taoq-ai/ZIRAN Agent Security Scan

Run ZIRAN automated security scans on AI agents in your CI/CD pipeline

Trust Signals

name	description	required	default
command	The ZIRAN sub-command to run. Supported: scan, audit, policy, ci	no	ci
result-file	Path to a previously generated ZIRAN campaign result JSON file. Required for: policy, ci (when not running a live scan).	no	""
source-path	Path to the agent source code directory. Required for: audit.	no	.
framework	Agent framework to scan. Required for: scan. Options: langchain, crewai, bedrock	no	""
agent-path	Path to the agent source file or configuration. Required for: scan.	no	""
coverage	Scan coverage level. Options: essential, standard, comprehensive	no	standard
concurrency	Maximum number of concurrent attack workers.	no	5
stop-on-critical	Stop the scan immediately when a critical finding is detected.	no	true
custom-attacks	Path to a directory of custom YAML attack vectors. If omitted, only built-in vectors are used.	no	""
policy-file	Path to a custom YAML policy file. If omitted the built-in ZIRAN policy is used.	no	""
gate-config	Path to a quality-gate YAML config. If omitted, default thresholds are used.	no	""
sarif-output	Path where the SARIF report will be written. Set to empty string to disable SARIF generation.	no	ziran-results.sarif
severity-threshold	Only report findings at or above this severity. Options: critical, high, medium, low	no	low
python-version	Python version to use.	no	3.12
ziran-version	ZIRAN package version or install spec. Use "." to install from local checkout (e.g. for testing).	no	ziran

name	description
status	Gate result: passed or failed
trust-score	Agent trust score (0.0-1.0)
total-findings	Total number of security findings
critical-findings	Number of critical findings
sarif-file	Path to the generated SARIF file