Skip to main content
Release notes and version history for Flint AI CLI.
​
August 26, 2026
Per-project configuration and a quicker start.Added:
  • Per-project configuration - A .env in your working directory now configures that project, layered over the global ~/.flintai/.env. Anything already set in your shell or CI still wins. See environment variables
Changed:
  • Quicker to start - flintai --version, flintai --help, and a mistyped argument return without loading the evaluation and telemetry stack, and flintai scan loads the scanner only once a scan runs
Fixed:
  • Scans complete on GPT-5 reasoning models - Tool calls reach the interface that supports them, and a parameter the model declines is dropped rather than ending the scan
​
August 13, 2026
A smaller, faster default install.Changed:
  • Leaner default install - Breaking: The standard install is roughly 2 GB smaller and no longer pulls CUDA on Linux. Scanning and the built-in OWASP LLM evaluations work as before. Garak evaluations, toxicity detection, and locally run HuggingFace models now need the optional full extra. See installation
​
August 12, 2026
Optional usage analytics, a clear warning when a scan runs short, and changes to machine-readable output.Added:
  • Anonymous usage analytics - The CLI asks on first run whether to share anonymous usage data, and pressing Enter turns it on. You can change your answer at any time, CI runs never send, and code, prompts, keys, and personal data are never collected. See data privacy
  • Incomplete scans now say so - When an analysis tool is unavailable, flintai scan warns that the findings are partial and names what’s missing, instead of quietly returning a shorter list. See scan results
  • --log on flintai scan - Set the log file path, matching the flag already available on flintai eval
Changed:
  • Default scan model - New setups scan with gemini-3.6-flash. Existing setups keep the model they already pin. See environment variables
  • Eval results name the schema version in snake_case - Breaking: the schemaVersion field in eval JSON output is now schema_version, and the format is version 2.0. Update automation that reads the old key. See eval results
  • Scan JSON drops two empty fields - Breaking: agents_found and agent_profiles are gone from flintai scan JSON output. Both were always empty. See scan results
  • Predictable dependency resolution - The OpenTelemetry and protobuf version ranges are pinned so pip install resolves without backtracking
Fixed:
  • Scanning a single file returns findings - flintai scan path/to/agent.py previously completed and reported nothing. A single file is now analyzed the same way it would be inside a directory. See the command reference
Security:
  • Dependency hardening - Cryptography and networking libraries updated to current maintained releases
​
July 27, 2026
Changed:
  • Scan finding impact text - The impact field on a scan finding now carries the description from the issue taxonomy instead of a generated Exploitable via ... string. This text appears in both JSON and SARIF output, so update any automation that matches on the old wording
  • Safety refusals during eval - A model refusal for a disallowed prompt now reports as blocked for safety rather than as a model error, so an eval run distinguishes a refusal from a failure
Fixed:
  • Eval no longer stops on a malformed provider error - An error response with an unexpected body is handled instead of ending the run
  • Corrected documentation links - Links in the project README now point to migrated documentation paths
​
July 15, 2026
Machine-readable output and broader Python support.Added:
  • --format {json,sarif} - Choose the output format for flintai scan and flintai eval run, with -f as the short form. json stays the default, so existing commands behave as before
  • SARIF 2.1.0 output - Feed scan and eval results directly into GitHub code scanning and other SARIF-aware workflows
  • Versioned eval output - Machine-readable eval results carry a schema version, so downstream automation stays stable across releases
Changed:
  • Python 3.11 or later - Lowered from 3.13, so the CLI installs in more development environments
  • Default output filenames follow the chosen format - Breaking: Scan writes scan_<timestamp>.<format>, renamed from results_<timestamp>.json, and eval writes eval_<timestamp>.<format>. Update any automation that looks for the old results_*.json name
​
June 30, 2026
Evaluation reliability and setup fixes.Changed:
  • More reliable adversarial evaluation - Built-in detector behavior tightened, with structured JSON judge output now required for key adversarial checks
  • Smoother getting started - Clearer virtual environment setup and example-agent instructions, plus corrected command-reference links
​
June 18, 2026
Initial public release of Flint AI CLI.Added:
  • flintai scan - AI-powered static analysis of Python agent code, with findings mapped to the OWASP Top 10 for Agentic Applications and scored with CVSS severity
  • flintai eval - Runtime behavioral evaluation of running agents using adversarial and functional tests
  • Built-in evaluation content - Evaluations for OWASP LLM risks, plus the detector and model configuration needed to run them locally
  • Framework detection - Auto-detect supported frameworks