Reins.Analyzers
0.1.1
dotnet add package Reins.Analyzers --version 0.1.1
NuGet\Install-Package Reins.Analyzers -Version 0.1.1
<PackageReference Include="Reins.Analyzers" Version="0.1.1"> <PrivateAssets>all</PrivateAssets> <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets> </PackageReference>
<PackageVersion Include="Reins.Analyzers" Version="0.1.1" />
<PackageReference Include="Reins.Analyzers"> <PrivateAssets>all</PrivateAssets> <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets> </PackageReference>
paket add Reins.Analyzers --version 0.1.1
#r "nuget: Reins.Analyzers, 0.1.1"
#:package Reins.Analyzers@0.1.1
#addin nuget:?package=Reins.Analyzers&version=0.1.1
#tool nuget:?package=Reins.Analyzers&version=0.1.1
Reins.Analyzers
Compile-time guardrails for .NET AI agent code. Reins is a Roslyn analyzer +
code fix library that catches security, reliability, and cost mistakes in code
built on the Microsoft Agent Framework
(Microsoft.Agents.AI) and the
Microsoft.Extensions.AI
IChatClient abstractions — before the code ever calls a model.
Reins is a compile-time complement to runtime governance tooling: runtime guardrails stop a bad request in production; Reins stops the bug from being merged.
Install (30 seconds)
<PackageReference Include="Reins.Analyzers" Version="0.1.0" PrivateAssets="all" />
That's it. Reins is a development dependency — it adds nothing to your application's output or its dependency graph. Projects that don't reference an AI agent framework pay zero analysis cost.
Rules
| ID | Category | Severity | Rule |
|---|---|---|---|
| REINS0001 | Reliability | Warning | CancellationToken not forwarded to agent invocation |
| REINS0002 | Security | Error | Hardcoded credential in AI client construction |
| REINS0003 | Cost | Warning | Model invocation inside a loop |
| REINS0004 | Reliability | Warning | Unbounded agentic loop |
| REINS0005 | Reliability | Suggestion | Agent invocation without timeout linkage |
| REINS0006 | Security | Warning | Tool method with raw string parameter lacking validation |
| REINS0007 | Observability | Info | Agent constructed without OpenTelemetry instrumentation |
| REINS0008 | Cost | Suggestion | Conversation history grown in loop without reduction |
Severity philosophy
Precision over recall. A noisy analyzer is a dead analyzer:
- Rules that detect a definite defect (hardcoded credentials) default to Error.
- Rules with high-confidence heuristics default to Warning.
- Rules based on the absence of something that may legitimately live elsewhere (timeouts in Polly, OTel in DI) default to Suggestion/Info and are documented as opt-in.
Every rule doc has a "Known false positives" section. A rule with more than a 2% false-positive rate on real code gets pulled or downgraded.
Tune severities per repo via .editorconfig:
dotnet_diagnostic.REINS0007.severity = warning # opt in harder to OTel
dotnet_diagnostic.REINS0003.severity = none # this repo batches deliberately
See docs/configuration.md for .editorconfig recipes
and CI/SARIF integration.
Building
dotnet build -warnaserror
dotnet test
dotnet pack -c Release
The samples/Reins.Sample.Agent project intentionally violates every rule and
doubles as an integration test.
Contributing
See CONTRIBUTING.md — including the rule proposal process and the precision bar new rules must meet.
License
Learn more about Target Frameworks and .NET Standard.
This package has no dependencies.
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.