Scan quickstart

Find misconfigurations, risky tool access, missing guardrails, and other issues in your Python agent code. An LLM does the analysis and triages false positives, so you see real problems, not noise.

Requirements: Python 3.11 or laterSupported frameworks: Google ADK, Google GenAI, Anthropic, OpenAI, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, HuggingFace Transformers, HuggingFace smolagents

Install `flintai-cli`

Using a virtual environment is recommended to avoid dependency conflicts:

python3 -m venv .venv
source .venv/bin/activate

Install Flint AI CLI:

pip install flintai-cli

Configure your LLM provider

flintai-cli uses AI to read your agent code contextually and filter false positives. Run the interactive setup and select your LLM:

flintai init

You’ll be prompted to select a provider (Gemini, OpenAI, Anthropic, or LiteLLM), select a model, and enter your API key. Your configuration is saved to ~/.flintai/.env.

Where to get API keys

Google Gemini: aistudio.google.com/apikey (free tier available)
OpenAI: platform.openai.com/api-keys
Anthropic: console.anthropic.com/settings/keys
LiteLLM: Supports 100+ providers via proxy. See docs.litellm.ai

Start free. Google Gemini offers a free tier with generous limits — test flintai-cli with no API costs.

Scan your Python agent code

Run the scan:

flintai scan .

Example output:

{
  "framework_detected": "crewai",
  "findings": [
    {
      "category": "asi05_unexpected_code_execution",
      "ai_spm_severity": "Critical",
      "title": "Arbitrary Code Execution via eval()",
      "cvss_scores": { "base_score": 9.3 }
    }
  ]
}

flintai scan finds the agent code in your repository and reports the issues in it — you may find agents you didn’t know existed. It also names the framework it detected in framework_detected, so you can confirm it read your code the way you expected. Results are saved to scan_<timestamp>.json, or scan_<timestamp>.sarif if you pass --format sarif.

Integrate with CI/CD. Save your scan results as a build artifact to prove validation before deployment, or write SARIF for GitHub code scanning. See CI/CD integration guide →

Overview

Flint AI Scan

Flint AI Eval

Guides

Reference

Troubleshooting

Resources

Next steps

Issues found?

Clean scan?

​Next steps

Issues found?

Clean scan?

Next steps