Actenon is a command-line scanner for AI agent frameworks and codebases. It identifies consequential actions reachable by a model-controlled parameter without an authorization check on the execution path.
The tool was used to scan 25 AI agent frameworks comprising 23,476 files across 25 repositories pinned by SHA. It reported 30 findings that were hand-triaged, along with 12 false positives discovered in the scanner itself that were fixed prior to release. In one example run on 340 files it surfaced seven issues in 0.4 seconds, distinguishing categories such as data loss, execution, and egress. The scanner specifically differentiates validation checks from true authorization guards at the point of side effects.
It is delivered as an open-source package under the Apache 2.0 license. Developers install and run it locally with the single command pipx run actenon-scan scan . on a codebase directory. The project page presents both the scanner and a research note detailing the methodology, limits, and what the team initially got wrong.
Actenon sits in PulseGate's Developer Tools category. It focuses on finding and fixing paths in AI agent code where models can trigger consequential actions without authorization checks. It is built as an open-source project for developers. Actenon is open source under the Apache-2.0 license. Actenon is available on the command line.
Actenon builds and maintains Actenon, and the product first shipped in 2026. Development happens publicly on GitHub with 75 commits in the last 90 days. Key capabilities include Security Scanning, Authorization Gap Detection, and False Positive Handling.
Latest indexed changes and source events
I scanned my AI agent framework for destructive/consequential actions, and wow verified by the PulseGate indexer
Other apps tracked under the same category.
