Executive Overview

The OWASP Artificial Intelligence Security Verification Standard (AISVS) establishes a comprehensive, vendor-neutral baseline of security requirements for modern AI applications, machine learning systems, autonomous agent swarms, and foundation model integrations.

aisvs-scan is a static application security testing (SAST) and compliance verification engine purpose-built for the AI era. It inspects source code, prompt hierarchies, tool manifests, MCP client/server topologies, and serialized model artifacts directly against the official AISVS catalog, evaluating requirements across Levels 1, 2, and 3.

Unlike legacy SAST tools that only identify generic injection vulnerabilities, aisvs-scan understands AI-native threat vectors:

• Model Context Protocol (MCP) server impersonation, DNS rebinding, unpinned tool runners, and form-mode secret elicitation.
• Agent tool execution without process isolation, sandbox escapes, and auto-approval bypasses on destructive actions.
• Model output flow into dangerous command, SQL, file, or network execution sinks (AI Taint Tracking).
• System/developer prompt contamination and instruction hierarchy degradation.
• Weaponized serialization opcodes embedded within PyTorch, Pickle, and Joblib model weights.
• Unauthenticated vector databases, cross-tenant embedding collisions, and missing retrieval authorization filters in RAG pipelines.

⚡ Zero Third-Party Dependencies: Implemented strictly using the Python Standard Library (ast, re, pickle, urllib, dataclasses, argparse). Installs instantaneously and runs hermetically in air-gapped or restricted CI environments.

Key Capabilities

┌────────────────────────────────────────────────────────────────────────┐
│                        OWASP AISVS SCANNER                             │
├───────────────────────────────┬────────────────────────────────────────┤
│ 🎯 214 AISVS Requirements     │ 100% coverage of official AISVS 1.01   │
│                               │ and 1.02-dev standard specifications.  │
├───────────────────────────────┼────────────────────────────────────────┤
│ 🔬 4 Specialized Engines      │ AST Taint Tracker, MCP Config Auditor, │
│                               │ Model Weights Disassembler, & Rules.   │
├───────────────────────────────┼────────────────────────────────────────┤
│ 🛡️ Multi-Verdict Auditing     │ PASS (verified defense), FAIL (flaw),  │
│                               │ GAP (missing), MANUAL, and N/A.        │
├───────────────────────────────┼────────────────────────────────────────┤
│ 🧩 Component Profiling        │ Automatic detection of LLMs, Agents,   │
│                               │ RAG, MCP, Fine-Tuning, & Edge AI.      │
├───────────────────────────────┼────────────────────────────────────────┤
│ 📊 6 Enterprise Reports       │ Interactive HTML, SARIF 2.1.0, JSON,   │
│                               │ Terminal ANSI, Markdown, & GRC CSV.    │
└───────────────────────────────┴────────────────────────────────────────┘

Architecture & Detection Engines

aisvs-scan uses a hybrid analysis pipeline combining syntax parsing, abstract syntax tree (AST) data-flow tracking, configuration auditing, and binary serialization inspection.

                           Target Repository / AI Project
                                         │
                             [File Walker & Lang Router]
                                         │
       ┌──────────────────┬──────────────┴─────┬──────────────────┐
       ▼                  ▼                    ▼                  ▼
┌──────────────┐   ┌──────────────┐     ┌──────────────┐   ┌──────────────┐
│  AST Taint   │   │  MCP Config  │     │   Artifact   │   │ Declarative  │
│   Tracker    │   │   Auditor    │     │ Disassembler │   │ Rule Engine  │
│ (Python AST) │   │ (JSON/Configs│     │ (.pkl/.pt)   │   │ (175+ Rules) │
└──────┬───────┘   └──────┬───────┘     └──────┬───────┘   └──────┬───────┘
       │                  │                    │                  │
       └──────────────────┴──────────────┬─────┴──────────────────┘
                                         ▼
                     [AI Feature & Component Profiler]
                                         ▼
                   [AISVS Requirements Verification Engine]
               (Evaluates L1/L2/L3: PASS, FAIL, GAP, MANUAL, N/A)
                                         ▼
       ┌──────────────────┬──────────────┼──────────────────┬─────────────┐
       ▼                  ▼              ▼                  ▼             ▼
Terminal Output      SARIF 2.1.0     HTML Report         Markdown      GRC CSV
(Developer UX)     (GitHub Security) (Dynamic Dashboard) (PR Summary) (Auditor)

