Comments
>log in to commentI built Guardana to give security and platform engineers a way to verify AI models and code completely offline. It scans artifacts, probes live endpoints, grades recordings, and diffs runs, outputting SARIF, JSON, JUnit or text. Let me know what you think and any improvements you’d suggest 😊
- Offline‑only security scans
- No account or telemetry required
- Scans model and code artifacts
- Probes live endpoints and agents
- Grades execution traces and diffs runs
Guardana is an open-source tool that scans AI model/code artifacts, probes live endpoints, grades recorded runs, and diffs security results.
- for
- Security and platform engineers building or operating AI systems.
- pricing
- open source
- license
- Apache-2.0
- v1.0.0rc2Guardana v1.0.0rc22 days ago
- v1.0.0rc1Guardana v1.0.0rc17 days ago
- v0.41.0Guardana v0.41.08 days ago
Key features
- Offline Scan — Runs deterministic rule checks on model and code artifacts without sending data.
- Live Probe — Tests running model endpoints or agents and records findings.
- Grade Recorded Runs — Applies security rules to saved interactions without contacting the system.
- Diff Comparisons — Compares two saved runs to see regressions or improvements.
- Custom Policies — Define new rules in YAML or Python and package them as policy packs.
- CI Integration — GitHub Action and pytest helper let you enforce checks in CI pipelines.
- Multiple Output Formats — Exports results as SARIF, JSON, JUnit or plain text.
- Optional Collector — Self-hosted PostgreSQL collector can store runs and evidence.
Use cases
- Validate model files and code for supply-chain risks before release.
- Continuously monitor a production endpoint for runtime attacks.
- Compare security findings between two model versions to catch regressions.
- Enforce custom security contracts in CI for AI-enabled applications.
- Detect hard-coded secrets and unsafe deserialization in code bases.
Guardana vs alternatives
 Guardana |  Semgrep |  Snyk |  Infisical | ||
|---|---|---|---|---|---|
| Best for | Offline AI security verification | Container and code vulnerability scanning | Static analysis for code bugs | Dependency and container security | Secrets management |
| Pricing | Open source | Free | Subscription | Subscription | Free |
| DevHunt upvotes | 1 | 0 | 0 | 0 | 0 |
| Launched | Oct 2026 | — | — | — | — |
- Guardana vs Trivy: Trivy scans containers and code for vulnerabilities, but does not probe live AI endpoints or grade recordings.
- Guardana vs Semgrep: Semgrep performs static code analysis, lacking offline AI artifact scans and runtime probing.
- Guardana vs Snyk: Snyk focuses on dependencies and container security, not on AI model or endpoint verification.
- Guardana vs Infisical: Infisical manages secrets, whereas Guardana checks for secret leaks within AI artifacts and runtime.
Guardana FAQ
Does Guardana send any data to external services?+
No. Scans run fully offline and only send data if you explicitly specify a reporter.
Do I need an account to use Guardana?+
No account or telemetry is required; the tool is Apache-2.0 licensed.
How can I add my own security rules?+
Use `guardana new-pack` or `guardana new-rule` to create YAML/Python policies that are validated by the tool.
Can Guardana be used in CI pipelines?+
Yes, via the Guardana GitHub Action or the `guardana.testing.assert_secure` helper in pytest.
What output formats are supported for findings?+
Findings can be exported as SARIF, JSON, JUnit, or plain-text reports.
Is there a way to store runs centrally?+
An optional self-hosted PostgreSQL collector can receive runs using the `--reporter` flag.
Summarized by DevHunt from guardana.dev · Oct 12, 2026. Details may change; check the official site.
