apisec-inc / AI-Surface

What it does

• Runtime telemetry or behavior monitoring. Use tools like Helicone, LangSmith, Arize, or Phoenix.
• Runtime exploit validation. ai-surface maps and audits statically; it does not prove exploitability against a running app (see Runtime validation).
• Prompt injection, jailbreak, bias, or accuracy testing. Out of scope by design. ai-surface is a structural analyzer, not a model evaluator.
• Full cross-file dataflow for tool resolution. Regex/AST-light today; agent tools built through factory functions may not be fully resolved. Treat the map as a strong floor, not proof of complete coverage. AST/dataflow is the top roadmap ite
• Secret-value reads or PII classification. Secrets are reported by name and type only, with values redacted. Use a dedicated secret scanner for value-level coverage.