Automation & agent frameworks Agent Development Kit (ADK, Python)
Is Agent Development Kit (ADK, Python) safe?
Short answer: Caution. StackGrade's weekly scan of google/adk-python gives it a Caution label for 2 critical-severity known vulnerabilities in runtime dependencies (OSV) and a skill or agent instruction file (.agents/skills/adk-setup/SKILL.md) that tells the agent to pipe a remote script into a shell. It does list 4 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Agent Development Kit (ADK, Python) is exploitable in your setup. Automated scan of commit 95d8610 on 2 Nov 2026, not a manual audit.
Updated : the last week its score, rank or safety result changed.
Google's code-first Python toolkit for building, evaluating and deploying agents.
- 22,079 stars
- pushed 1 Nov
- Apache-2.0
- Python
#36of 52 overall#9in Automation & agent frameworks▲ 2 vs Week 44
- Maintenance 30%53
- Adoption 30%15
- Docs 20%69
- Community 20%–
Score over the last 4 weeks: 40, 40, 41, 43.
2 critical-severity known vulnerabilities in runtime dependencies (OSV) (+1 more).
How this score works
Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.
- Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 67 days (about 4 per 30 days), latest release 23 Oct 2026. Median 25.8 h to close an issue (18 closed issues).
- Adoption: 22,079 stars (70%), 4,286 forks (30%).
- Docs: README 9,366 characters, 21 headings, 11 code blocks, install section: yes.
#9 of 14 in Automation & agent frameworks
Ranked by score. The yellow row is this tool.
Show the other 5
- 10OpenBot#39 overall41Caution
- 11AutoGen#41 overall40Caution
- 12OpenAI Agents SDK (Python)#42 overall39Caution
- 13smolagents#47 overall30No dependencies scanned
- 14artemis#50 overall25Caution
Safety scan, 2 Nov 2026
Automated scan of commit 95d8610, 2,982 files. Not a manual audit.
Caution
- 2Critical dependency advisories4 high, 4 medium, 3 low. OSV, runtime dependencies only.
- 0Install hooksNo npm install scripts found.
- 0Remote-code patternsFor example eval(fetch(…)).
- 221Agent files checked1 file tells the agent to pipe a script into a shell.
- 0curl | sh installersIn docs or program code. Information only.
Why this label?
Why this label:
- 2 critical-severity known vulnerabilities in runtime dependencies (OSV)
- Skill/agent file instructs piping a remote script into a shell: .agents/skills/adk-setup/SKILL.md — curl -LsSf https://astral.sh/uv/install.sh | sh
Known vulnerabilities in runtime dependencies (OSV): 2 critical, 4 high, 4 medium, 3 low
anyio@4.9.0 (PYSEC-2026-4025) in contributing/samples/adk_team/adk_knowledge_agent/requirements.txtcertifi@2026.7.22 (PYSEC-2026-4320) in contributing/samples/adk_team/adk_knowledge_agent/requirements.txt
Also found (informational, does not change the label):
- 4 high-severity known vulnerabilities in runtime dependencies (OSV)
- Critical advisories counted once per package: 8 matches across 4 lockfiles
Notes:
- Telemetry/analytics references in code: telemetry, amplitude
Automated scan of commit 95d8610 on 2 Nov 2026, not a manual audit. 2,982 files checked. What we check
Repo activity
From the GitHub API, fetched 2 Nov 2026.
- 10+Releases, 90 daysLatest v2.13.0, 23 Oct
- 26hMedian issue closeOver 18 closed issues
- 22.1kStars+71 since 26 Oct
- 4.3kForks439 open issues
- 2025Repo created1 Apr 2025
4 releases in the last 30 days (GitHub releases feed, last 10 entries):
Questions about Agent Development Kit (ADK, Python)
Answers use this week's StackGrade data.
Is Agent Development Kit (ADK, Python) safe to use?
Caution. StackGrade's weekly scan of google/adk-python gives it a Caution label for 2 critical-severity known vulnerabilities in runtime dependencies (OSV) and a skill or agent instruction file (.agents/skills/adk-setup/SKILL.md) that tells the agent to pipe a remote script into a shell. It does list 4 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Agent Development Kit (ADK, Python) is exploitable in your setup. Automated scan of commit 95d8610 on 2 Nov 2026, not a manual audit.
How does StackGrade score Agent Development Kit (ADK, Python)?
Agent Development Kit (ADK, Python) scores 43 out of 100 in Week 45: #36 of 52 tracked tools overall and #9 in Automation & agent frameworks. The score combines maintenance (53), adoption (15) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.
What are the alternatives to Agent Development Kit (ADK, Python)?
What licence does Agent Development Kit (ADK, Python) use?
The licence listed for google/adk-python is Apache-2.0. Read the licence text before commercial use.
Compare and use it
Side by side
Used in 1 AI use case
All facts and sources
- Type
- Agent framework
- License
- Apache-2.0
- Language
- Python
- Created
- 1 Apr 2025
- Owner
- google (Organization)
- Forks
- 4,286
- Homepage
- google.github.io/adk-docs
GitHub description: “An open-source, code-first Python toolkit for building, evaluating, and deploying sophisticated AI agents with flexibility and control.”
Sources: github.com/google/adk-python, api.github.com/repos/google/adk-python, raw.githubusercontent.com/google/adk-python/main/README.md. Fetched 2 Nov 2026.
Know when Agent Development Kit (ADK, Python) changes label
One email a week: the new top 10, the biggest score changes and every safety label that changed.
Free. Double opt-in: you confirm by email first, unsubscribe in one click.