rai-audit-agents 0.1.8

Agentic AI audits for tool-use, memory, permissions, and prompt injection

rai-audit-agents

Agentic AI audits for tool use, memory, permissions, and prompt injection delivered through tools, retrieval, email, or webpages.

Checks also cover instruction poisoning persisted into agent memory and bounded tool-execution budgets. Agent findings include OWASP Agentic Top 10 2026 mappings where applicable.

Additional controls cover tool arguments, scoped identities, credential propagation, MCP/tool manifests, recursion and retry limits, stop signals, reversible high-impact actions, authenticated handoffs, and delegated permissions. Reports include an explicit OWASP Agentic Top 10 2026 evidence map.

Trace Schema

The canonical versioned JSON schema follows the current OpenTelemetry GenAI operation vocabulary. New traces should set "schema_version": "1.0"; unversioned traces are migrated during loading: invoke_agent, invoke_workflow, execute_tool, and retrieval. Events emit aligned attributes such as gen_ai.agent.name, gen_ai.tool.name, and gen_ai.data_source.id.

OpenTelemetry currently marks its GenAI agent conventions as Development, so the schema preserves a general attributes mapping alongside stable audit fields.

CLI

rai-audit agents run \
  --trace packages/rai-audit-agents/examples/customer_support_trace.json \
  --allowed-tools lookup_order \
  --format html

Python API

from rai_audit.agents import AgentAudit, load_trace

trace = load_trace("packages/rai-audit-agents/examples/customer_support_trace.json")
report = AgentAudit(trace, allowed_tools=["lookup_order"], persist=False).run()

Framework Adapters

Adapters normalize captured records without requiring framework installations:

from rai_audit.agents import (
    adapt_autogen_messages,
    adapt_langgraph_events,
    adapt_openai_agents_trace,
    adapt_otel_spans,
)

References:

• OpenTelemetry GenAI agent spans
• OpenTelemetry GenAI spans
• OpenAI Agents SDK tracing