Skip to content

Back to the catalog

apisec-inc/AI-Surface
github.comrepo

apisec-inc/AI-Surface

ai-surface is a local/offline static analysis CLI (apisec-inc) that scans a codebase for AI attack surface — LLM SDK calls, agent frameworks (LangChain, AWS Strands), MCP servers, RAG/vector stores, model gateways, and provider keys — and flags risk indicators such as financial-action tools with no human approval or unverified MCP servers. It generates an AI-BOM (CycloneDX), SARIF for GitHub code scanning, and maps findings to OWASP LLM Top 10, EU AI Act, NIST AI RMF, and ISO/IEC 42001, with a baseline+fail-on-severity workflow for gating new risk in PRs without blocking on pre-existing debt.

TL;DR Offline static scanner that inventories and risk-scores an app's agents/MCP/RAG/LLM surface and gates PRs on new high-severity findings, with AI-BOM and OWASP LLM/EU AI Act/NIST mappings.
Open original ↗
Document

What it is

ai-surface (PyPI package apisec-ai-surface) is a Python 3.9+ static-analysis CLI from apisec-inc that inventories the AI attack surface a codebase introduces — LLM calls, LangChain/AWS Strands agents, MCP servers, RAG/vector stores, model gateways, self-hosted runtimes, provider keys, and the HTTP APIs exposing them. The pitch is a pre-merge gate for the AI layer, filling the slot that Trivy (images), Gitleaks (secrets), and SCA (dependencies) already occupy.

How it works

Each risky finding gets an explicit verdict: CONFIRMED RISK (a fact of the code as written — a declared capability, a present secret, a financial tool with no approval step) or LIKELY RISK (inferred, wants human review). A scan ends on a scorecard with a posture grade (the demo app scores D). Findings map to OWASP LLM Top 10 and to EU AI Act / NIST AI RMF / ISO 42001 clauses; by default those governance clauses collapse to one summary line and expand with --governance.

What to do

Run once with no install:

uvx --from apisec-ai-surface ai-surface scan .

Or install and run anywhere:

pipx install apisec-ai-surface
ai-surface scan .
# if not found: pipx ensurepath, then open a new shell

Other invocations and flags the page documents:

pip install apisec-ai-surface && ai-surface scan .
ai-surface scan . --ui                    # loopback-only visual surface map
ai-surface scan examples/demo-app --governance   # per-finding clauses
ai-surface init                           # one-command CI setup

--ai-only drops the plain API-endpoint section. The intended pattern is baseline the existing surfaces first, then gate new high-risk findings before merge — not fail on the whole existing inventory.

Caveats

  • It runs no code, makes no network calls, sends no telemetry, needs no credentials — source stays on the host; --ui serves loopback only.
  • Runtime exploit validation is explicitly out of scope for this OSS scanner; it flags surfaces and infers risk statically, so LIKELY RISK findings still need a human look.

Technologies named here

Techniques named here

  • financial-action
  • no-human-oversight
  • unverified-source
  • remote-mcp
  • broad-permissions
  • non-literal data flow into LLM call
  • RAG retrieval risk
  • RAG poisoning surface
  • BOLA candidate

Related in AI Security