AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs

Abstract: LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents, prompts, models, capabilities, memory states, and control policies as typed nodes, and captures their component-dependency, control-flow, and data-flow dependencies as typed edges. Built on ADGs, AgentFlow supports a range of analyses for agent governance and security, including Agent Bill of Materials (BOM) generation and prompt-to-tool risk detection. We implement AgentFlow for five representative agent frameworks and evaluate it on AgentZoo, a corpus of 5,399 real-world agent programs. Our evaluation shows that AgentFlow recovers richer agent entities and dependencies than existing AST-based agent static analysis tools, generates more dependency-aware Agent BOMs, and uncovers 238 taint-style prompt-to-tool risks in real-world agent programs. These results show that ADG provides a practical foundation for understanding, governing, and securing emerging agent software.

• The paper introduces a novel Agent Dependency Graph (ADG) that systematically extracts and models agent-specific dependencies at the framework level.
• It employs a three-phase pipeline—fact extraction, intra-agent, and inter-agent analysis—to uncover complex orchestration flows and risk paths.
• Empirical evaluation on over 5,000 agent programs demonstrates superior asset coverage, enhanced BOM generation, and effective prompt-to-tool risk detection.

AgentFlow: Static Analysis of Agent Program Dependencies via Agent Dependency Graphs

Introduction and Motivation

The AgentFlow framework addresses a fundamental gap in static analysis for LLM-based agent programs: the inability of existing static analysis tooling to recover and reason about agent-specific dependencies, which are introduced at the agent-framework abstraction layer rather than the host programming language level. With the proliferation of agentic software ecosystems—such as LangGraph, OpenAI Agents SDK, and CrewAI—modern agent programs combine host-language code with complex orchestration mechanisms, multi-agent workflows, tool integrations, memory channels, and runtime control policies. These frameworks introduce new forms of dependencies across agents, prompts, models, capabilities, memory states, and policies, which are not captured by classical control/data flow or call-graph analysis.

AgentFlow proposes an intermediate representation—the Agent Dependency Graph (ADG)—that makes agentic dependencies explicit and analyzable, thereby enabling governance and security analyses specific to agent program supply chains.

Agent Dependency Graph: Abstraction and Representation

AgentFlow models agent programs as ADGs, comprising:

• Nodes: Types include agents, prompts/contexts, LLM models, agent capabilities (e.g., tools, MCP endpoints, skills), memory states, and control policies.
• Edges: Typed relations representing:
  • Component-dependency (static assignment/binding; e.g., agent-to-model, agent-to-tool),
  • Control-flow (potential transfers: agent-to-capability, agent-to-agent, guarded by policies),
  • Data-flow (possible propagation: context-to-agent, agent-to-tool argument, capability-to-agent return, memory I/O, message passing).
• Over-approximation: ADGs conservatively model the possible execution- and information-flow induced by the agent framework semantics, rather than just call graphs.

  Figure 1: Agent programs and supply chain components, documenting core entities such as agents, capabilities, memory, and policies.

ADGs are constructed via three subgraphs:

• ACDG: Agent Component Dependency Graph (static binds),
• ACFG: Agent Control Flow Graph (dynamic transition possibility),
• ADFG: Agent Data Flow Graph (information propagation).

This abstraction is framework-agnostic but expressive enough to recover dependencies from heterogeneous programming styles, as evidenced by support for five distinct agent frameworks.

Framework-Specific Semantics and Fact Extraction

The crux of reconstructing ADGs lies in extracting agent facts from framework-specific agent programs. AgentFlow employs frontend adapters to parse constructs such as:

• decorators (@function_tool),
• class/object definitions (e.g., Agent(...)),
• workflow declarations (handoff, Runner.run),
• capability configurations (MCP endpoints),
• policy bindings (approval or guardrail specifications),
• explicit data-channel/memory references.

It resolves aliases and normalizes these references into a canonical form, independent of framework syntax, before further analysis.

Figure 2: Motivating example illustrating agent-specific dependencies (tools, handoffs, memory sharing) that transcend standard function call relationships.

AgentFlow supports 143 framework-specific constructs across OpenAI Agents SDK, LangGraph, CrewAI, LlamaIndex, and Semantic Kernel, demonstrating coverage of both common and advanced agent programming idioms.

