Scan a FastAPI chatbot

​

What this example tests

• All 10 ASI categories at the HTTP boundary.
• The --endpoint mode’s pre-flight reachability check (an unreachable target fails fast with EXIT_TARGET_UNREACHABLE before any LLM budget is spent).
• The default {"input": "<prompt>"} request template (no contract required).

​

Prerequisites

• AgentGuardian installed — pip install agent-guardian.
• A FastAPI agent reachable at an HTTP URL. Use the bundled examples/fastapi_chatbot/ fixture or your own.
• A model spec — --model stub for an offline dry-run, or a real model spec for a graded assessment.

​

Run target

uv sync --extra examples
uv run uvicorn examples.fastapi_chatbot.serve:app --port 8000

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()


class ChatRequest(BaseModel):
    input: str


@app.post("/chat")
def chat(req: ChatRequest) -> dict:
    return {"output": f"You said: {req.input}"}

​

Run AgentGuardian

agent-guardian scan \
  --endpoint http://localhost:8000/chat \
  --model stub \
  --mode fast \
  --output md \
  --output-path scan.md

• --endpoint URL — hosted HTTP endpoint of the FastAPI agent.
• --model stub — offline default. Swap for a real model spec (openai:gpt-4o, gemini:gemini-2.5-flash, ollama:llama3.1) for a graded run.
• --mode fast — fast / smart / full (default).
• --output md --output-path scan.md — Markdown report. Other formats: json, sarif, junit, pdf.

​

Expected output

​

Common errors

• EXIT_TARGET_UNREACHABLE (exit code 6). Two empty-body POSTs with a 2 s timeout both failed. Pass --no-preflight if your endpoint refuses empty bodies but is actually up.
• 422 Unprocessable Entity on every request. Your endpoint expects a different request shape than {"input": "..."}. Declare a target contract with the custom shape — see Config file reference.

​

Next step

• For a tool-bearing target with framework-adapter visibility, read Scan a LangGraph agent.
• For a retrieval-augmented target, read Scan a RAG application.