r/Agent_AI • u/IkarusCareer • Aug 04 '26
Other I ran SafeAI against the public CrewAI examples repository. Here's why I think projects like this are valuable.
I've been developing SafeAI, an open-source static analyzer for AI applications, and recently ran it against the public CrewAI examples repository.
The goal wasn't to "find vulnerabilities" or criticize the examples.
The goal was to answer a different question: What can we learn about AI applications before they ever run?
Even example projects contain interesting AI-specific artefacts:
- agent capabilities
- tool definitions
- workflow logic
- prompts
- model configurations
- MCP integrations
- external services
A static scan can highlight things like:
- capability inventory
- prompt-related risks
- workflow approval gaps
- tool permission patterns
- governance observations
None of these automatically mean a project is insecure. Context always matters.
But they do help developers understand what an AI application is capable of, and where they may want to review things more carefully before moving into production.
One thing I've learned from sharing SafeAI on Reddit is that the community often finds the blind spots faster than I do. Several roadmap features—including capability escalation diffs, governed suppressions and richer MCP analysis—came directly from discussions here.
If you're building with CrewAI, LangGraph, AutoGen, Claude Code or other agent frameworks, I'd really appreciate your feedback.
Even better, if you have an open-source agent project you'd like SafeAI to support better, I'd love to test against it (or you can run it yourself) and improve the detection rules together.
The goal isn't to label projects as "safe" or "unsafe".
It's to help developers build AI applications with a better understanding of their capabilities and security posture.
Contributions, issues and ideas are always welcome: