{
  "markdown": "# Draugr\n\n> Run Trivy, Semgrep, Gitleaks and more from one file. Get one SARIF report and one verdict.\n\n[![CI](https://github.com/draugr-dev/draugr/actions/workflows/ci.yml/badge.svg)](https://github.com/draugr-dev/draugr/actions/workflows/ci.yml)\n[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/draugr-dev/draugr/badge)](https://scorecard.dev/viewer/?uri=github.com/draugr-dev/draugr)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13631/badge)](https://www.bestpractices.dev/projects/13631)\n[![Latest release](https://img.shields.io/github/v/release/draugr-dev/draugr?sort=semver)](https://github.com/draugr-dev/draugr/releases)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue)](LICENSE)\n\n**Describe your app. Draugr figures out the rest.**\n\nEvery application carries problems nobody put there on purpose: a library that turned out to have a\nhole in it, a password committed by accident, a server setting that leaves a door open. Draugr finds\nthem, works out which ones actually matter for *your* app, and answers the question you are really\nasking before a release. **is this safe to ship?**\n\nIt runs the established open-source scanners for you, Trivy, Semgrep, Gitleaks and others, so there\nis nothing to choose between, wire up, or read five of. You describe what you built, once, in one\nfile: where the repositories are, what images it builds, what it exposes, what infrastructure it\nruns on. Draugr picks the checks that apply, runs the right tool for each, and produces evidence you\ncan hand to somebody else. Bring the scanners you already pay for, or use the open-source defaults.\n\nFindings are **ranked**, not listed. A scanner's \"critical\" describes a flaw in the abstract. How\nbad it could be at its worst, anywhere. The same flaw is act-now in the service strangers can reach\nand backlog in the internal tool three people use, and no scanner can tell those apart because the\ndifference is in the file you wrote, not in the code. And [`draugr diff`](docs/guides/pr-diff.md)\ngates a pull request on **new** findings only, so inheriting two hundred existing ones does not\nblock every change.\n\n**[Quickstart](#quickstart)** · [See it in action](#see-it-in-action) ·\n[What it checks](#what-it-checks) · [In your pipeline](#in-your-pipeline) ·\n[Documentation](#documentation) · [What Draugr doesn't promise](#what-draugr-doesnt-promise) ·\n[Security](#security--supply-chain)\n\n## See it in action\n\n```console\n$ draugr scan .\nDraugr · FAIL   (draugr-demo 1.0)\n\nPriorities:  P1 197   P2 629   P3 229   P4 18\n\nControls:\n  iac       FAIL   7 high  10 medium  23 low\n  images    FAIL   20 critical  153 high  248 medium  37 low\n  licenses  pass   353 medium  176 low\n  sast      FAIL   7 high  10 medium\n  sca       FAIL   4 critical  10 high  13 medium  1 low\n  secrets   FAIL   1 high\n\nReachability:\n  govulncheck  2 reachable, 2 unreachable\n  Unreachable findings are ranked down in priority, not removed from the report.\n\n1 finding suppressed by config.exclude · 1 accepted by demo@example.com\n\nFix first (top 10 of 1073, by priority):\n  Priority  Severity  Score  Rule            Control  Scanner  Location\n  P1        critical  9.8    CVE-2026-42010  images   trivy    python:3.8-slim\n            libgnutls30: gnutls: Authentication Bypass via NUL Character in Username\n  P1        critical  9.8    CVE-2026-31789  images   trivy    python:3.8-slim\n            libssl3: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509\n  P1        critical  9.8    CVE-2019-20477  sca      trivy    app/requirements.txt:4\n            PyYAML 5.1: command execution through python/object/apply in FullLoader\n```\n\nAbridged: the real run lists ten and says how many it did not. That last block is the point, a\nthousand findings, ordered, with the three that matter this week at the top.\n\n**Priority (P1–P4) is not severity.** Severity says how bad a flaw is at its worst, anywhere.\nPriority weighs that against how exposed and how important the part of your app it sits in is, which\nno scanner can work out, because it is not in the code.