iFixAi is a free, open source ai security & privacy project written in Python and released under Apache-2.0. It has 15,323 GitHub stars, 1,333 forks and 2 open issues, and was last pushed 35 hours ago. On this registry it ranks #4 of 34 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available. It gained 354 stars over the last 3 tracked days.

What is iFixAi?

iFixAi is an open-source Python auditor that answers, in under 120 seconds, whether an AI agent is actually doing the job it is supposed to do — run either by a human operator or by the agent itself.

What it is

iFixAi lives in the AI & Machine Learning / AI Security & Privacy space as a diagnostic tool for agent evaluation, alignment, governance, and safety. It positions itself between AI red-teaming and operational assurance: a single ifixai run drives a guided setup that picks the system under test, the judge, and the suite, verifies the connection, and saves the configuration, then executes 32 inspections across five pillars and returns an A–F grade with a scored core-pillar scorecard. The project is written in Python and licensed under Apache-2.0.

The concrete problem it addresses is narrow and specific. Existing evaluation, red-teaming, and observability tools grade agents mainly on technical capability such as token efficiency, latency, and prompt-injection resistance. Those measurements do not answer whether the agent fulfils its job against business KPIs and organizational structure. iFixAi replaces that gap — a purely technical or ad hoc assessment — with an all-in-one auditing process that balances adversarial depth against assurance discipline.

Key capabilities

  • Three run modes: a ifixai setup wizard followed by zero-flag ifixai run, fully explicit CLI flags for scripting, or a plugin/skill where the agent itself is the operator.
  • A run that executes 32 inspections across five pillars and produces an A–F grade plus a scored core-pillar scorecard.
  • Suite selection through --suite smoke|strategic|core|extended|all.
  • A choice of grader: self-assessment, one independent vendor, or a multi-judge ensemble.
  • Output as JSON and Markdown reports plus a rich terminal scorecard, written to ./ifixai-results/.
  • Key handling where the wizard auto-detects API keys and stores only the environment-variable name in ifixai.yaml, never the secret itself, or accepts an --api-key flag.
  • Topic coverage spanning agent evaluation, AI alignment, AI governance, AI safety, hallucination detection, the EU AI Act, and ISO 42001.

Who uses it and how

  • First-time users and teams onboarding run ifixai setup once, then repeat a zero-flag ifixai run.
  • CI and automation pipelines use explicit-flag mode to produce audit-ready scripted batches.
  • Operators working inside Claude Code or Codex use a self-provisioning plugin that lets the agent discover config, build the fixture, name the cost before billing, and explain the scorecard.
  • Other agent frameworks scaffold a /ifixai-skill with uvx ifixai install.
  • Windows users run it as python -m ifixai when the ifixai script is not on PATH.

Getting started

Install with pip install "ifixai[openai]", or the anthropic, gemini, and other provider extras, then run ifixai setup followed by ifixai run; reports land in ./ifixai-results/. Claude Code and Codex users can instead install the plugin, and any agent can scaffold a skill with uvx ifixai install.

How it compares

No comparable open-source or paid product is named in the available facts, so iFixAi stands alone in this registry. It defines itself against the broader class of eval, red-teaming, and observability tools, which it says assess agents on technical capability rather than on whether the agent does the job it is supposed to do.

When to use it — and when not to

Choose iFixAi when the question is operational and business-facing — whether an agent meets its KPIs and organizational role — rather than purely technical. A self-hoster must supply their own provider API keys for both the system under test and the judge, and manage the resulting configuration and report files. It is a poor fit for teams wanting a hosted, zero-setup service or deep purely-technical observability, since its stated focus is assurance and grading rather than latency, token, or prompt-injection telemetry.

project readme (upstream, from github) — read inline

iFixAi

English · 简体中文 · 日本語 · 한국어

Independent Auditing of AI Agents

Catch your agent's mistakes and blind spots before the shit hits the fan.

iFixAi — #1 Python repository of the week on Trendshift

Quick startThree ways to runTest your agentScoringDocsContributing

license: Apache 2.0 python 3.10+ CI 50 inspections good first issues


One ifixai run, end to end: guided setup picks the system, judge, and suite; the run verifies the connection and saves your config; 32 inspections execute across five pillars; and the result lands as an A–F grade with a scored core-pillar scorecard.


What it is

The existing Eval, Red-teaming, and Observability Tools are evaluating the agent mainly based on tech capability (token efficiency, latency, prompt injections). They cannot answer the most crucial question.

Is the agent doing the job it is supposed to do based on the business KPIs and Organizational Structure? iFixAi gives you this answer in less than 120 seconds by striking the right balance between AI-Red Teaming and Operational Assurance.

Adversarial depth. Assurance discipline. All-in-one auditing process.

Three ways to run

All three run the same diagnostic underneath. The difference is how you configure and drive it.

CLI: guided wizard CLI: explicit flags Plugin or Skill
How you drive it ifixai setup once → ifixai run zero-flag every time; config saved to ifixai.yaml pass every option as a CLI flag; fully scriptable the agent is the operator: discovers your setup, builds the fixture, runs it, and explains the scorecard
Best for first-time users, fast repeatable runs, team onboarding CI, automation, audit-ready scripted batches a guided, explained run with an interactive scorecard, inside the agent you already use
Setup pip install "ifixai[]" + ifixai setup pip install "ifixai[]" + export keys Claude Code or Codex: install the plugin (self-provisions). Any agent: uvx ifixai install scaffolds /ifixai-skill
Keys auto-detected by wizard; stored as env-var name in ifixai.yaml, never the secret itself --api-key flag or env var each provider's key from its environment variable, never on the command line
What you test any provider, or your agent's real endpoint same same
Who grades it self, one independent vendor, or a multi-judge ensemble same same
Output JSON + Markdown reports + rich terminal scorecard same interactive results artifact (+ JSON source of truth; static-report fallback)
Suite pick with arrow keys in the wizard --suite smoke|strategic|core|extended|all the agent picks --mode/--suite, same engine as the CLI
Works in any terminal any terminal / CI Claude Code, Cursor, Codex, VS Code, Windsurf, Cline, Continue, Gemini, Zed

Quick start

Now try it yourself. Pick a path from the table above; full walkthrough: docs/get-started.md.

Guided wizard (recommended)

pip install "ifixai[openai]"   # or anthropic, gemini, etc.: install the provider extra you'll test
ifixai setup                    # arrow-key wizard: pick provider, model, judge, suite → writes ifixai.yaml
ifixai run                      # no flags needed; reports land in ./ifixai-results/

ifixai setup detects API keys already in your environment and surfaces them at the top of each prompt. No key found? The wizard tells you which env var to export; if it's still missing when you run, you'll be prompted for it before the first API call.

Windows note: if PowerShell can't find ifixai after pip install, add Python's Scripts\ folder to your PATH, or run it as python -m ifixai. This is the usual Python-on-Windows PATH gap, not an iFixAi issue.

Plugin (Claude Code and Codex)

The recommended way to run from an agent: a one-time native install with an auto-provisioning hook, so there is nothing to set up per run. Ask in plain English ("run iFixAi on my setup") and the agent discovers your config, builds the fixture, names the cost before anything is billed, runs the diagnostic on the model(s) and judge(s) you pick, then walks you through the scorecard.

Claude Code, from inside Claude Code:

/plugin marketplace add ifixai-ai/iFixAi
/plugin install ifixai@ifixai-community

Then ask "run iFixAi on my setup", or type /ifixai:ifixai. (Restart Claude Code or run /reload-plugins if it doesn't appear.) Already on ifixai@ifixai-ai? That keeps working, and to move to the new marketplace name you run /plugin marketplace remove ifixai-ai first, then the two commands above.

Codex, in your terminal:

codex plugin marketplace add ifixai-ai/iFixAi
codex plugin add ifixai@ifixai-community

Then start Codex and ask "run iFixAi on my setup". Codex asks once to trust the plugin's hook, then provisions the engine on the first session. Already on ifixai@ifixai-ai? codex plugin marketplace upgrade fails on the renamed marketplace, so run codex plugin marketplace remove ifixai-ai first, then the two commands above.

Skill (every agent)

Prefer a single scaffolded file, or use an agent without a plugin? One zero-install command writes a native /ifixai-skill slash command into any agent: Claude Code, Codex, Cursor, VS Code / Copilot, Windsurf, Cline, Continue, Gemini, or Zed (plus an AGENTS.md bridge). Only uv and Python 3.10+ are needed; no API key or provider extra to scaffold:

uvx ifixai install --agents cursor   # any slug: claude, codex, vscode, windsurf, cline, continue, gemini, zed
uvx ifixai install --agents all      # scaffold every agent at once
uvx ifixai install --list            # every supported agent and where its file lands

Then run /ifixai-skill in that agent. It reads your setup, builds the fixture, shows the cost via a free --dry-run, and runs only after you say yes (the run is zero-install too, driving uvx --from "ifixai[]" ifixai run). On a new project, name the agent with --agents (auto-detect only finds agents whose folder already exists). Already have the CLI on your PATH? Drop the uvx prefix. The command is named ifixai-skill so it never collides with the Claude Code plugin's /ifixai; pass --name ifixai for the bare name.

Explicit flags

## 1. Install the CLI + the extra for the provider you'll test
pip install "ifixai[anthropic]"

## 2. Prove the pipeline runs: built-in mock, no keys, no network, ~1s.
##    Expect a FAILING scorecard (15/50) — the bundled default fixture ships
##    seeded defects on purpose so you see what failures look like.
##    Defect map: ifixai/fixtures/default/README.md
ifixai run --provider mock --api-key not-used --eval-mode self

## 3. Get a citable grade: your model graded by a *different* vendor's judge.
##    Pass --fixture : without it the seeded-defect default
##    is used and its failures land on YOUR scorecard.
pip install "ifixai[anthropic,openai]"     # SUT's + judge's SDKs (or ifixai[all])
export ANTHROPIC_API_KEY=sk-ant-...         # the SUT, graded
export OPENAI_API_KEY=sk-...                # the judge, auto-paired from the environment
ifixai run --provider anthropic --api-k

readme truncated — read the full docs on github

Frequently asked questions

Is iFixAi free to use?

iFixAi is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does iFixAi do?

Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is sup

What is iFixAi written in?

iFixAi is primarily written in Python. Its source is publicly available at https://github.com/ifixai-ai/iFixAi, and it has 15,323 GitHub stars.