{
  "markdown": "# CodeInspectus, by Synvoya\n\n[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-green.svg)](LICENSE)\n[![Node.js](https://img.shields.io/badge/node-%3E%3D22-brightgreen.svg)](package.json)\n[![npm downloads](https://img.shields.io/npm/dm/codeinspectus)](https://www.npmjs.com/package/codeinspectus)\n![MCP-ready](https://img.shields.io/badge/MCP-ready-blue.svg)\n![Local-first](https://img.shields.io/badge/local--first-yes-brightgreen.svg)\n![No telemetry](https://img.shields.io/badge/telemetry-none-brightgreen.svg)\n[![Official MCP Registry](https://img.shields.io/badge/Official_MCP_Registry-listed-blue.svg)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.Synvoya%2Fcodeinspectus)\n[![codeinspectus MCP server](https://glama.ai/mcp/servers/Synvoya/codeinspectus/badges/score.svg)](https://glama.ai/mcp/servers/Synvoya/codeinspectus)\n[![GitHub stars](https://img.shields.io/github/stars/Synvoya/codeinspectus?style=social)](https://github.com/Synvoya/codeinspectus)\n\n**A local-first, privacy-preserving security MCP server and CLI.** Any AI coding agent\n(Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to\nscan AI-generated / \"vibe-coded\" code for real vulnerabilities, map findings to\ncompliance frameworks as honest code-level coverage, and drive a **scan → fix →\nrescan** loop — fully on your machine, with **no account** and **zero network\negress at scan time**.\n\n![CodeInspectus demo](assets/codeinspectus-demo.gif)\n\n**Reproduce the V2.1 proof:** the `codeinspectus@2.1.0` package scans an immutable public Rich\ncommit, finds one high-confidence GitHub Actions expression-injection pattern, applies GitHub's\ndocumented intermediate-`env` remediation in a temporary clone, confirms it as **1 resolved,\n0 remaining, 0 introduced, 0 not rechecked**, then creates and verifies sealed evidence for both\nstates. Run the [reproduction script](scripts/reproduce-v2.1-case-study.mjs) or read the\n[scanner-derived case study](examples/reports/rich-v2.1.0-sealed-workflow.md). The recorded\npre-publication run used the exact V2.1 tarball; the script defaults to npm after publication.\nThe case uses the `ai` scanner class to isolate stable native behavior; use a normal full scan for\nbroad repository coverage.\n\nIf CodeInspectus is useful, [star the repository](https://github.com/Synvoya/codeinspectus)\nso other AI-app builders can find it.\n\nCodeInspectus orchestrates three best-in-class OSS engines behind one normalized,\nCWE-keyed schema, and adds its own **AI-code-specific checks** that generic\nscanners miss:\n\n- **Opengrep** — SAST / OWASP Top 10 (SARIF)\n- **Gitleaks** — secrets\n- **Trivy** — dependency CVEs (SCA), IaC misconfig, secrets, license, SBOM\n- **CodeInspectus Pub** — first-party, exact-version Dart/Flutter dependency matching and\n  CycloneDX/SPDX inventory from `pubspec.lock`, backed by a bundled offline OSV Pub snapshot\n- **CodeInspectus native checks** — client-side secret/bundle exposure, Supabase\n  RLS / inverted-auth (the CVE-2025-48757 class), prompt-injection sinks,\n  model-produced tool arguments reaching Node, Python, or narrowly supported Go, Java, C#, PHP, Rust, and Ruby shell sinks without a visible guard,\n  general model output reaching JavaScript `eval`/`Function` or import-proven shell-string APIs,\n  conventional Next.js and import-proven Express admin API handlers missing visible authentication\n  or server-side authorization, Supabase Edge Functions with explicit anonymous deployment but no\n  request authentication or privileged-operation authorization,\n  client-writable `user_metadata` authorization, and unsanitized model/user output\n  rendered via `dangerouslySetInnerHTML` (XSS / LLM05), plus explicit API-boundary\n  leaks, raw request-to-database writes, sensitive logging, and evidence-gated\n  security-header/CSP/Referrer-Policy/Permissions-Policy/session-cookie/Supabase-CAPTCHA\n  configuration checks. Separate\n  first-party packs cover six narrow Flutter/Dart source failure modes and eight bounded\n  Android/iOS repository-configuration failures, plus four React Native and two Expo\n  framework-specific mobile failures. A bounded Python AI/API pack covers ten narrow\n  Django, Flask, FastAPI, Starlette, Jinja, OpenAI, Anthropic, LangChain, and OS-command source failures.