\n\n**[draugr-dev/draugr-demo](https://github.com/draugr-dev/draugr-demo)** is a deliberately\nvulnerable app wired to Draugr: every control lights up, findings land in the repo's\n**Security → Code scanning** tab, and its example pull requests show the new-vs-fixed diff.\n\n## Quickstart\n\n```bash\ncurl -fsSL https://draugr.dev/install.sh | sh\n```\n\nInstalls to `~/.local/bin`, no `sudo`. It verifies before it installs and says which checks ran, the\narchive's SHA-256 against the release `checksums.txt`, plus the cosign signature on that file when\n[cosign](https://docs.sigstore.dev/cosign/) is on your `PATH`, and installs nothing if a check\nfails. The script is [readable in the repo](install.sh); other routes, including Homebrew and `go\ninstall`, are in the [install guide](docs/getting-started/install.md).\n\n```bash\ndraugr tools install     # fetch the scanners, pinned and verified\ndraugr scan .            # scan this repo with sensible defaults\ndraugr init              # or scaffold a draugr.saga.yaml to customize\n```\n\nThen describe what you actually ship:\n\n```yaml\nproject: my-app\nrelease:\n  version: \"1.0\"\nconfig:\n  controllers:\n    images:\n      enabled: true\ncomponents:\n  - name: web\n    images:\n      - image: alpine:3.19\n```\n\n```bash\ndraugr scan draugr.saga.yaml            # console summary; exits non-zero on fail\ndraugr scan draugr.saga.yaml -o out/    # also writes report.json + results.sarif\ndraugr scan draugr.saga.yaml --format markdown   # or html, junit, json, sarif\n```\n\n**Your editor already knows this file.** Draugr's\n[JSON Schema](https://draugr.dev/schema/draugr.saga.schema.json) is registered with\n[SchemaStore](https://www.schemastore.org/), so any `*.saga.yaml` gets completion, hover docs and\ntypo warnings on open with nothing to configure.\n\nOr let discovery write the descriptor for you:\n\n```bash\ndraugr survey github repos --org my-org -o draugr.saga.yaml\ndraugr survey k8s images --namespace prod -o draugr.saga.yaml\n```\n\nFull walkthrough: [quickstart](docs/getting-started/quickstart.md).\n\n## What it checks\n\nEleven controls, each backed by a tool Draugr executes rather than bundles, so every scanner stays\nunder its own license, and you can swap it.\n\n| Control | Looks for | By default |\n|---|---|---|\n| `sca` | known flaws in the libraries you depend on | Trivy, Grype and Mend opt-in |\n| `secrets` | passwords and keys committed by accident, history included | Gitleaks |\n| `sast` | patterns in the code you wrote that let somebody in | Semgrep, gosec opt-in for Go |\n| `iac` | settings that leave a door open, in Terraform, Kubernetes and Dockerfiles | Trivy |\n| `images` | what is baked into your container images | Trivy, Grype opt-in |\n| `licenses` | terms attached to code you did not write | Trivy |\n| `dast` | problems only visible from outside a running app | Nuclei, authenticated, and from an OpenAPI spec |\n| `headers` | how your site answers a browser | native |\n| `tls` | certificates and encryption | native |\n| `infrastructure` | your Kubernetes cluster, against the CIS benchmarks | native, kube-bench opt-in |\n| `threats` | whether anything you talk to is on a public blocklist | abuse.ch URLhaus |\n\nEvery scanner, what it sends and whose terms it carries:\n[integrations catalog](docs/reference/catalog.md).\n\nAlongside them: content-hash caching, an SBOM per repository and image, KEV/EPSS enrichment,\nper-control gate thresholds, and suppressions that stay in the report **with the reason someone\ngave** rather than disappearing.\n\n## In your pipeline\n\nThe first-party GitHub Action installs Draugr, provisions the scanners, and hands the merged SARIF\nto code scanning, one clean **Draugr** tool in the Security tab:\n\n```yaml\npermissions:\n  contents: read\n  security-events: write\n\nsteps:\n  - uses: actions/checkout@v4\n  - id: draugr\n    uses: draugr-dev/draugr@v0     # pin @vX.Y.Z for reproducible CI\n    with:\n      saga: draugr.saga.yaml\n      tools: true                  # provision the scanners the controls need\n  - if: always()                   # publish findings even when the gate fails\n    uses: github/codeql-action/upload-sarif@v3\n    with:\n      sarif_file: ${{ steps.draugr.outputs.sarif }}\n```\n\n[GitHub Actions](docs/guides/github-action.md) · [GitLab](docs/guides/gitlab-ci.md), an include,\nGitLab's own report formats, a sticky merge-request comment · [Azure\nPipelines](docs/guides/azure-pipelines.md), a step template\n\n**From an AI coding assistant.