Rowan

Rowan is an open-source static application security testing (SAST) tool designed specifically for AI and machine learning projects. It analyzes source code, AI model files, dependencies, and agent/MCP configuration to find potential security vulnerabilities such as injection, unsafe deserialization, SSRF, leaked secrets, unsafe model loading, and risky agent tools. It provides evidence for each finding without executing the code and supports languages including Python, JavaScript/TypeScript, Ruby, PHP, Rust, Java, Kotlin, and C#. Rowan aims to help developers identify security issues in AI/ML projects via static analysis.