Skip to content

AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

🕒 Published (v1): 2026-07-02 03:11 UTC · Source: Arxiv · link

Why this paper was selected

Static analysis of agent dependency graphs; framework-agnostic harness structure formalization

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

AgentFlow is the first static analysis framework for LLM agent programs that recovers an Agent Dependency Graph (ADG) — a typed, framework-agnostic IR encoding agents, prompts, models, capabilities, memory, and control policies as nodes with component-dependency, control-flow, and data-flow edges. Built on ADGs, it supports Agent Bill of Materials (BOM) generation and taint-style prompt-to-tool risk detection. Evaluated on 5,399 real-world agent programs, it uncovers 238 prompt-to-tool risks invisible to existing AST-based tools.

Problem

Agent programs built on frameworks like LangGraph, OpenAI Agents SDK, and CrewAI embed agent-level semantics (tool registrations, handoff declarations, shared sessions, approval guards) in framework-specific APIs rather than in ordinary control/data flow. Classical static analysis — call graphs, data-flow analysis, AST scanning — cannot recover these implicit dependencies, leaving governance (supply-chain auditing, BOM generation) and security (taint propagation from untrusted inputs to privileged tools) without a practical foundation.

Method

AgentFlow constructs an ADG defined as a triple:

\[\text{ADG}_P = \langle \text{ACDG}_P,\; \text{ACFG}_P,\; \text{ADFG}_P \rangle\]

where nodes \(V = A \uplus I \uplus M \uplus C \uplus S \uplus G\) represent agents, prompts, models, capabilities, memory states, and control policies. Construction proceeds in three stages:

  1. Fact extraction frontend — framework-specific constructs (decorators, constructors, handoff calls, session objects) are recognized and alias-resolved into normalized opcode-and-operand agent facts (entity, component-binding, control-flow, data-flow). 143 constructs are modeled across five frameworks.
  2. Intra-agent local analysis — agent facts seed ADG nodes and ACDG/ACFG/ADFG edges within each agent (tool bindings, capability calls, memory reads/writes).
  3. Inter-agent dependency analysis — multi-agent transfers (handoffs, delegations) and cross-agent data propagation (shared sessions, inter-agent messages) are resolved and added as typed edges.

The ADG over-approximates execution (all paths permitted by program structure) rather than predicting a single deterministic trace, handling the probabilistic nature of LLM outputs. Two applications are built on ADG queries: structural graph queries for Agent BOM generation, and taint-style reachability queries tracking prompt inputs through agents/memory to high-privilege capabilities.

Key Contributions

  • ADG IR: formal, framework-agnostic typed graph (ACDG + ACFG + ADFG) as a unified intermediate representation for agent programs.
  • AgentFlow static analyzer: first tool that recovers ADGs from source code across five heterogeneous agent frameworks (OpenAI Agents SDK, LangGraph, CrewAI, LlamaIndex, Semantic Kernel), modeling 143 framework constructs.
  • Agent BOM generation: dependency-aware bills of materials that capture not just component inventory but which agents can invoke which tools/MCP servers, how memory propagates, and where approval guards apply.
  • Prompt-to-tool risk detection: taint analysis over ADGs identifying 238 real-world prompt-to-tool reachability risks in AgentZoo.
  • AgentZoo corpus: evaluation dataset of 5,399 real-world agent programs.

Results

  • AgentFlow recovers richer agent entities and dependencies than existing AST-based agent static analysis tools (no specific precision/recall numbers given in the provided text).
  • Generates more dependency-aware Agent BOMs than competing tools.
  • Uncovers 238 taint-style prompt-to-tool risks in 5,399 real-world agent programs from AgentZoo.
  • Covers 143 framework constructs across 5 frameworks (OpenAI Agents SDK: 48, LangGraph: 27 for LangChain/LangGraph, Semantic Kernel: 31, LlamaIndex: 22, CrewAI: 15).

Limitations

  • Static analysis over-approximates; it cannot predict which tools will actually be called at runtime (model output is probabilistic), so false positives in risk detection are expected but not quantified in the provided text.
  • Framework coverage is bounded to five SDKs; novel or proprietary frameworks require new frontend modeling effort.
  • Dynamic prompt assembly (runtime string interpolation, retrieved context) may not be fully captured by static alias resolution.
  • Excludes agent products (e.g., Claude Code) and low-code platforms (e.g., Dify, n8n) — the approach is scoped to source-code, framework-based agent programs only.
  • The provided text truncates before full evaluation details; reported recall/precision metrics and baseline comparison numbers are not shown.

Relevance to Harnesses / Meta-Harnesses

AgentFlow directly models the internal wiring of agent harnesses — the dependency graph it recovers is precisely the structure that a meta-harness author must reason about: which sub-agents exist, what tools they can invoke, how memory is shared across agents, and where control policies gate execution. The ADG IR is effectively a static blueprint of a multi-agent harness, making AgentFlow a structural analysis complement to dynamic harness execution. For researchers building or auditing meta-harnesses, the Agent BOM and taint-reachability analyses address key governance concerns (supply-chain transparency, privilege escalation through tool chaining) that emerge specifically from multi-agent orchestration architectures like those used in paper-digest pipelines and agentic workflows.