← All tools

shmindmaster/crewscore

AI Agent
Popularity 65 Updated AI & Agents

What did you forget to tell your AI agent? Paste a system prompt, see which failure modes it never guards against — prompt injection, hallucination, runaway cost, missing human approval. Offline, deterministic, no API key, no telemetry.

githubauto-collected

Installation

source
git clone https://github.com/shmindmaster/crewscore

Install with source.

<div align="center"

CrewScore

Find the safety rules your AI agent prompt forgot.

CrewScore reads your system prompt and shows you which of 23 safety controls it never states — injection defense, human approval, cost limits, stop conditions.

We scanned 356 real agent prompts: 83 production prompts and 273 general-purpose prompts. Among the production subset, median coverage was 14 of 100. See the numbers →

<br/

Example result: 8 of 23 written guardrails found · 15 may be missing. CrewScore checks whether controls are written down, not whether an agent obeys them.

Try it live, no install: crewscore.ai

</div

pip install crewscore
crewscore scan .

Deterministic regex over prompt text. Offline, no API key, no LLM.

---

Read this first

CrewScore is a checklist, not a benchmark. The number is the share of 23 published controls your prompt states — nothing about whether they are well specified, mutually consistent, or obeyed at runtime.

| What the prompt does | What it scores | | --- | --- | | Nothing written down | 0 | | One control in each of the 8 dimensions | 36 | | All 23 controls | 100 | | One control restated five different ways | same as stating it once |

So a low score is actionable — you probably have not written down an injection policy, a human gate, or a safe-stop rule, and those are worth writing. A high score means the text is present, not that the agent obeys it. Don't rank prompts, teams, or vendors by this number, and don't treat a threshold as a safety bar. Prefer the findings to the total.

Three dimensions — Cost, Compliance, Audit — ship with known-poor construct validity and say so. Compliance is keyword detection; naming a regulation is not complying with it.

📄 The validation study → — including the arithmetic showing our own scale was broken through 0.1.0, which we published before fixing.