1. Python AST Taint Tracking Engine (analyzers/taint.py)

Traces untrusted AI outputs and tool parameters through the Abstract Syntax Tree into critical sinks without relying on heuristic string matching:

• Taint Sources: Return values of LLM completion methods (client.chat.completions.create, messages.create, generate_content, litellm, etc.) and arguments passed into functions decorated as tools (@tool, @function_tool, @mcp.tool).
• Execution Sinks:
  • Host Command & Code Execution (eval, exec, os.system, subprocess.run, pty.spawn, asyncio.create_subprocess_shell).
  • SQL Execution (cursor.execute, pd.read_sql).
  • File System Write/Delete Operations (Path.write_text, os.remove, shutil.rmtree).
  • Arbitrary Outbound Network Requests (requests.get, httpx.post, aiohttp).
  • Unsanitized HTML Rendering (XSS/SSRF via render_template_string, Markup).
• Unbounded Agent Loop Detection: Detects while True agent reasoning loops lacking loop budgets, recursion depth limits, or break conditions.

2. MCP Security & Governance Engine (analyzers/mcp_config.py)

Inspects MCP server manifests, mcp.json, claude_desktop_config.json, .cursor/mcp.json, and client configurations:

• Unpinned Tool Runners: Flags executions of unpinned packages (npx -y @package@latest, uvx tool, docker run image:latest) vulnerable to supply chain hijacking.
• Insecure Transport: Detects remote MCP servers communicating over unencrypted plaintext HTTP (http://).
• Secret Leaks: Discovers hard-coded API keys, bearer tokens, and credentials in MCP environment blocks and headers.
• Permission Over-scoping: Catches servers configured with broad filesystem access (/, ~, $HOME).
• Human Approval Bypasses: Flags auto-approval configurations (autoApprove: ["*"] or trust: true) that bypass human oversight on privileged actions.

3. Model Weight & Serialization Inspector (analyzers/artifact.py)

Inspects binary model files (.pkl, .pt, .pth, .bin, .joblib, .ckpt):

• Executable Format Detection: Flags pickle-based formats that allow arbitrary Python code execution during deserialization (recommending memory-mapped formats like Safetensors or GGUF).
• Opcode Disassembly: Safely parses the pickle bytecode stream without loading arbitrary objects to detect dangerous globals (os.system, subprocess.Popen, posix_spawn, eval, builtins.exec).

4. Declarative YAML Rule Engine (rules/yaml_loader.py & data/rules/*.yaml)

All 175+ built-in rules covering prompt injection, token length enforcement, system message isolation, rate limits, structured JSON schema validation, and GenAI telemetry are stored in declarative per-chapter YAML rule packs (c01_training_data.yaml–c12_monitoring_logging.yaml) and evaluated by a zero-dependency YAML rule loader with custom rule override support (-r / --rules-path).

12 AISVS Chapters: Standard Coverage

aisvs-scan audits against all 12 Chapters (214 requirements) defined in the official OWASP standard across verification levels L1, L2, and L3:

Verification Verdicts

For every requirement evaluated, the engine produces one of five verdicts:

• PASS: Positive defense control or implementation indicator was statically verified (e.g. schema validator, token length bound, sandbox runner, signature verification).
• FAIL: Actionable security weakness or policy violation detected in code, prompt, configuration, or model artifact.
• GAP: Statically verifiable requirement that is applicable to the target but has no detected defense indicator.
• MANUAL: The requirement requires human, operational, legal, or physical review (e.g. legal data agreements, out-of-band reviews).
• N/A: The relevant AI component (e.g. MCP, RAG, Agent, Training, Edge) was not detected in the target project, eliminating irrelevant noise.

Quickstart

1. Install from PyPI (Recommended)

pip install aisvs-scanner
aisvs-scan scan /path/to/ai-project

2. Run Directly from Source (No Installation Needed)

# Clone the scanner
git clone https://github.com/mesutgungor/aisvs_scanner.git
cd aisvs_scanner

# Run scan on any target
./bin/aisvs-scan scan /path/to/ai-project

CLI Reference

aisvs-scan scan [TARGET] [OPTIONS]

Performs a security verification audit of a target directory, file, or repository.

aisvs-scan validate-rules <PATH...>

Validate one or more custom YAML rule files or directories before running a scan:

aisvs-scan validate-rules examples/custom_rules.yaml

aisvs-scan list-requirements [OPTIONS]

Browse the official AISVS requirements catalog.