** Ask one to check a change and it will, using whatever scanner it\nfinds over a scope it chose. `draugr mcp` serves Draugr over the [Model Context\nProtocol](https://modelcontextprotocol.io) so it reads your *committed* descriptor instead, and\nscanning is off by default, because it clones repositories and runs external tools.\n\n```bash\nclaude mcp add draugr -- draugr mcp\n```\n\nSee [use Draugr from an AI coding assistant](docs/guides/ai-agents-mcp.md).\n\n## Documentation\n\n**[Documentation index →](docs/README.md)**\n\n- [Quickstart](docs/getting-started/quickstart.md), install, first scan, first survey, CI\n- [Concepts](docs/concepts/saga.md), the descriptor, controls, scanners, the verdict\n- [Saga schema](docs/reference/saga-schema.md) · [CLI reference](docs/reference/cli.md),\n  every field, every flag\n- [Integrations catalog](docs/reference/catalog.md), every scanner, with licenses and terms\n- [Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md)\n\n## What Draugr doesn't promise\n\nA passing verdict means the controls you configured found nothing they were looking for. It is not a\nstatement that your software is secure. It is silent about anything your descriptor does not\ndeclare, controls you did not enable, and whatever the underlying scanners miss. License findings\nare information, not legal advice. Draugr is provided under Apache-2.0 **without warranty**.\n\nThe details, including whose terms the scanners carry and your responsibility for authorization\nwhen scanning live endpoints: [scope and disclaimer](docs/trust-and-operations/disclaimer.md).\n\n## Security & supply chain\n\nA security tool should hold itself to what it checks. Draugr does:\n\n- **Standard output**. Every finding is normalized to **SARIF 2.1.0** (OASIS), so results flow\n  into GitHub / GitLab / Azure DevOps code scanning and any SARIF-aware tool.\n- **Signed releases + provenance**, release archives' `checksums.txt` is **keyless-signed with\n  cosign** (Sigstore) into a `checksums.txt.sigstore.json` bundle, and each release publishes\n  **SLSA build-provenance** attestations (`gh attestation verify …`); verify before installing\n  ([recipe](docs/trust-and-operations/verifying-releases.md)).\n- **SBOMs**. A Syft **SBOM** is published for every release archive.\n- **Verified tooling**, `draugr tools install` fetches scanners pinned by **SHA-256** and, where\n  the upstream signs them, verifies the **cosign** signature too, and cosign itself is\n  installable, so verification is self-sufficient.\n- **We scan ourselves**. Draugr runs on its own repo every PR (dogfood self-scan), and we track\n  our supply-chain posture with the **[OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/draugr-dev/draugr)**\n  (badge above).\n\n  That card reports **`SAST: 0`**, and it is worth saying why we are leaving it there. Static\n  analysis does run on this repository: Semgrep and gosec through Draugr's own `sast` control on\n  every scan, and gosec again inside `golangci-lint` on every pull request. Scorecard looks for a\n  specific set of tools it recognizes, and ours are not in it.\n\n  Adding a third static analyzer purely to move the number would be the same thing as writing\n  tests that touch code without asserting anything, a metric improved without the property\n  behind it improving. We would rather the score be wrong and the analysis be real. If you want\n  to check the analysis rather than the score, the findings are in the repository's Security tab,\n  uploaded by the scan itself.\n- **Report a vulnerability**. See [SECURITY.md](SECURITY.md).\n\n## Development\n\nRequires Go 1.26+. `make build` builds `./bin/draugr`; `make gate` runs the full local gate, fmt,\nvet, lint, race tests with coverage, and govulncheck. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## License\n\nDraugr is licensed under the [Apache License 2.0](LICENSE).\n",
  "bytes": 12366,
  "sha": "585272bab500ecfd2571db634152014bf62349d23aa0a8928efdfb69bc559e90",
  "repo_slug": "draugr-dev/draugr",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_dev_draugr_draugr_b2e99213/readme"
}