIUM | …os/modules/control-plane/examples/advanced_features.py | 372 | # Get comprehensive status | COMMENT |
| MEDIUM | …nt-os/modules/control-plane/examples/lifecycle_demo.py | 658 | # Show comprehensive status | COMMENT |
| MEDIUM | …control-plane/src/agent_control_plane/policy_engine.py | 902 | # version-robust way. sqlglot renamed ``AlterTable`` -> ``Alter`` | COMMENT |
| MEDIUM | …control-plane/src/agent_control_plane/control_plane.py | 424 | """Get comprehensive status for an agent""" | STRING |
| MEDIUM | …les/control-plane/src/agent_control_plane/lifecycle.py | 3065 | """Get comprehensive status of the control plane""" | STRING |
| MEDIUM | …n/agent-os/src/agent_os/integrations/drift_detector.py | 308 | """Run a comprehensive scan over multiple source dicts. | STRING |
| MEDIUM | …/tests/scenarios/test_stock_library_smoke_scenarios.py | 55 | proc = subprocess.run( # noqa: S603 — trusted test harness | CODE |
| MEDIUM⚡ | …e-python/agent-mesh/tests/test_credential_lifecycle.py | 150 | """Verify seamless key rotation without service interruption.""" | STRING |
| MEDIUM⚡ | …nt-governance-python/agent-mesh/tests/test_keystore.py | 164 | """Create a comprehensive mock of the pkcs11 package.""" | STRING |
| MEDIUM | …examples/06-eu-ai-act-compliance/compliance_checker.py | 68 | # Capabilities that elevate risk when present | COMMENT |
| MEDIUM | …agent-mesh/packages/mcp-proxy/policies/enterprise.yaml | 3 | # Full enterprise security: Rate limiting, PII detection, comprehensive audit. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …governance-typescript/agent-os-vscode/src/extension.ts | 380 | print(result) | CODE |
| HIGH | …src/webviews/workflowDesigner/WorkflowDesignerPanel.ts | 301 | print(result) | CODE |
| HIGH | …src/webviews/workflowDesigner/WorkflowDesignerPanel.ts | 362 | print(result) | CODE |
| HIGH⚡ | …ntmesh-integrations/copilot-governance/src/reviewer.ts | 247 | "unconditionally return True without performing actual checks. " + | CODE |
| HIGH⚡ | …ntmesh-integrations/copilot-governance/src/reviewer.ts | 256 | " return False\n" + | CODE |
| HIGH | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 436 | print(f"Agent completed: {result}") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …k/python/agent_control_specification/_orchestration.py | 106 | CODE | |
| LOW | …ython/agent_control_specification/_adapters/litellm.py | 306 | CODE | |
| LOW | …gent-os/examples/self-evaluating/src/agent_metadata.py | 214 | CODE | |
| LOW | …-python/agent-os/examples/self-evaluating/src/agent.py | 187 | CODE | |
| LOW | …-python/agent-os/examples/self-evaluating/src/agent.py | 394 | CODE | |
| LOW | …-os/examples/self-evaluating/src/polymorphic_output.py | 259 | CODE | |
| LOW | …ython/agent-os/modules/caas/src/caas/vfs/filesystem.py | 77 | CODE | |
| LOW | …ce-python/agent-os/modules/caas/src/caas/api/server.py | 415 | CODE | |
| LOW | …ernance-python/agent-os/modules/nexus/tests/helpers.py | 50 | CODE | |
| LOW | …overnance-python/agent-os/modules/atr/atr/decorator.py | 210 | CODE | |
| LOW | …governance-python/agent-os/modules/atr/atr/__init__.py | 265 | CODE | |
| LOW | …thon/agent-os/modules/iatp/examples/untrusted_agent.py | 66 | CODE | |
| LOW | …control-plane/src/agent_control_plane/control_plane.py | 116 | CODE | |
| LOW | …les/control-plane/src/agent_control_plane/lifecycle.py | 2695 | CODE | |
| LOW | …agent-os/services/cloud-board/api/routes/compliance.py | 95 | CODE | |
| LOW | …governance-python/agent-os/src/agent_os/mcp_gateway.py | 134 | CODE | |
