Drako

pip install drako && drako scan .

Scan for Free

Two scores, two audiences. Governance speaks to security teams — are your agents safe? Determinism speaks to engineers — will they behave the same way twice?

Reachability separates real risks from theoretical ones: a dangerous tool no agent actually calls is flagged, not screamed at you.

drako scan .                       # Full scan, both scores
drako scan --details               # Code snippets + fix suggestions
drako scan --benchmark             # Compare against 100 scanned projects
drako scan --baseline              # Acknowledge existing issues, only show new ones
drako scan --format sarif          # GitHub Code Scanning
drako scan --fail-on critical      # CI gate
drako scan --share                 # Generate shareable score card
drako fix --dry-run                # Preview auto-fixes
drako scan --diff HEAD~1           # Only scan changed files
drako history                      # view policy snapshot history
drako diff v2 v3                   # compare policy versions
drako rollback v2                  # restore previous policy

Agent BOM

Standalone inventory. No runtime, no network, pure AST.

drako bom .

Output formats: --format text (default) · json · markdown

Rules

97 deterministic rules across 16 categories. No LLM in the evaluation loop. Same code, same result, every time. Full rule reference →

Vendor Concentration rules detect when your model, framework, and governance stack come from the same vendor — flagging audit independence risk that vendor-affiliated tools have no incentive to report.

Framework-Specific rules detect known governance gaps in the frameworks you use, including default configurations that ship insecure.

Scoring: start at 100, deduct per finding with caps per category. Grades: A (90-100) · B (75-89) · C (60-74) · D (40-59) · F (0-39)

TypeScript/JavaScript: 17 additional rules (SEC, GOV, COM, DET, ODD) apply when scanning TS/JS projects.

Install: pip install drako[typescript]

Advisories

Drako ships with 25 security advisories in the DRAKO-ABSS format (Agent Behavioral Security Standard) — covering OWASP Top 10 for LLMs, MITRE ATLAS techniques, and real CVEs from CrewAI, LangChain, and AutoGen.

Advisories appear inline in scan findings:

SEC-007  Prompt injection vulnerability       (agents/researcher.py)
         Related: DRAKO-ABSS-2026-001 — System Prompt Extraction
         Ref: OWASP LLM01:2025, MITRE AML.T0051

Each advisory includes: affected configurations, IOC pattern hashes for runtime matching, taint paths, and remediation mapped to Drako rules.

📄 Browse advisories → · ABSS format spec →

Baseline

Existing projects get 40+ findings on first scan. The baseline lets teams acknowledge known issues and focus only on new ones.

drako scan . --baseline            # save current state
drako scan .                       # only NEW findings from now on
drako baseline show                # what's baselined
drako baseline reset               # start fresh

• Score always reflects all findings — real posture, not a filtered view
• CI pass/fail is based on new findings only
• SARIF marks baselined findings as "baselineState": "unchanged"
• Baseline file commits to your repo — shared across the team

Observability Dashboard

Drako ships with a built-in observability dashboard at getdrako.com/dashboard. No external tooling required.

The command center gives you your full governance posture at a glance — audit entries, verified agents, policy blocks, and quota usage — with real-time auto-refresh.

Every agent run produces signals across four dimensions. Drako surfaces them as actionable intelligence, not raw logs:

FinOps

Track and optimize your AI spend with per-model and per-agent cost breakdowns.

What you get:

• Cost by Model — See exactly how much each LLM model costs you
• Cost by Agent — Identify your most expensive agents
• Budget Tracking — Set monthly budgets and track burn rate
• Cache Hit Rate — Monitor how effectively your cache reduces costs

Deep dive: See docs/observability.md for the full architecture, all available metrics, and integration guide.

Desktop Agent Scanning

Scans the MCP servers declared in your AI coding tools — Claude Desktop, Cursor, VS Code, Windsurf, Claude Code, Codex CLI, Gemini CLI, and Kiro.

drako desktop scan          # Discover + scan all installed AI clients
drako desktop bom           # Export the BOM from the desktop agents
drako desktop govern        # Scan + activate proxy protection

8 deterministic rules covering shell/exec capabilities, plaintext credentials, unencrypted transport, elevated privileges, and unrestricted filesystem access. Fully offline and 100% deterministic. No network requests during scanning.

📄 Desktop scanning docs → View the complete documentation here

Configure

drako init                         # generate .drako.yaml from your scan

# .drako.yaml — pre-filled with YOUR agents and tools
governance_level: autopilot        # autopilot | balanced | strict

agents:
  researcher:
    source: agents/researcher.py
tools:
  web_search:
    type: read
  code_runner:
    type: execute                  # ⚠ flagged CRITICAL by scan

policies:
  odd:
    researcher:
      permitted_tools: [web_search, file_reader]
      forbidden_tools: [code_runner]
  dlp:
    mode: enforce
  circuit_breaker:
    failure_threshold: 5
  hitl:
    triggers:
      tool_types: [write, execute, payment]
      spend_above_usd: 100.00

Autopilot reads your scan, generates the config, starts in audit mode. When ready: drako upgrade --balanced enables enforcement.

