Plumbline is an open-source analyzer for LLM and agentic code. It finds the defects that make agents fall over — unbounded loops, calls with no timeout, model output reaching a shell — before a single line ships. Trust starts before production.
Plumbline uses taint and dataflow analysis to reason about real properties of LLM and agentic code — not formatting, not naming. The defects that break agents in production are structural, and they're written long before deployment.
Same code, same findings, every run. No flakiness, no model calls in the analysis path, no surprises — safe to gate a build on.
Offline by default and no telemetry — nothing leaves your machine. The one exception is opt-in AI enrichment, which you turn on yourself.
Emits SARIF for GitHub code scanning and your IDE, JSON for tooling, and ships a pre-commit hook.
The bugs that survive testing and surface only under real traffic — the ones a code review misses because they're about behaviour, not syntax.
A loop with no iteration cap or exit condition — the runaway cost and latency risk.
A call with no timeout, or retries turned off — the agent stalls when the provider does.
Generated output passed to a shell, eval, or a SQL query.
A sunset model identifier, or a version nothing pins — behaviour drifts and nobody notices.
Plumbline lives on the left of the lifecycle — design-time. AgentGuard picks it up on the right — runtime. Together they cover the whole path.
Run plumb scan locally before you commit.
The ships-with hook scans every change automatically.
A quality gate the build can fail on — deterministic, so it's fair.
SARIF findings surface right in GitHub, next to your other checks.
Plumbline guards the code before it gets there. AgentGuard guards it once it's live.
Plumbline is Apache-2.0 and public — because you shouldn't have to trust a black box to tell you your AI is sound. Install it in a minute; gate your next build on it.
pip install actaclad-plumbline · plumb scan