\n  Separate Go, Java, and C# AI packs each contribute one exact official OpenAI SDK\n  tool-argument-to-shell rule; the PHP pack contributes one equivalent rule for the\n  community-maintained `openai-php/client` ecosystem, and the Rust pack contributes one\n  bounded rule for the community-maintained `async-openai` ecosystem. A Ruby pack contributes one\n  equivalent rule for the exact official `openai` gem. A Firebase configuration pack contributes\n  three literal public-write rules for Firestore, Cloud Storage, and Realtime Database. A GitHub\n  Actions pack contributes two workflow rules for direct untrusted-context shell interpolation and\n  exact `pull_request_target` checkout-and-execute chains.\n\nThe shipped manifest contains **94 curated detections**: **72 first-party native rule\nIDs** (29 JavaScript/TypeScript, 6 Flutter/Dart, 4 Android, 4 iOS, 4 React Native, and\n2 Expo, plus 10 Python AI/API, 1 Go AI, 1 Java AI, 1 C# AI, 1 PHP AI, 1 Rust AI, 1 Ruby AI,\n3 Firebase configuration, 2 GitHub Actions workflow, and 2 JavaScript baseline SAST rules), 18 Opengrep-owned\nSAST rules, and 4 custom Gitleaks rules. All 20 Opengrep YAML rules remain physically active:\nthe two native-owned rules reconcile exact results and fall back to Opengrep on mismatch or\nnative unavailability. Opengrep, Gitleaks, and Trivy are optional, managed, additive engines.\n\n> CodeInspectus explains each engine's coverage, license, platform-specific size, and required\n> action before asking permission. After approval it downloads the official, **SHA-pinned**\n> engine binaries, stores them outside the npm package, and calls\n> them as local subprocesses. It does **not** fork them.\n\n## Why CodeInspectus?\n\nAI-generated apps often ship with security mistakes that generic scanners miss: exposed\nclient-side secrets, weak Supabase auth patterns, unsafe HTML rendering, prompt-injection\nsinks, and risky AI/vector-store integrations.\n\nCodeInspectus combines proven local scanners with AI-app-specific rules, then exposes the\nworkflow through an MCP server so coding agents can scan, explain, and help fix issues\nbefore shipping.\n\n## Install\n\n**Prerequisite:** **Node.js ≥22**. Node 24 LTS is recommended. No separate engine or Cosign\ninstallation is required. CodeInspectus can bootstrap a SHA-pinned Cosign verifier inside\n`~/.codeinspectus/` after approval; signature verification remains **fail-closed**.\nOn Linux, the current upstream Opengrep assets require glibc. Alpine/musl remains supported for\nnative CodeInspectus rules, Gitleaks, and Trivy, but setup marks Opengrep unavailable before any\ndownload and reports aggregate scan coverage as partial when it is selected.\n\nThe official `@contentauth/c2pa-node` validator is an optional peer because its upstream package\ndownloads a platform-native binding during its own lifecycle script. Normal CodeInspectus installs\ndo not install that peer. Install it explicitly alongside CodeInspectus when local C2PA validation\nis required; otherwise candidate assets report partial `content_provenance` coverage.\n\n```bash\n# Interactive: inspect coverage, licenses, and sizes; then approve all or choose components.