NuGuard answers the questions that matter most to each stakeholder — from source code evidence, not manual attestation.
Filename and line number as evidence. Full relationship graphs.
Frameworks like LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Google ADK, AWS BedrockAgentCore, Azure Semantic Kernel, Agno, and more.
LLM and embedding model references with provider, version, and model cards.
Function tools, MCP tools, and decorated callables wired to agents — including privilege scope (db_write, code_execution, shell).
System instructions and prompt templates — full content preserved, template variables identified, sensitive values redacted.
Vector stores, databases, and caches with PII/PHI classification.
Content filters and safety validators.
OAuth2, API key, Bearer, JWT, and MCP auth nodes. IAM roles, privilege scopes.
Kubernetes manifests, Terraform, CloudFormation, Azure Bicep, etc. Cloud region, HA mode, secret stores, IAM roles, encryption settings.
NuGuard checks agentic behavior against your Cognitive Policy — catching policy drift, unexpected refusals, and guardrail gaps before they reach production.
Most red-team tools fire generic prompt libraries at an LLM endpoint. NuGuard knows your application context and tailors attacks accordingly. Attacks for a healthcare app vs a code generation tool are going to be different.
Developer-friendly security tool — AI-SBOM generation, Deep AI Stack Analysis, Cognitive Policy Enforcement — requires minimal security expertise to get started.
Add --llm for LLM enrichment. Most features work out-of-the-box without an LLM key.
# Install $ pip install nuguard # Generate AI-SBOM from source $ nuguard sbom generate --source ./my-ai-app --output app.sbom.json # Static analysis (7 scanners, no running app needed) $ nuguard analyze --sbom app.sbom.json --format markdown # Behavior Validation $ nuguard behavior --policy cognitive_policy.md \ --output behavior_report.md # Dynamic red-team scan (requires running app) $ nuguard redteam --policy cognitive_policy.md \ --output redteam_report.md
from pathlib import Path from nuguard.sbom import AiSbomConfig, AiSbomExtractor, AiSbomSerializer from nuguard.sbom.toolbox.plugins.vulnerability import VulnerabilityScannerPlugin # Generate AI-SBOM doc = AiSbomExtractor().extract_from_path( path=Path("./my-ai-app"), config=AiSbomConfig(), ) print(f"nodes={len(doc.nodes)}, edges={len(doc.edges)}") # Serialize json_str = AiSbomSerializer.to_json(doc) # Run structural vulnerability scan sbom = doc.model_dump(mode="json") result = VulnerabilityScannerPlugin().run(sbom, {"provider": "all"}) for f in result.details["findings"]: print(f["severity"], f["rule_id"], f["title"])
# .github/workflows/ai-security.yml
name: AI Security Scan
on: [push, pull_request]
jobs:
nuguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install NuGuard
run: pip install nuguard
- name: Generate AI-SBOM
run: nuguard sbom generate --source . --output app.sbom.json
- name: Static analysis — fail on HIGH+
run: nuguard analyze --sbom app.sbom.json \
--format sarif --output analysis.sarif \
--min-severity high
- name: Policy compliance check
run: nuguard policy check --sbom app.sbom.json \
--framework owasp-llm-top10
- name: Upload SARIF to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: analysis.sarif
Install NuGuard, run your first scan, and get a complete security picture of every AI component in your codebase — in minutes, from source code, no API key required.