{
  "markdown": "# AI AppSec\n\nEvidence-backed AppSec for AI applications and agents.\n\nPowered by HAIEC.\n\nAudit AI code for security risks before you commit, push, merge, or deploy.\n\n## What AI AppSec Does\n\nAI AppSec produces deterministic, reproducible static security evidence for\nAI-agent and AI-application source code. It uses Semgrep 1.173.0 as its\nexecution engine with a bundled Public Core rulepack (122 detectors, 79\nsecurity checks).\n\nKey properties:\n\n- **Static analysis only** — does not execute target code\n- **No network required for normal scans** (Semgrep setup may require network)\n- **No HAIEC account or API key required**\n- **Deterministic evidence** — Scan Receipts with SHA-256 digests\n- **Fail-closed digests** — rulepack/manifest verified at runtime\n- **Proof-of-fix** — rescan comparison with check-evaluation safety\n\n## Quick Start\n\n```bash\n# Install\nnpm install -g ai-appsec\n\n# Check Semgrep status\nai-appsec doctor\n\n# Install Semgrep engine (requires network)\nai-appsec setup\n\n# Start MCP server (stdio transport)\nai-appsec\n```\n\nOr use via npx without global install:\n\n```bash\nnpx ai-appsec doctor\nnpx ai-appsec setup\n```\n\n> **Prerelease channel:** `@next` tracks upcoming prereleases (e.g. `ai-appsec@next`).\n\n## When to Use It\n\nUse `scan_ai_security` when a developer asks to:\n\n- \"check this for security issues\"\n- \"audit this task before I push\"\n- \"review this change for security problems\"\n- \"scan this AI agent\" or \"scan this AI app\"\n- \"check my LLM application\"\n- \"security review this PR\"\n- \"is this safe to merge\"\n- \"check this before deployment\"\n- \"audit this code for vulnerabilities\"\n- \"run a security scan\"\n- \"check for security risks before commit\"\n\n## scan_ai_security\n\nThe MCP tool `scan_ai_security` is the only tool implemented in v0.1.\n\nIt scans AI/LLM/agent application source code for security risks including:\n\n- Unsafe AI-output execution\n- Secrets exposure\n- RAG/model integration risks\n- Insecure AI API usage\n- Control gaps\n- Prompt/input-related risk signals\n\n### What scan_ai_security Does NOT Do\n\n- Does not provide complete AI system assurance\n- Does not provide runtime behavioral assurance\n- Does not provide compliance certification\n- Does not guarantee zero false positives\n- Does not prove root causes for concern families\n- Does not execute target code, install dependencies, or run package managers\n- Does not perform compliance assessment (compliance requires additional HAIEC evidence)\n\n## Findings\n\nFindings are classified by:\n\n- **Finding kind**: PRESENCE, RISK_SIGNAL, CONTROL_GAP, VULNERABILITY\n- **Severity**: CRITICAL, HIGH, MEDIUM, LOW, INFO\n- **Disposition**: INFORMATIONAL, REVIEW, BLOCK\n\n## Security Concern Families\n\nSecurity Concern Families summarize semantically compatible finding instances\nfor decision-quality presentation. A concern family is a deterministic grouping\nview — it is NOT necessarily one vulnerability, one material issue, or one root\ncause. Underlying finding instances remain auditable.\n\nConcern family count is not a vulnerability count. Top 20 / Top 50 are\npresentation limits, not evidence limits.\n\n## COMPLETE / PARTIAL / ERROR\n\n- **COMPLETE**: All supported files in scope were successfully analyzed.\n- **PARTIAL**: Some supported files could not be analyzed (e.g., parser failures).\n  PARTIAL scans cannot prove absence of findings. Missing evidence is never\n  interpreted as PASS.\n- **ERROR**: The scan could not complete due to an engine error.\n\n## Coverage\n\nAI AppSec provides explicit coverage accounting:\n\n- **DISCOVERED**: all files found beneath the target\n- **INTENTIONALLY_EXCLUDED**: files excluded by scope policy\n- **UNSUPPORTED**: files outside supported extensions (.py, .js, .jsx, .ts, .tsx)\n- **TARGETED**: supported files intended for analysis\n- **ENGINE_REPORTED_SCANNED**: files Semgrep reports as scanned\n- **PARSE_FAILED**: files with parse errors\n- **SUCCESSFULLY_ANALYZED**: scanned minus parse failures\n\n## Scan Receipt\n\nEvery scan produces a tamper-evident Scan Receipt with SHA-256 digests for:\n\n- Finding set\n- Concern family set\n- Coverage file sets\n- Evaluated security checks and detectors\n- Semantic receipt identity\n\nCOMPLETE scans produce reproducible receipts across processes and operating\nsystems. PARTIAL scans preserve run-specific coverage differences.