# View all requirements for Chapter 10 (MCP Security)
aisvs-scan list-requirements -c C10

# View only foundational Level 1 requirements for Input Validation
aisvs-scan list-requirements -c C2 -l 1

aisvs-scan list-rules

List all 175+ built-in detection rules and defense indicators, showing their mapped AISVS controls and severities.

aisvs-scan sync

Fetch the latest AISVS requirements and descriptions directly from the official OWASP/AISVS repository:

aisvs-scan sync --standard-version 1.02-dev --ref main

Interactive HTML Dashboard

aisvs-scan includes a standalone, zero-dependency interactive HTML dashboard (-f html):

aisvs-scan scan /path/to/project -f html -o aisvs-audit-report.html

Dashboard Features:

• Interactive KPI Status Cards: Click PASS, FAIL, GAP, MANUAL, or N/A cards to immediately filter the requirements matrix.
• Findings Live Search & Severity Filter: Instant real-time filtering across Rule IDs, file paths, snippets, and severities.
• Chapter Selectors & Quick Pills: Toggle presets like Critical & High, MCP Only (C10), or Agents (C9).
• Expandable Code Inspection Drawers: Click any finding row to reveal the extracted source code snippet, confidence score, and remediation steps.
• Requirement Verification Matrix: Live full-text search with dynamic counter (Showing X of 214 requirements).
• Global Reset: Single click to restore all views and filters.

Output Formats

CI/CD Integration

GitHub Actions Workflow (with SARIF Alerts & Build Failure)

Create .github/workflows/aisvs-security.yml:

name: OWASP AISVS AI Security Verification

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  ai-security-audit:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Checkout AISVS Scanner
        uses: actions/checkout@v4
        with:
          repository: 'mesutgungor/aisvs_scanner'
          path: './.aisvs_scanner'

      - name: Run AISVS Security Verification
        run: |
          python3 ./.aisvs_scanner/bin/aisvs-scan scan . \
            --level 2 \
            --format sarif \
            --output aisvs-results.sarif \
            --fail-on high \
            -e ".aisvs_scanner/*" -e "tests/*"

      - name: Upload Results to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: aisvs-results.sarif

Real-World Benchmark Case Studies

Case Study 1: assafelovic/gpt-researcher (30,000+ ⭐)

The scanner was benchmarked against gpt-researcher, a complex open-source autonomous agent framework containing multi-agent loops, vector retrieval, and MCP servers:

=== OWASP AISVS AI Security Verification Standard Scanner ===
Standard: OWASP AISVS v1.01 (Level 1-2) | Target: gpt-researcher
Scanned: 708 files in 51.23s

Verification Summary:
  PASS:    70 (Verified defense indicators present)
  FAIL:    15 (Actionable security violations detected)
  GAP:     73 (Applicable controls missing static indicators)
  MANUAL:   7 (Human/operational verification required)
  N/A:      2 (Features not present in target)

Key Real-World Findings Detected:

1. Unpinned MCP Tool Execution (AIS-MCPCFG-001 → AISVS #10.1.1): .mcp.json executed uvx gpt-researcher without an exact version pin or digest. A compromised package release would immediately execute arbitrary code upon client launch.
2. Unsafe Pickle Deserialization in Browser Scraper (AIS-DESER-001 → AISVS #4.1.2, #6.1.1): gpt_researcher/scraper/browser/browser.py used pickle.load() on browser cookies, allowing remote code execution via poisoned state files.
3. Retrieval Queries Without Tenant Filters (AIS-RAG-002 → AISVS #5.2.2, #8.1.3): Vector store queries in backend/chat/chat.py were invoked without metadata scoping, allowing potential cross-tenant document leakage in multi-user environments.
4. Silent Input Truncation (AIS-PROMPT-003 → AISVS #2.1.4): Input strings were silently sliced (context[:max_len]) instead of rejected, which can strip safety guardrails and developer instructions.
5. MCP Server Bound to 0.0.0.0 Without Host Verification (AIS-MCP-013 → AISVS #10.3.3): FastAPI MCP server bound to all interfaces without Origin/Host verification middleware, exposing it to local DNS rebinding attacks.

(Interactive HTML report included in examples/reports/gpt_researcher_audit_report.html).

