Install & first scan

Stoa is a local-first static scanner for repositories that contain AI agents. It runs entirely on your machine — no source is uploaded, no telemetry.

Install

pipx install stoa-agent-risk
stoa --version

Python 3.10+. No accounts, no API keys.

First scan

cd my-repository
stoa scan .
open stoa-report.html

A scan is report-only by default (always exits 0) and writes two files: a self-contained HTML report (with the Dimension Exposure Matrix at the top) and stoa-registry.json for machines and coding assistants.

Gate a pull request

stoa init github

This scaffolds a GitHub Actions workflow that scans each PR, diffs agent reach against the base branch, and fails only on a newly introduced high-confidence critical finding (AI002 exec class, or a hardcoded credential).

Use it with a coding agent

stoa scan . --json stoa-registry.json

The registry is deterministic and already redacted, so Claude Code, Cursor, or Copilot can read it and remediate findings without ever seeing a raw credential.

← Overview Dimension exposure →