\nnpx codeinspectus setup\n\n# Automation after an operator has reviewed the plan:\nnpx codeinspectus setup --status\nnpx codeinspectus setup --all\nnpx codeinspectus setup --select opengrep,gitleaks\n```\n\nOn a terminal, a first bare `npx codeinspectus` run opens this guided setup. MCP clients continue\nto start over piped stdio and expose `codeinspectus_setup`: agents must request a plan, show it,\nask permission, then call install with `confirm_downloads=true`. Declined choices are saved so\nusers are not repeatedly prompted; `setup --reset` clears them.\n\nSetup first checks local state without network access. It downloads only missing,\nmismatched, or newly pinned binaries, verifies them against the immutable lockfile shipped in the\nnpm package, and atomically installs them under `~/.codeinspectus/`. It refreshes the offline\nTrivy vulnerability DB only when it is missing, lacks rescan provenance, or is more than seven\ndays old. Rule-only CodeInspectus upgrades therefore download nothing. After setup, **scans\nperform zero network I/O.**\n\nEvery scan and `codeinspectus_list_rules` response includes structured `engine_setup` state:\n`ready`, `repair_required`, `db_refresh_recommended`, or `unsupported_platform`. MCP agents are\ninstructed to explain non-ready state and obtain approval through `codeinspectus_setup`. There is\nno silent npm `postinstall` download. `repair-engines` remains available for advanced/manual use;\nthe older `install-engines` command remains a compatibility alias.\n\nIf a Trivy DB was installed before 0.3.2, scan output tells your agent that CVE rescan\ntracking is not yet enabled. The agent should run `npx codeinspectus repair-engines`\nonce; this re-fetches the DB through the verified install path and records its provenance.\nUntil then, vanished CVEs conservatively report `not_rechecked`; current scan findings\nremain complete and unaffected.\n\nRe-verify your pinned binaries any time:\n\n```bash\nnpx codeinspectus verify-engines\n```\n\n## CLI, CI, and local evidence workflows\n\n```bash\ncodeinspectus scan . --format sarif --output results.sarif\ncodeinspectus scan . --format csv --output findings.csv\ncodeinspectus scan . --format sarif --output results.sarif --fail-on-severity high\ncodeinspectus scan . --baseline SCAN_ID --fail-on-new-severity high\ncodeinspectus scan . --diff origin/main --head HEAD\ncodeinspectus scan . --working-tree --base HEAD\ncodeinspectus bundle create SCAN_ID --output-dir /outside/repository/scan-results\ncodeinspectus bundle verify /outside/repository/scan-results\ncodeinspectus bulk scan /absolute/path/to/local-repositories --concurrency 2\ncodeinspectus history scan . --from BASE_SHA --to HEAD_SHA --since 2026-07-01 --until 2026-07-30 --max-commits 20\ncodeinspectus issue export SCAN_ID CI-0001 --adapter github --visibility private\n```\n\nGit-scoped scans retain full repository context, tag changed versus supporting-context\nfindings, and report exact resolved revisions and explicit completeness limits. They never\ncheckout, reset, stage, or modify the repository. See\n[`docs/GIT-SCOPED-SCANS.md`](docs/GIT-SCOPED-SCANS.md).\n\nSealed bundles retain redacted JSON, SARIF, Markdown, coverage, provenance and an additive\ncanonical scan record with content hashes for every artifact. Verification is mandatory before\nbundle export or comparison. See [`docs/SEALED-SCAN-BUNDLES.md`](docs/SEALED-SCAN-BUNDLES.md).\n\nCSV is a deterministic spreadsheet-safe projection of the canonical JSON model. It always retains\nan explicit scan/coverage row, even with zero findings, and neutralizes formula-triggering cells.\nSee [`docs/CSV-EXPORT.md`](docs/CSV-EXPORT.md) for the stable column contract.\n\nThe V2 TypeScript SDK is available from `codeinspectus/sdk`. It is a bounded,\nshell-free wrapper around the exact installed local CLI and exports versioned finding, coverage,\nhistory, baseline, triage and bundle types without duplicating scanner logic. See\n[`docs/TYPESCRIPT-SDK.md`](docs/TYPESCRIPT-SDK.md).