Industry templates: drako init --template fintech · healthcare · eu-ai-act · startup · enterprise

📄 Full config reference → · Policy templates →

Runtime Enforcement

One line to protect agents in production:

from drako import govern
crew = govern(crew)    # every tool call passes through enforcement

Every tool call goes through a 13-stage pipeline before executing. If a tool is forbidden, carries PII, exceeds spend caps, matches a known threat, or needs human approval — blocked before it runs.

Key capabilities

• 🔒 DLP — Presidio-based PII/PCI scanning. Critical PII blocked before reaching downstream APIs.
• 👤 Human-in-the-Loop — Agent pauses on high-risk actions, escalates to human. Configurable triggers. EU AI Act Art. 14.
• ⚡ Circuit Breaker — Per-agent AND per-tool. One failing tool doesn't kill the whole agent.
• 📋 Audit Trail — SHA-256 hash chain with Ed25519 signatures. Tamper-evident, exportable, regulator-ready.
• 🌐 Collective Intelligence — Anonymous IOC sharing across deployments. One detection protects everyone. Sub-5s propagation.

📄 Full runtime docs → — covers all 20 capabilities including Trust Score, Intent Fingerprinting, ODD Enforcement, Magnitude Limits, FinOps, Secure A2A, Topology Monitoring, Chaos Engineering, Observability, Alerting, and OTEL/SIEM Export.

Out-of-process proxy

Zero code changes. The agent can't bypass what doesn't run in its process.

drako proxy start
export OPENAI_BASE_URL=http://localhost:8990/openai/v1

📄 Proxy docs → · Docker + Helm →

Autopilot Mode

Zero-config governance. One command, smart defaults from your scan.

drako init                     # autopilot (default) — audit-first
drako init --balanced          # enforcement active with escape hatches
drako init --strict            # maximum governance for enterprise
drako init --manual            # full YAML with all sections
drako init --template fintech  # start from industry template

Autopilot analyzes your project and generates a .drako.yaml pre-configured with:

• ODD: Each agent locked to its discovered tools
• DLP: Audit mode (logging PII, not blocking yet)
• Circuit Breaker: Threshold 5 failures / 60s window
• HITL: Active for write/execute tools (auto-allow on timeout)
• FinOps: Cost tracking enabled

Everything starts in audit mode. When you're ready for enforcement:

drako upgrade --balanced    # DLP enforce, ODD enforce, HITL reject on timeout
drako upgrade --strict      # + intent verification, cryptographic audit, magnitude enforce

CI/CD

GitHub Action

The Drako GitHub Action posts inline PR comments on the exact lines where issues are found, uploads SARIF to Code Scanning, and gates merges on governance score.

# .github/workflows/drako.yml
name: Drako Governance
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install drako
      - run: drako scan . --format sarif > results.sarif
      - run: drako scan . --fail-on critical --threshold 70
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: results.sarif }
        if: always()

Pre-commit hook

# .pre-commit-config.yaml
- repo: https://github.com/DrakoLabs/Drako
  hooks:
    - id: drako-scan

Supported Frameworks

EU AI Act

High-risk system rules take effect August 2, 2026.

📄 Compliance report generation →

Performance

97 rules, 10,000 iterations, time.perf_counter_ns(), after 1,000 warmup:

Governance overhead: <0.3% of a typical LLM call.

Policy Templates

Industry-specific governance presets. Start from a template, override what you need.

drako templates list              # show available templates
drako templates show fintech      # preview a template
drako init --template healthcare  # init with template

Available templates:

Templates support inheritance via extends::

# .drako.yaml
extends: fintech
governance_level: balanced
# Your overrides here — template provides the base

See It in Action

git clone https://github.com/drakolabs/drako.git
cd drako/examples/demo-crewai
pip install drako
drako scan .

The demo project has intentional governance gaps and scores ~35 (Grade F). See what Drako finds.

Roadmap

• Beyond Python — Go SDK next. TypeScript/JavaScript already supported. If it makes a tool call, Drako governs it.
• Compliance packages — SOC 2 Type II audit evidence, ISO 42001 templates.

Drako is actively developed and moving fast. If you're deploying AI agents to production, watch the repo — or better, run the scan and see what it finds. 📄 Full roadmap →

License

BUSL-1.1. Free to use in production. Cannot offer governance capabilities as a competing hosted service. Converts to Apache 2.0 four years after release. See LICENSE.

Contributing

Every rule requires a positive fixture, a negative fixture, and a standard reference. See CONTRIBUTING.md.