AI application safety & security

Build with AI.
Ship with confidence.

Know what’s in your AI application. Test what it can do. Turn security findings into evidence your team can act on.

Start your free trial Explore the docs

pip install nuguard

Open source · Apache 2.0 · Python 3.12+

Your AI, connectedIllustrative map

Application boundary

ModelReasoning & inference

Tools & MCPActions & permissions

PolicyBehavioral boundaries

DataAccess & isolation

AI agentIntent → action

Follow the path. Find the risk.

Source, behavior policy, and runtime evidence in one workflow.

Security across the whole application

AgentsModelsTools & MCPDataCloud & IaC

From source to runtime

See the system.
Test the boundaries.

AI security goes beyond the model. Connect your code, policies, tools, and live behavior to understand where risk travels.

01 / Discover

An inventory that connects the dots.

Generate an AI-SBOM of agents, models, prompts, tools, and datastores. See the relationships that make your application work.

AI-SBOM

AgentsModelsToolsData

Explore AI-SBOM

02 / Analyze

Find risk before it ships.

Bring AI-specific analysis, Semgrep source checks, Checkov infrastructure checks, and dependency findings into the same review.

Explore analysis

03 / Behavior

Make intent testable.

Define allowed behavior in a Cognitive Policy. Check responses and tool use against the boundaries your team expects.

Explore behavior testing

04 / Red-team

Challenge the unexpected.

Probe prompt injection, data leakage, and tool misuse. Use multi-turn attacks and campaign mode to explore connected conversations.

Explore red-teaming

05 / Pentest

Cover the web surface, too.

Run bounded, explicitly authorized Nuclei-based tests against the web and API surfaces around your AI application.

Explore web pentesting

06 / Govern

Give every finding context.

Review affected assets, evidence, and remediation. Export reports and SARIF, then set severity gates for your release workflow.

Explore reporting & CI

A clear path forward

One workflow.
Five steps to stronger AI.

Start with source code. Add your application’s policy and an authorized sandbox when you’re ready to test runtime behavior.

Start here · Source code

Know what you’re building.

Turn source code into an AI-SBOM of your assets and data paths. The first scan needs no live target or LLM key.

Read the discovery guide

terminal

# Map your application from source
nuguard sbom generate \
  --source . \
  --output app.sbom.json

Source → assets → relationships

Your application · Your intent

Put the boundaries in writing.

Use a Cognitive Policy to describe allowed topics, data handling, and restricted actions. Validate it before live testing.

Read the policy guide

terminal

# Validate your Cognitive Policy
nuguard policy validate \
  --file cognitive_policy.md

Intent → policy → testable controls

Static checks · Risk context

Turn the inventory into insight.

Analyze the AI-SBOM for security issues and relationships that deserve a closer look. Review findings before moving to runtime checks.

Read the analysis guide

terminal

# Analyze the discovered application
nuguard analyze \
  --sbom app.sbom.json \
  --source .

Inventory → findings → risk context

Authorized sandbox · Runtime tests

Test what the application really does.

Configure your target and test identity, then verify the connection. Run behavior, red-team, or web tests to answer specific security questions.

Set up runtime testing

terminal

# Verify your configured sandbox first
nuguard target verify \
  --config nuguard.yaml \
  --sbom app.sbom.json

Behavior · red-team · authorized pentest

Release decisions · Shared evidence

Make security part of delivery.

Retain reports, review findings, and use severity gates in CI. Fix confirmed issues and rerun the relevant checks; review coverage gaps alongside results.

Explore release gates

terminal

# Retain evidence and gate on severity
nuguard scan --source . \
  --output-dir nuguard-reports \
  --fail-on high

Reports → review → fix & retest

↻ Fix · retest · repeatBuild your config from nuguard.yaml.example

Fits your stack

Your tools.
Your infrastructure.

Discover AI assets across languages, agent frameworks, exported workflows, and cloud deployments.

See support by integration Support depth varies by integration.

Languages

PythonTypeScript / JavaScriptGoC#Java

Agent frameworks & tools

LangGraphOpenAI Agents SDKCrewAIAutoGenMCPSemantic Kernel

Visual workflows & cloud

n8nLangflowFlowiseCopilot StudioSparkflowsAWSAzureGCPKubernetesTerraform

Built for the whole team

Shared evidence.
Clearer decisions.

For developers

Trace findings to code and assets. Test locally, fix the cause, and rerun the check.

Start building

For engineering leaders

Make security repeatable with policy boundaries, CI gates, and release evidence.

Explore CI workflows

For security teams

Connect inventory and attack paths with runtime evidence and coverage gaps.

Explore runtime testing

Start with visibility

Your next AI release.
A clearer security picture.

Map your application today. Build confidence with every test.

Start your free trial Explore the docs

Prefer to run it yourself? Explore the open-source project ↗

Build with AI.Ship with confidence.

See the system.Test the boundaries.

An inventory that connects the dots.

Find risk before it ships.

Make intent testable.

Challenge the unexpected.

Cover the web surface, too.

Give every finding context.

One workflow.Five steps to stronger AI.

Know what you’re building.

Put the boundaries in writing.

Turn the inventory into insight.

Test what the application really does.

Make security part of delivery.

Your tools.Your infrastructure.

Languages

Agent frameworks & tools

Visual workflows & cloud

Shared evidence.Clearer decisions.

For developers

For engineering leaders

For security teams

Your next AI release.A clearer security picture.

Build with AI.
Ship with confidence.

See the system.
Test the boundaries.

One workflow.
Five steps to stronger AI.

Your tools.
Your infrastructure.

Shared evidence.
Clearer decisions.

Your next AI release.
A clearer security picture.