\n\nBulk mode scans already-existing repositories under one explicit local parent with bounded\nconcurrency, per-repository isolation and an atomic resumable manifest. It never clones or requires\na GitHub account. See [`docs/BULK-SCANNING.md`](docs/BULK-SCANNING.md).\n\nRepository-history mode is separately opt-in and requires exact revision, UTC date and commit-count\nbounds. It scans isolated immutable snapshots, marks shallow or truncated history partial, and never\ndescribes an old finding as current or a historical secret as active. See\n[`docs/REPOSITORY-HISTORY.md`](docs/REPOSITORY-HISTORY.md).\n\nIssue adapters generate one redacted, review-required GitHub, Jira or Linear JSON payload without\nauthentication or submission. Destination visibility is mandatory and public/private disclosure\nwarnings remain in the artifact. See [`docs/ISSUE-PAYLOADS.md`](docs/ISSUE-PAYLOADS.md).\n\nThe first command is report-only: findings are retained but do not fail complete scans. The second\nenforces a severity threshold. Both fail closed with exit 2 when aggregate coverage is partial or\nunknown; coverage takes precedence over finding severity. Exit 1 is reserved for threshold findings\nafter complete coverage. See the [CLI command reference](docs/CLI-REFERENCE.md) and\n[CI policy and SHA-pinned GitHub Actions workflow](docs/CI-POLICY.md)\nfor the full exit contract, SARIF upload, artifact privacy, and fork/Dependabot behavior.\n\nBaseline enforcement fails only on findings proven new against a compatible explicit stored scan.\nIncompatible, partial, or unknown comparison evidence fails closed with exit 2. Local triage adds\nappend-only review context without hiding or changing findings. See\n[baselines and local triage](docs/BASELINES-AND-TRIAGE.md) for commands, exact matching, bounds,\nstorage, redaction, schemas, and audit behavior.\n\nLocal scan history can be listed, inspected, rerun, and compared without network access:\n\n```bash\ncodeinspectus scans list --repository \"$PWD\"\ncodeinspectus scans show SCAN_ID\ncodeinspectus scans rerun SCAN_ID\ncodeinspectus scans compare OLD_SCAN_ID NEW_SCAN_ID --format json\n```\n\nComparison is evidence-gated: absence is `Resolved` only after compatible producer components and\ncomplete like-for-like coverage; otherwise it is `Not rechecked / unknown`. See the\n[scan history and comparison contract](docs/SCAN-HISTORY.md) for filters, bounds, V1.x compatibility,\ncorruption handling, and `Reopened` provenance.\n\nThe shipped agent rules also define an approval-gated\n[one-finding remediation workflow](docs/ONE-FINDING-REMEDIATION.md): investigate one exact finding,\npropose the regression and smallest patch, edit only after separate approval, test, then rescan\nagainst the exact prior scan. Only a CodeInspectus `resolved` result supports a scanner-resolution\nclaim; `not_rechecked` remains an explicit proof gap.\n\nTwo explicit, optional workflows extend investigation without changing scanner truth:\n\n- [Threat-model and knowledge-base review](docs/THREAT-MODEL-WORKFLOW.md) treats every\n  repository-controlled document as untrusted context. Documents can explain or prioritize raw\n  findings, but never suppress, downgrade, override, or mark them resolved.\n- [Bounded multi-agent review](docs/MULTI-AGENT-REVIEW.md) keeps deterministic findings and agent\n  interpretations in separate evidence lanes, applies explicit agent/time/scope/cost limits, and\n  requires an exact-prior deterministic rescan before any scanner-resolution claim.\n\nThese rules are included in the npm package under `agent-rules/`; normal CLI and MCP scans do not\nload documents, invoke models, or depend on either workflow.