ADG Construction Pipeline

ADG recovery proceeds in three phases:

1. Fact Extraction: Parsing framework/host code to generate entity, component, control, and data facts.
2. Intra-agent Analysis: Establishing component bindings and capability invocation edges within individual agents.
3. Inter-agent Analysis: Recovering orchestration flows (handoffs, delegations), cross-agent data flow (shared memory, inter-agent messaging), and over-approximating LLM-induced non-determinism.

This approach generalizes beyond direct code inspection, capturing implicit dependencies obscured by agent-DSLs or code generation.

Figure 3: AgentFlow system overview, depicting multi-phase analysis—from fact extraction to ADG construction and downstream security/governance applications.

Applications: Agent BOM and Prompt-to-Tool Risk Detection

Agent Bill of Materials (Agent BOM):

AgentFlow leverages the ADG structure to generate dependency-rich BOMs enumerating not only which components (prompts, models, tools, skills, policies) are present, but how they are interconnected. This is vital for agent supply chain transparency, provenance, compliance, and vulnerability management, extending beyond traditional SBOM/AI-BOM capabilities [karen2025aibom, vadim2025taibom].

Prompt-to-Tool Risk Detection:

By querying the confluence of ADFG (taint propagation from prompts/context) and ACFG (transitive tool/capability reachability), AgentFlow identifies prompt-to-tool risk paths, i.e., program slices where user-controllable input may trigger privileged side effects. This static analysis provides strong coverage of prompt injection, tool poisoning, and agentic privilege escalation vulnerabilities [icse26taintp2x, liu2024llm4shell].

Empirical Evaluation

AgentFlow was evaluated on 5,399 real-world agent programs (AgentZoo). Key findings:

• ADG recovery: AgentFlow captures substantially more agent-specific entities and edges than Agent-Wiz and AgenticRadar, the two leading open-source baselines. It recovers nontrivial control/data flows, memory/policy dependencies, and complex orchestration overlooked by AST-based approaches.
• Agent BOM generation: ADG enables AgentFlow to generate BOMs with both higher asset coverage and rich binding relationships (component assignments, workflow, memory linkage), exceeding the capabilities of Drako-Agent-BOM, Trusera-AI-BOM, and Cisco-AI-BOM.
• Prompt-to-tool risk analysis: AgentFlow revealed 238 projects (4.4%) with taint-style prompt-to-tool risk, including direct and multi-step transitive channels to sensitive sinks (external send, file access, SQL, code execution). Manual validation of sampled findings yielded a true positive rate of 73%.
• Performance: The framework analyzed typical projects in under 15 seconds median, scaling to thousands of real-world repositories.

Theoretical and Practical Implications

AgentFlow's ADG abstraction and modular pipeline present several substantive advancements:

• Theoretically: ADGs unify agent program analysis, enabling formal reasoning over agent-centric semantics—composition, orchestration, and probabilistic execution patterns.
• Practically: AgentFlow enables practical, scalable auditing of agent software supply chains, risk detection, and compliance automation for enterprises adopting LLM agents.
• Security and Governance: The explicit, compositional representation of dependencies supports advanced analyses, including cyclic control/flaw detection, multi-agent collusion auditing, compositional least-privilege verification [wu2026skillscope], and hybrid fuzz-guided/exploit validation.

Limitations and Future Work

Static, over-approximate modeling inevitably overstates possible flows but is required for soundness when LLM output is not statically predictable. AgentFlow relies on recognizing framework conventions; handling user-defined or rapidly changing APIs, and extending to non-Python ecosystems, would require additional adapters. Integration of dynamic analysis (hybrid fuzzing, exploit validation) using ADG as a guide is a natural evolution. Precision can further improve by richer sink semantics and interleaving points-to reasoning with ADG path extraction.

Conclusion

AgentFlow introduces the Agent Dependency Graph as a comprehensive, framework-agnostic IR for agent program analysis. By recovering agent-specific control, data, and component dependencies, AgentFlow surpasses previous static tooling in supply-chain transparency and risk detection. Its application to large agent corpora demonstrates both feasibility and value for future agent software engineering, security, and regulatory compliance (2607.01640).