Quick Start
Install Drako and run your first scan in under two minutes.
Scan Rules
Explore 97 deterministic rules across 16 security categories.
Runtime Enforcement
Protect agents in production with a one-line integration.
CLI Reference
Full reference for every Drako command and flag.
What Drako does
Scan your codebase
Run
drako scan . to analyze your AI agent project. Drako uses AST-based static analysis — no LLM in the evaluation loop — to produce deterministic results every time.Review findings and scores
Drako produces two scores: a Governance score (are your agents safe?) and a Determinism score (will they behave consistently?). Reachability analysis separates findings that matter from theoretical risks.
Generate a config
Run
drako init to auto-generate a .drako.yaml config pre-filled with your agents, tools, and recommended policies. Start in audit mode, then upgrade when ready.Two scores, two audiences
| Score | Audience | What it measures |
|---|---|---|
| Governance | Security teams | Are your agents safe to run in production? |
| Determinism | Engineers | Will they behave the same way twice? |
Key capabilities
97 scan rules
Deterministic rules across security, governance, compliance, determinism, and more. No LLM in the evaluation loop.
Reachability analysis
Separate real risks from theoretical ones. Dangerous tools that no agent uses are dimmed, not screamed at you.
Agent BOM
Pure AST inventory: agents, tools, models, prompts, permissions, MCP servers, and framework versions.
DLP & prompt injection
Presidio-based PII/PCI scanning and bidirectional prompt injection detection on every tool call.
Human-in-the-loop
Pause agents on high-risk actions and escalate to a human. EU AI Act Article 14 compliant.
Audit trail
SHA-256 hash chain with Ed25519 signatures. Tamper-evident, exportable, regulator-ready.
Observability
Built-in dashboard with latency percentiles, violation heatmaps, and drift detection.
EU AI Act compliance
Coverage for Articles 9, 11, 12, and 14. High-risk rules take effect August 2, 2026.
Supported frameworks
Drako integrates with the frameworks your agents already use. Detection is automatic via AST analysis.| Framework | Detection | Framework-specific rules |
|---|---|---|
| CrewAI | AST | FW-001 → FW-003 |
| LangGraph | AST | FW-004 → FW-005 |
| AutoGen | AST | FW-006 → FW-007 |
| Semantic Kernel | AST | FW-008 → FW-009 |
| PydanticAI | Import | FW-010 |
| LangChain | Import | General rules |
| TypeScript/JavaScript | Tree-sitter | 17 additional rules |
TypeScript/JavaScript support requires
pip install drako[typescript]. This covers LangChain.js, Vercel AI SDK, Mastra, and AutoGen.js.