\n\n## Evidence Envelope\n\nEach scan produces an Evidence Envelope that binds the receipt to the scan\nexecution context, including:\n\n- Producer identity\n- Target identity (scan input digest, git commit, dirty state)\n- Execution status and completeness\n- Semantic receipt digest\n- Envelope digest\n\n## Proof-of-fix\n\nRescan a target after a fix to compare receipts. The proof-of-fix comparison\nis safe: it verifies that a specific security check's findings were resolved\nwithout requiring the entire scan to be identical.\n\n## Offline / Local Operation\n\nNormal scanning operates fully offline after prerequisites are installed:\n\n- No HAIEC cloud access required\n- No account or API key required\n- No rule download during scanning\n- No telemetry emitted (Semgrep invoked with `--metrics off`)\n\nSemgrep setup (`ai-appsec setup`) may require network access to install the\nengine. Once installed, all scanning is local.\n\n## Semgrep Prerequisite\n\n`scan_ai_security` requires Semgrep 1.173.0 (exact version match).\n\n```bash\n# Check Semgrep status\nai-appsec doctor\n\n# Install managed Semgrep (requires network)\nai-appsec setup\n```\n\nSemgrep is NOT bundled with this package. It is an external engine installed\nseparately. See THIRD_PARTY_NOTICES.md for details.\n\n## Limitations\n\n- Only `scan_ai_security` is implemented in v0.1\n- Static analysis only — no runtime behavioral evidence\n- No compliance certification or assessment\n- No tenant isolation checking (roadmap)\n- No LLM content verification (roadmap)\n- No deploy security gating (roadmap)\n\n## License\n\nMIT License\n\nCopyright (c) 2026 HAIEC\n\nSee [LICENSE](LICENSE) for the full license text.\n\n## Security Reporting\n\nIf you believe you have found a security vulnerability:\n\n1. **Do not disclose it publicly** before review.\n2. Report via [GitHub private vulnerability reporting](https://github.com/subodhkc/ai-appsec/security/advisories/new).\n3. For non-sensitive bugs, use [GitHub Issues](https://github.com/subodhkc/ai-appsec/issues).\n\nNo bug bounty program exists at this time. This project is maintained by a\nsmall team. We appreciate responsible disclosure and patience.\n\n## Roadmap\n\nFuture HAIEC capabilities (not yet implemented in this package):\n\n- Tenant isolation checking (`scan_tenant_isolation`)\n- LLM/runtime content verification (`verify_llm_content`)\n- Deploy security gating (`check_deploy_security`)\n- Native deterministic dataflow analysis\n- Runtime evidence\n- Inventory evidence\n- Regulatory evidence\n- Compliance/assurance integration\n- Compliance Twin\n\nThese will remain independent products/engines. See the HAIEC architecture\nprinciple: one workflow, four independent checks.\n\n## HAIEC\n\nAI AppSec is powered by HAIEC. HAIEC is the broader assurance platform that\nmay combine ai-appsec evidence with runtime, inventory, regulatory, and\nexternal evidence for broader compliance and assurance in the future.\n\nFounder-led development with HAIEC acting as the release gatekeeper for\nprovenance, licensing, and publication.\n\n## Related Projects\n\n- [LLMVerify](https://github.com/subodhkc/llmverify-npm) — LLM content\n  verification (independent product, separate repository)\n- [Tenant Isolation](https://github.com/subodhkc/mcp-tenant-isolation) —\n  Cross-tenant boundary checks (independent product, separate repository)\n",
  "bytes": 7560,
  "sha": "bbc77ecf20ddb3e9b1ed18267e67f576a87e42cfe6a2e5d6bf2122999f8ef5a9",
  "repo_slug": "subodhkc/ai-appsec",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_subodhkc_ai_appsec_e25743c1/readme"
}