# AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs arXiv: https://arxiv.org/abs/2607.01640 ยท HTML: https://mlsanity.com/paper/2607.01640/ ## Key facts - Cited by 2 papers in the map (data through 14 Oct 2026). - Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use. - Builds on 27 of its 64 references that are in the map. - First posted on arXiv 2 Jul 2026. ## Placed in - LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/) ## Builds on (most cited first, 27 of 27) - [Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions](https://mlsanity.com/paper/2503.23278/) (2025) - [Demystifying RCE Vulnerabilities in LLM-Integrated Apps](https://mlsanity.com/paper/2309.02926/) (2023) - [Large Language Model Supply Chain: A Research Agenda](https://mlsanity.com/paper/2404.12736/) (2024) - [MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills](https://mlsanity.com/paper/2606.07131/) (2026) - [Defining and Detecting the Defects of the Large Language Model-based Autonomous Agents](https://mlsanity.com/paper/2412.18371/) (2024) - [On the (In)Security of LLM App Stores](https://mlsanity.com/paper/2407.08422/) (2024) - [An Empirical Study of Agent Developer Practices in AI Agent Frameworks](https://mlsanity.com/paper/2512.01939/) (2025) - [LLM App Store Analysis: A Vision and Roadmap](https://mlsanity.com/paper/2404.12737/) (2024) - [Exploring ChatGPT App Ecosystem: Distribution, Deployment and Security](https://mlsanity.com/paper/2408.14357/) (2024) - [ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation](https://mlsanity.com/paper/2605.26542/) (2026) - [Large Language Model Supply Chain: Open Problems From the Security Perspective](https://mlsanity.com/paper/2411.01604/) (2024) - [ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents](https://mlsanity.com/paper/2603.12614/) (2026) - [Agentproof: Static Verification of Agent Workflow Graphs](https://mlsanity.com/paper/2603.20356/) (2026) - [Demystifying LLM Supply Chain Vulnerabilities in the Wild: Distribution, Root Cause, and Real-World Impact](https://mlsanity.com/paper/2502.12497/) (2025) - [Implementing AI Bill of Materials (AI BOM) with SPDX 3.0: A Comprehensive Guide to Creating AI and Dataset Bill of Materials](https://mlsanity.com/paper/2504.16743/) (2025) - [AIBoMGen: Generating an AI Bill of Materials for Secure, Transparent, and Compliant Model Training](https://mlsanity.com/paper/2601.05703/) (2026) - [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://mlsanity.com/paper/2605.06812/) (2026) - [MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning](https://mlsanity.com/paper/2603.27204/) (2026) - [SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills](https://mlsanity.com/paper/2605.05868/) (2026) - [Lifting the Veil on Composition, Risks, and Mitigations of the Large Language Model Supply Chain](https://mlsanity.com/paper/2410.21218/) (2024) - [YASA: Scalable Multi-Language Taint Analysis on the Unified AST at Ant Group](https://mlsanity.com/paper/2601.17390/) (2026) - [AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems](https://mlsanity.com/paper/2606.21877/) (2026) - [MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis](https://mlsanity.com/paper/2401.03218/) (2024) - [TAIBOM: Bringing Trustworthiness to AI-Enabled Systems](https://mlsanity.com/paper/2510.02169/) (2025) - [LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories](https://mlsanity.com/paper/2604.04288/) (2026) - [Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions](https://mlsanity.com/paper/2605.07135/) (2026) - [Unsafe by Flow: Uncovering Bidirectional Data-Flow Risks in MCP Ecosystem](https://mlsanity.com/paper/2605.07836/) (2026) ## Built on by (most cited first, 2 of 2) - [Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents](https://mlsanity.com/paper/2610.03014/) (2026) - [G-CARB: Graph-Localized Conformal Agent Risk Budget for Compositional Harm](https://mlsanity.com/paper/2610.05563/) (2026) ## Abstract (arXiv) LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined semantics for models, prompts, tools, memory, and multi-agent orchestration logic. As a result, their behavior depends not only on traditional control and data flows, but also on a new class of agent dependencies. Such dependencies are often expressed as framework-induced semantics, such as agent constructors, tool decorators, and agent handoff declarations, making them difficult to recover with existing static analysis or dependency tracking tools. In this paper, we present AgentFlow, the first static analysis framework for recovering and analyzing agent dependencies from agent programs. AgentFlow constructs an Agent Dependency Graph (ADG), a framework-agnostic graph representation that represents agents, prompts, models, capabilities, memory states, and control policies as typed nodes, and captures their component-dependency, control-flow, and data-flow dependencies as typed edges. Built on ADGs, AgentFlow supports a range of analyses for agent governance and security, including Agent Bill of Materials (BOM) generation and prompt-to-tool risk detection. We implement AgentFlow for five representative agent frameworks and evaluate it on AgentZoo, a corpus of 5,399 real-world agent programs. Our evaluation shows that AgentFlow recovers richer agent entities and dependencies than existing AST-based agent static analysis tools, generates more dependency-aware Agent BOMs, and uncovers 238 taint-style prompt-to-tool risks in real-world agent programs. These results show that ADG provides a practical foundation for understanding, governing, and securing emerging agent software.