Developer open-sources three tools to keep AI agents from breaking in production

Three ways agents fall over

As dev.to reported, a developer has open-sourced version 2.0.0 of three small Python tools. Each targets a problem that tends to appear when an AI agent moves from a laptop experiment into a real automated pipeline.

The first problem is tools that run without being checked. MCP (Model Context Protocol, a standard way to give an AI assistant access to tools and data) servers can expose risky actions such as running shell commands or fetching arbitrary web addresses. The second is a single bad file that ruins a long agent session. The third is depending on one model provider, so a rate limit or overload takes everything down.

The tools are described as having zero dependencies, meaning they need no extra software packages. Each is also published as a GitHub Action, an automated check that runs when code changes, and comes with a demo that runs in your browser.

The auditor reads tool code before it runs

The first tool, mcp-agent-security-auditor, does static analysis. That means it inspects code without running it. It uses an AST (abstract syntax tree, the program's structure laid out as a tree) to follow how data moves through a tool.

It ships with 12 rules, numbered MCP-001 through MCP-012, mapped to the OWASP LLM Top 10 and to CWE, a public catalog of software weaknesses. They cover shell command injection, SSRF (tricking a server into making requests it should not), leaked credentials and environment variables, arbitrary file writes, and hidden instructions planted in a tool's description text. That last one is a form of prompt injection, where text aimed at the AI sneaks in as if it were a normal instruction.

Results can be output in SARIF v2.1.0, a standard report format that GitHub's code scanning tab can display. A sample workflow can also fail a build when it finds a high-severity issue.

The crash guard protects long sessions

The second tool deals with a frustrating failure. The author says a password-protected PDF, an empty file, or an HTML error page saved with a .pdf or .png name can permanently break a long-running session in Claude Code, Google Antigravity and Codex. Once the bad item is saved in the session's transcript.jsonl file (a log with one record per line), every later request comes back with an HTTP 400 INVALID_ARGUMENT error.

The guard works in two ways. Before the agent reads a file, it checks the file's first bytes, which reveal the real file type, and looks for the marker PDFs use when encrypted. It also blocks oversized files and fake media. If a transcript is already poisoned, a repair command finds the corrupted blocks, saves a timestamped backup and fixes the file in place.

• Check: run the script with a file path before an agent touches it.
• Heal: point it at a broken transcript to repair it.

The router keeps requests flowing

The third tool, infinite-llm-fallback-router, sits between your software and the AI providers. It can send requests to Anthropic Claude, Google Gemini, OpenAI, DeepSeek or a local server that speaks the OpenAI format.

When a provider returns an error such as 429 (quota used up), 500, 502, 503 or 529 (provider overloaded), the router moves on to another one. It also uses circuit breakers, a pattern borrowed from electrical systems. After repeated failures, the router stops sending traffic to that provider for a cooling-off period that grows longer each time, then tries it again. A companion GitHub Action can check your routing setup on every code change.

The author also mentions a bonus: a browser-based two-factor code generator added to a separate product, Vision Flow Studio Pro v2.0. It is unrelated to the agent tooling.

How much to trust it

The project is a single author's release, and nothing in the post shows independent testing, user adoption or benchmarks. The claims about what the tools catch and how quickly they fail over come from the author alone.

The categories are still useful as a checklist. A security scanner is only as good as its rules, and twelve rules will not catch every unsafe tool. A router that hides provider outages can also hide cost or behavior differences between models. Anyone considering these should read the code, try them on non-critical work first, and keep human review in place.

The tools are MIT-licensed, a permissive license that allows free use and modification. The author invites feedback, issues and pull requests, so the real test will be whether other developers try them and report back.