\n\nAn MCP server is installed **once per machine** and shared across all your\nprojects — it is **not** a per-repo `npm install` dependency.\n\n## Client registration\n\nThe server command is the same across clients, but each client uses its own\nconfiguration format. Clients with JSON MCP configuration use:\n\n```jsonc\n{\n  \"mcpServers\": {\n    \"codeinspectus\": { \"command\": \"npx\", \"args\": [\"-y\", \"codeinspectus\"] }\n  }\n}\n```\n\n| Client | How |\n|--------|-----|\n| **Claude Code** | `claude mcp add-json codeinspectus '{\"command\":\"npx\",\"args\":[\"-y\",\"codeinspectus\"]}'` |\n| **Cursor** | add to `~/.cursor/mcp.json` (or project `.cursor/mcp.json`) |\n| **VS Code** | `code --add-mcp '{\"name\":\"codeinspectus\",\"command\":\"npx\",\"args\":[\"-y\",\"codeinspectus\"]}'` |\n| **Codex** | use one of the Codex-specific options below |\n| **Windsurf / Cline / Aider** | add the JSON block above to that client's MCP configuration |\n\nFor **Codex**, choose one registration method:\n\n```bash\n# Codex CLI\ncodex mcp add codeinspectus -- npx -y codeinspectus\n```\n\n- **Codex app or IDE extension:** open **Settings → MCP servers → Add server**,\n  choose **STDIO**, set the command to `npx` and arguments to `-y`,\n  `codeinspectus`, then restart.\n- **Codex configuration file:** add this to global `~/.codex/config.toml` or a\n  trusted project's `.codex/config.toml`:\n\n```toml\n[mcp_servers.codeinspectus]\ncommand = \"npx\"\nargs = [\"-y\", \"codeinspectus\"]\ntool_timeout_sec = 600\n```\n\nCodex defaults MCP tool calls to 60 seconds. CodeInspectus runs multiple security\nengines concurrently and permits up to five minutes per engine, so 600 seconds\navoids premature client timeouts on larger repositories. This is a Codex client\ntimeout only; it does not change engine limits or other clients' configurations.\n\nOptional: drop in the ready-made [`agent-rules/`](agent-rules/) so your agent\nauto-runs the scan → fix → rescan loop.\n\nMCP clients that support server instructions, including Codex, also receive the\nsafe workflow automatically: show findings first, obtain granular approval before\nfixes, and rescan before claiming an issue is resolved. The agent-rule files remain\nuseful when you want the same policy persisted explicitly in a repository.\n\n## Tools\n\n| Tool | Purpose |\n|------|---------|\n| `codeinspectus_scan` | Full local scan of a path (engines + AI checks). Returns CWE-keyed findings, detected technologies, exact native-pack and Pub dependency coverage, remediations, framework tags, and three-state repository evidence for supported runtime controls. |\n| `codeinspectus_setup` | Offline setup plan, saved decline choices, or approval-gated verified downloads to `~/.codeinspectus`; never writes to the target repository. |\n| `codeinspectus_rescan` | Re-scan after fixes; diffs vs a prior scan → resolved / remaining / introduced, with fresh technology and pack coverage. |\n| `codeinspectus_compliance_report` | Per-framework **code-level control coverage** (not certification). |\n| `codeinspectus_explain_finding` | Deep explanation + full remediation for one finding. |\n| `codeinspectus_generate_sbom` | CycloneDX/SPDX SBOM using Trivy plus native Pub inventory/fallback (written to the managed dir by default, or a path you choose). |\n| `codeinspectus_list_rules` | Active detectors, native-pack inventory/rule ownership, engine versions, detection-DB + Trivy/Pub DB provenance and freshness, and structured machine setup/repair state. |\n\nCodeInspectus **never edits or deletes your source code or repository** — it reads and\nreports; your agent applies the fixes. It stores engine data and scan history under\n`~/.codeinspectus`; the only file it writes is an optional SBOM — to a managed directory\nby default, or a path you choose (see `codeinspectus_generate_sbom`).