| LOW | …s/src/agent_os/integrations/semantic_kernel_adapter.py | 818 | CODE | |
| LOW | …ent-os/src/agent_os/integrations/google_adk_adapter.py | 1042 | CODE | |
| LOW | …ent-os/src/agent_os/integrations/google_adk_adapter.py | 1060 | CODE | |
| LOW | …python/agent-learning/src/agent_learning_gov/runner.py | 73 | CODE | |
| LOW | …ython/agent-learning/src/agent_learning_gov/capture.py | 42 | CODE | |
| LOW | …ance-python/agent-mesh/tests/test_django_middleware.py | 139 | CODE | |
| LOW | …rnance-python/agent-mesh/tests/test_http_middleware.py | 97 | CODE | |
| LOW | …overnance-python/agent-mesh/src/agentmesh/telemetry.py | 32 | CODE | |
| LOW | …ce-python/agent-mesh/src/agentmesh/core/identity/ca.py | 428 | CODE | |
| LOW | …ce-python/agent-mesh/src/agentmesh/core/identity/ca.py | 494 | CODE | |
| LOW | …t-mesh/src/agentmesh/identity/attestation_collector.py | 61 | CODE | |
| LOW | …nt-mesh/src/agentmesh/identity/attestation_verifier.py | 42 | CODE | |
| LOW | …e-python/agent-mesh/src/agentmesh/governance/govern.py | 1039 | CODE | |
| LOW | …ce-python/agent-mesh/src/agentmesh/governance/audit.py | 586 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | policy-engine/scripts/demo_end_to_end.sh | 24 | # Usage: | COMMENT |
| LOW | examples/terraform-azure/main.tf | 14 | # Usage: | COMMENT |
| LOW | examples/policies/sql-safety.yaml | 13 | # Usage: | COMMENT |
| LOW | examples/terraform-aws/main.tf | 15 | # Usage: | COMMENT |
| LOW | examples/demos/openclaw-governed/docker-compose.yaml | 9 | # Usage: | COMMENT |
| LOW | .github/pipelines/esrp-publish.yml | 7 | # Usage: | COMMENT |
| LOW | …thon/agent-os/modules/observability/docker-compose.yml | 9 | # Usage: | COMMENT |
| LOW | …on/agent-os/modules/control-plane/build_and_publish.sh | 4 | # Usage: | COMMENT |
| LOW⚡ | …ent-os/src/agent_os/integrations/smolagents_adapter.py | 272 | # Usage: | COMMENT |
| LOW | …s/src/agent_os/integrations/semantic_kernel_adapter.py | 899 | # Usage: | COMMENT |
| LOW | …/agent-sre/examples/chaos-chatbot/chaos-scenarios.yaml | 4 | # Usage: | COMMENT |
| LOW | …agent-sre/src/agent_sre/specs/data-pipeline-agent.yaml | 6 | # Usage: | COMMENT |
| LOW | …thon/agent-sre/src/agent_sre/specs/research-agent.yaml | 6 | # Usage: | COMMENT |
| LOW | …python/agent-sre/src/agent_sre/specs/coding-agent.yaml | 6 | # Usage: | COMMENT |
| LOW | …nt-sre/src/agent_sre/specs/customer-support-agent.yaml | 5 | # Usage: | COMMENT |
| LOW | …-hypervisor/examples/docker-compose/docker-compose.yml | 9 | # Usage: | COMMENT |
| LOW | …agent-mesh/docker/examples/docker-compose.sidecar.yaml | 6 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/policies/ai-security-guidance.md | 33 | ### 1. Independent validation of AI-generated tests | COMMENT |
| HIGH | .github/actions/ai-agent-runner/action.yml | 371 | body: `${marker}\n${statusMarker}\n${runMarker}\n## 🤖 AI Agent: ${agentType}\n\n> AI-generated review ou | CODE |
| HIGH | .github/actions/ai-agent-runner/action.yml | 377 | const body = `${marker}\n${statusMarker}\n${runMarker}\n## 🤖 AI Agent: ${agentType}\n\n> AI-generated review | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …vernance-python/agent-os/tests/test_security_skills.py | 413 | def process_data(items): | CODE |
| LOW | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 424 | async def process_data(*data_sources) -> List[Dict]: | CODE |
| LOW | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 515 | async function processData(...dataSources: any[][]): Promise<any[]> { | CODE |
