Compile-time guardrails for .NET AI agent code. Reins is a Roslyn analyzer +
code fix library that catches security, reliability, and cost mistakes in code
built on the Microsoft Agent Framework
(Microsoft.Agents.AI) and the
Microsoft.Extensions.AI
IChatClient abstractions — before the code ever calls a model.
Reins is a compile-time complement to runtime governance tooling: runtime guardrails stop a bad request in production; Reins stops the bug from being merged.
<PackageReference Include="Reins.Analyzers" Version="0.1.0" PrivateAssets="all" />That's it. Reins is a development dependency — it adds nothing to your application's output or its dependency graph. Projects that don't reference an AI agent framework pay zero analysis cost.
| ID | Category | Severity | Rule |
|---|---|---|---|
| REINS0001 | Reliability | Warning | CancellationToken not forwarded to agent invocation |
| REINS0002 | Security | Error | Hardcoded credential in AI client construction |
| REINS0003 | Cost | Warning | Model invocation inside a loop |
| REINS0004 | Reliability | Warning | Unbounded agentic loop |
| REINS0005 | Reliability | Suggestion | Agent invocation without timeout linkage |
| REINS0006 | Security | Warning | Tool method with raw string parameter lacking validation |
| REINS0007 | Observability | Info | Agent constructed without OpenTelemetry instrumentation |
| REINS0008 | Cost | Suggestion | Conversation history grown in loop without reduction |
Precision over recall. A noisy analyzer is a dead analyzer:
- Rules that detect a definite defect (hardcoded credentials) default to Error.
- Rules with high-confidence heuristics default to Warning.
- Rules based on the absence of something that may legitimately live elsewhere (timeouts in Polly, OTel in DI) default to Suggestion/Info and are documented as opt-in.
Every rule doc has a "Known false positives" section. A rule with more than a 2% false-positive rate on real code gets pulled or downgraded.
Tune severities per repo via .editorconfig:
dotnet_diagnostic.REINS0007.severity = warning # opt in harder to OTel
dotnet_diagnostic.REINS0003.severity = none # this repo batches deliberatelySee docs/configuration.md for .editorconfig recipes
and CI/SARIF integration.
dotnet build -warnaserror
dotnet test
dotnet pack -c ReleaseThe samples/Reins.Sample.Agent project intentionally violates every rule and
doubles as an integration test.
See CONTRIBUTING.md — including the rule proposal process and the precision bar new rules must meet.