QUIET COYOTE — AI Agent Compliance Scanner

klynx-comply is an open-source CLI that scans AI agent codebases for security, governance, and safety issues before deployment. Built by KlynxAI.

Install

pip install klynx-comply

Or from source:

git clone https://github.com/klynx-ai/klynxai-assistant
cd tools/klynx-comply
pip install -e .

Quick Start

# Scan current directory
klynx-comply scan

# Scan a specific path
klynx-comply scan ./my-agent-app

# Output as JSON (for CI/CD)
klynx-comply scan --format json --output report.json

# Output as SARIF (GitHub Code Scanning, VS Code, Azure DevOps)
klynx-comply scan --format sarif --output results.sarif

# Only report HIGH and above
klynx-comply scan --severity HIGH

# Fail CI only on CRITICAL
klynx-comply scan --fail-on critical

# Run specific checks only
klynx-comply scan --checks SC-001 --checks AT-001

# List all checks
klynx-comply checks

Checks

CI/CD Integration

GitHub Actions

- name: Agent compliance scan
  run: |
    pip install klynx-comply
    klynx-comply scan --format sarif --output results.sarif --fail-on high

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

GitLab CI

comply:
  script:
    - pip install klynx-comply
    - klynx-comply scan --format json --output gl-sast-report.json
  artifacts:
    reports:
      sast: gl-sast-report.json

Suppression

Add # comply:ignore to a line to suppress all findings on that line:

api_key = "test-key-for-unit-tests-only"  # comply:ignore

Exit Codes

KlynxAI Integration

When run inside a KlynxAI-managed environment, klynx-comply integrates with:

• Dragon Policy Engine — auto-validates PolicyEnvelope usage
• KlynxScan — feeds findings into vulnerability dashboard
• WarRoom AI — compliance gate before deployment

License

Apache 2.0 — free to use, modify, and distribute.

Built with by KlynxAI