Case Study 2: pydantic/pydantic-ai (pydantic_ai_slim)

Scanned with the declarative YAML rule engine across 486 source files covering agent toolsets, embeddings, realtime audio/LLM pipelines, and MCP client/server integrations:

=== OWASP AISVS AI Security Verification Standard Scanner ===
Standard: OWASP AISVS v1.01 (Level 1-2) | Scanner v1.0.0
Target: pydantic_ai_slim | Scanned 486 files in 72.28s

Detected AI Components: agent, llm, mcp_client, mcp_server, media_generation, model_loading, multimodal, rag, serving

Verification Summary:
  PASS:    78 (Verified defense indicators present)
  FAIL:     6 (Actionable security violations detected)
  GAP:     59 (Applicable controls missing static indicators)
  MANUAL:   7 (Human/operational verification required)
  N/A:     17 (Features not present in target)

Key Findings Detected:

1. Special-Token Injection Allowed in Tokenizer (AIS-PROMPT-002 → AISVS #2.1.7): pydantic_ai/realtime/openai_live.py called encoding.encode(text, allowed_special='all'), allowing reserved control tokens (<|im_start|>, <|endoftext|>) in untrusted inputs.
2. Silent Input Truncation (AIS-PROMPT-003 → AISVS #2.1.4): pydantic_ai/embeddings/bedrock.py and cohere.py configured truncate = 'END' instead of rejecting over-length inputs.
3. Model Download Without Revision Pinning (AIS-SUPPLY-001 → AISVS #6.1.2, #6.1.3): pydantic_ai/embeddings/sentence_transformers.py loaded SentenceTransformer('Qwen/Qwen3-Embedding-0.6B') without an immutable commit SHA revision pin.

(Interactive HTML report included in examples/reports/pydantic_ai_audit_report.html).

Declarative YAML Rule Engine & Custom Rules

All 175+ built-in OWASP AISVS detection rules and defense evidence indicators are decoupled from Python code into per-chapter YAML rule packs under src/aisvs_scanner/data/rules/ (c01_training_data.yaml through c12_monitoring_logging.yaml).

• Zero External Dependencies: Uses a built-in pure-Python YAML parser out of the box (automatically accelerating with PyYAML if installed).
• Custom Rules & Overrides: Supply -r / --rules-path <file_or_dir> to add organization-specific rules or override any built-in rule by id.

# examples/custom_rules.yaml
rules:
  - id: CUSTOM-LLM-001
    kind: violation
    reqs: ["5.3.1", "2.1.1"]
    title: "Direct unapproved LLM endpoint domain in source code"
    severity: high
    confidence: high
    langs: [code, config_only]
    patterns:
      - 'https?://api\.unapproved-llm-vendor\.example\.com'
    remediation: "Route all LLM inference calls through the approved enterprise AI gateway."

  - id: CUSTOM-GUARD-001
    kind: evidence
    reqs: ["2.1.1", "7.1.1"]
    title: "Enterprise AI Gateway SDK Guardrail Initialized"
    langs: [python, js]
    patterns:
      - 'EnterpriseAIGateway\s*\('

# Validate custom YAML rules
aisvs-scan validate-rules examples/custom_rules.yaml

# Scan a repository with built-in + custom YAML rules
aisvs-scan scan . -r examples/custom_rules.yaml

Suppressing Warnings

To suppress false positives or document accepted risks, use inline directives on the offending line:

# Suppress a specific rule:
api_key = get_temporary_test_token()  # aisvs:ignore AIS-SECRET-001

# Suppress all rules on a line:
result = client.chat.completions.create(...)  # noqa

# Or use standard security suppression tags:
raw_input = req.get_data()  # nosec

Testing

Run the comprehensive unit test suite:

PYTHONPATH=src python3 -m unittest discover -s tests -v

All unit tests execute hermetically in < 0.05 seconds.

Contributing

Contributions are welcome! Please follow these steps:

1. Fork the repository.
2. Create your feature branch (git checkout -b feature/new-aisvs-rule).
3. Commit your changes (git commit -m 'Add AISVS check for C10.4.8').
4. Ensure all unit tests pass (python3 -m unittest discover -s tests).
5. Open a Pull Request.

License

Distributed under the Apache License 2.0. See LICENSE for details.

Aligned with the OWASP Artificial Intelligence Security Verification Standard project.