AI Surface
Find the AI attack surface your code is about to ship.
ai-surface finds the AI your team is shipping (agents, MCP servers, RAG stores, LLM calls, and APIs), flags the risky ones, and gates net-new risk in your pull requests before it ships. It runs locally and offline, so your source never leaves the host.
terminal
MIT · Python 3.9+ · No telemetry · Runs offline
Eight categories of AI attack surface, mapped from source
Configuration, keys, manifests, and specs are detected across stacks. Deep code-level detection is strongest today for Python and TypeScript / JavaScript.
Agent frameworks
LangChain, LangGraph, CrewAI, LlamaIndex, AutoGen, Haystack, Semantic Kernel, Pydantic AI, AWS Strands, Vercel AI SDK, Mastra, OpenAI Agents, and more. Extracts agent tool inventories and flags financial, destructive, and high-blast-radius authority.
MCP servers
Configured and in-house MCP servers. Audited findings include risk flags, remediation, detected secrets by name and type only, and registry / trust signals.
Vector stores / RAG
Pinecone, Weaviate, Chroma, Qdrant, Milvus, FAISS, LanceDB, pgvector, and more, plus LangChain and LlamaIndex retrieval. Flags managed-store egress, RAG data flow, and external ingestion (the poisoning surface).
LLM SDK call sites
Anthropic, OpenAI, Azure OpenAI, AWS Bedrock, Google Gen AI, Vertex AI, Together, Mistral, Cohere, Groq, LiteLLM, and Vercel AI SDK. Extracts models and flags non-literal prompt flow.
API endpoints
OpenAPI / Swagger specs and framework routes (FastAPI, Starlette, Flask, Express, Spring, Django). Captures method, path, auth style, and object-id segments that may need BOLA review.
Model gateways
LiteLLM proxy, Portkey, Helicone, Cloudflare AI Gateway, and OpenRouter. Captures routed-model inventories where visible.
AI infrastructure
Kubernetes, Helm, Docker Compose, Dockerfiles, and Terraform for AI runtimes and managed services: Ollama, vLLM, TGI, Triton, llama.cpp, Bedrock, SageMaker, and Vertex.
AI provider keys
Provider key names such as OPENAI_API_KEY, ANTHROPIC_API_KEY, and AZURE_OPENAI_* across env files and config. Values are never read or printed.
See exactly what a PR is about to ship
Every audited finding carries an assessed severity, the OWASP LLM mapping, the governance clause it evidences, and a fix. Run --ui for an interactive, loopback-only map of the same surfaces.
ai-surface scan .
Gate new AI risk at PR time
Drop in the GitHub Action and every pull request gets a sticky comment showing what AI surface changed, not just the current repo state. Baseline existing surfaces, then fail the build only on newly introduced high-or-critical findings. No API keys: the action uses the built-in GITHUB_TOKEN.
Sticky PR diff comments (base vs head)
--baseline: gate only what's new, not pre-existing debt
--fail-on high: severity-gated, non-blocking on inventory
100% local: no source, findings, or metadata sent to APIsec
.github/workflows/ai-surface.yml
Runs inside your AI coding assistant
ai-surface ships as an MCP server for Claude Code, Cursor, Windsurf and Cline, and as an automatic check in Claude Code that runs after every edit. When an assistant adds a new tool, agent or model call, the finding shows up in the same conversation, before the change is committed.
scan_ai_surface: inventory the AI surface of a project
check_new_ai_surface: report what changed since the last check
One command writes the hook and the MCP entry for a repo
State is kept outside the repository, per user
terminal
The inventory doubles as your AI-BOM and governance evidence
Audited findings map to the OWASP LLM Top 10 and to evidence-relevant clauses in the EU AI Act, NIST AI RMF, and ISO/IEC 42001. Mappings ship as JSON fields, CycloneDX properties, and UI badges. AI Surface produces evidence; it does not certify or attest compliance.
The PR-time AI gap your other tools do not cover
SAST (Semgrep, CodeQL)
Code-pattern vulnerabilities
After commit; no AI surface inventory
DAST (Burp, ZAP)
Reachable web vulnerabilities
After deploy; not LLM / agent internals
SCA (Snyk, Dependabot)
Vulnerable dependencies
After commit; packages, not AI usage
Observability (LangSmith, Arize)
What LLM calls happened
After deploy; needs runtime traffic
AI-SPM / AI governance
Cloud / runtime AI posture
Runtime-first; not a PR-time gate
ai-surface
What AI surface is about to ship, mapped to governance
At PR time, before merge, offline
APIsec platform
Which AI / API surfaces are actually exploitable
Runtime validation, replayable evidence
AI Surface maps the attack surface statically, before merge. When you need to prove which of those surfaces an attacker can actually exploit against a running app, that is runtime validation on the APIsec platform.
An interactive map of every AI surface it finds
Run ai-surface scan . --ui to open the attack-surface map, served on loopback. Nodes are grouped by category with risk indicators, governance badges, and AI-BOM download. Nothing runs in the browser and nothing leaves your machine.
Tested against 50 popular open-source AI projects
Each repo was shallow-cloned, analyzed locally, and deleted. No application was run. These are category-presence signals, a floor not a ceiling.
50
popular AI repos scanned
~2.6M
combined GitHub stars
7,615
AI surfaces mapped
50%
expose MCP servers
96%
trip a governance rule
95%
confirmable only at runtime