Show HN: Rowan, an open-source SAST scanner for AI apps (code, models, MCP)"

Category: security

Tags: sast, security, ai-security, static-analysis, ml-security

Score: 6.5/10 (Innovation: 6, Technical: 6, Documentation: 7, Utility: 7)

Rowan is an open-source static application security testing (SAST) scanner tailored for AI and ML projects, detecting vulnerabilities in source code, model files, and MCP configurations. It combines Opengrep-based taint analysis with model file inspection via Hayward, offering a privacy-conscious, CI-friendly security tool with 573 rules. Its focus on AI-specific risks like unsafe model loading and agent tool usage fills a growing security gap.

Target audience: backend devs, ML engineers, security engineers, devops

Repository: https://github.com/hedgerow-dev/rowan · Python · MIT · 5 stars

View on Hacker News