| LOW | …thon/agent-os/extensions/copilot/src/agentGenerator.ts | 626 | func processData(dataSources ...[]any) ([]any, error) { | CODE |
| LOW | …agent-os/examples/crewai-safe-mode/crewai_safe_mode.py | 255 | def execute_task(self, task: str) -> str: | CODE |
| LOW | …ent-os/examples/self-evaluating/src/agent_brokerage.py | 384 | def execute_task(self, task: str, task_metadata: Optional[Dict[str, Any]] = None, | CODE |
| LOW | …les/observability/src/agent_os_observability/tracer.py | 87 | def my_function(x, y): | STRING |
| LOW | …les/observability/src/agent_os_observability/tracer.py | 223 | def my_function(): | STRING |
| LOW | …governance-python/agent-os/modules/amb/amb_core/bus.py | 388 | async def handle_request(msg: Message): | STRING |
| LOW | …gent-os/modules/atr/tests/test_integration_executor.py | 173 | def process_data(numbers: list, multiplier: int = 2, add_value: int = 0) -> list: | CODE |
| LOW⚡ | …ce-python/agent-os/modules/atr/tests/test_decorator.py | 86 | def my_function(x: str) -> str: | CODE |
| LOW | …s/control-plane/src/agent_control_plane/mcp_adapter.py | 608 | def handle_request(self, request: Dict) -> Dict: | CODE |
| LOW | …python/agent-os/src/agent_os/integrations/profiling.py | 82 | def my_method(self, ...): ... | STRING |
| LOW | …python/agent-os/src/agent_os/integrations/profiling.py | 85 | def my_method(self, ...): ... | STRING |
| LOW | …ernance-python/agent-sre/src/agent_sre/api/__init__.py | 357 | def handle_request(self) -> None: | CODE |
| LOW | …-python/agent-mesh/examples/01-mcp-tool-server/main.py | 44 | async def handle_request(self, tool_name: str, params: Dict[str, Any]) -> Dict[str, Any]: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ns/langchain-agentmesh/langchain_agentmesh/identity.py | 77 | for demonstration purposes. | STRING |
| MEDIUM | …e-python/agent-os/examples/governed-chatbot/chatbot.py | 251 | response = "I apologize, but I cannot provide that response due to content policy." | CODE |
| MEDIUM | …n/agent-os/modules/caas/tests/test_heuristic_router.py | 128 | ("Thanks", "You're welcome! Let me know if you need anything else."), | CODE |
| MEDIUM | …ython/agent-os/modules/cmvk/src/cmvk/constitutional.py | 209 | ("I cannot provide instructions for making weapons.", False, "Appropriately refuses"), | CODE |
| MEDIUM | …nce-python/agent-os/modules/control-plane/benchmark.py | 144 | response = "I notice this request contains suspicious instructions. I must follow my core safety guideli | CODE |
| MEDIUM | …t-os/modules/control-plane/examples/compliance_demo.py | 136 | good_response = "I'd be happy to help you with that task. Let me know if you need clarification." | CODE |
| MEDIUM | …gent-os/modules/control-plane/examples/adapter_demo.py | 24 | Mock OpenAI client for demonstration purposes. | STRING |
| MEDIUM | …/control-plane/src/agent_control_plane/agent_kernel.py | 433 | Note: This returns simulated execution results for demonstration purposes. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …nt-governance-python/agent-mesh/services/api/README.md | 40 | -H "x-api-key: <your-api-key>" \ | CODE |
| HIGH | …nt-governance-python/agent-mesh/services/api/README.md | 78 | -H "x-api-key: <your-api-key>" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/ci/test_no_stubs.py | 56 | result = _run_gate_with_added_line(tmp_path, "sample.py", "# TODO: implement this") | CODE |
| LOW | …gentmesh-integrations/nostr-wot/tests/test_provider.py | 13 | # TODO: Add tests using respx to mock the WoT API | COMMENT |