\n\nEach scan also reports a read-only **git-safety** state: if there's no git repo or\nuncommitted changes, it recommends creating a checkpoint before fixes — your agent\nruns git only with your approval; the tool never does.\n\n### Source Integrity — V3.1\n\nV3.1 activates the first capability in the stable, non-CWE `repository_trust` contract across scan,\nrescan, CLI JSON, MCP structured output, SARIF metadata, and the TypeScript SDK. It deterministically\ninspects supported repository text for bidirectional overrides/unbalanced controls, zero-width or\ndefault-ignorable token characters, concealed Unicode tag sequences, encoded variation-selector\nruns, and a bounded set of mixed-script identifier confusables.\n\nEvery artifact reports escaped code points, Unicode names, exact file/line/code-point column,\nUTF-8 byte offset, context classification, validator identity, confidence, limitations and an\napproval-required proposed action. Very long tag/variation runs retain the exact span and sequence\nlength while capping rendered evidence to 64 code points; dense candidates and identifiers are\nbounded before output materialization and incomplete work is reported as partial. Initial BOMs,\nlegitimate RTL text, emoji variation/ZWJ/tag\nsequences, international-language joiners and ambiguous confusables are suppressed or kept\nnon-destructive. Scans never edit files; cleanup requires explicit approval for the named file and\nmarker, a reversible edit by the user's coding agent, tests, and a rescan.\n\nThis is **source-integrity protection, not AI-authorship detection**. V3.2's explicit-attribution\nand C2PA results are separate capability records; hidden Unicode is never promoted into either.\nCodeInspectus does not claim that hidden Unicode is a Claude watermark or evidence of AI generation.\n\n### AI Provenance Audit — V3.2\n\nV3.2 activates two more read-only `repository_trust` capabilities:\n\n- `explicit_ai_attribution` deterministically inspects bounded source/config headers, local git\n  commit trailers, and supported image EXIF/XMP/IPTC/PNG metadata for explicit AI-generator or\n  AI-source declarations. These are verified observations of declarative records—not proof that\n  the statement is truthful, proof of vendor origin, or a statistical authorship judgment.\n- `content_provenance` uses the optional official Content Authenticity Initiative Node validator\n  to inspect supported local C2PA Content Credentials. Results distinguish valid, trusted, invalid,\n  present-but-inconclusive, and remote-reference evidence. Offline scans never fetch a remote\n  manifest, OCSP response, trust list, or revocation endpoint.\n\nEvery parser and traversal path is bounded, rejects symbolic links, and reports exclusions as\n`partial`. C2PA and legal/licensing attribution records are protected evidence and are never\ncleanup-eligible. V3.2 does not edit files, remove metadata, rewrite text, inspect pixels/audio/video\nframes, or claim that absence of a marker means human authorship. Statistical text-watermark\nverification remains `unavailable` until an authoritative, independently verifiable detector with\ncalibrated operating thresholds is available.\n\nSee the [V3 migration guide](docs/V3-REPOSITORY-TRUST-MIGRATION.md) for schema and SDK changes.\n\n`detected_technologies` explains the bounded repository signals CodeInspectus saw.\n`pack_coverage` separately reports how many registered native analyzers and rules actually ran.\nA pack state of `ran` means those listed rules executed; it is not a claim of complete security\ncoverage for the named language or framework. `not_applicable` means the installed pack did not\nmatch detected project technology; `not_run`, `partial`, and `unavailable` distinguish scanner\nfiltering from incomplete or failed execution. The Flutter pack runs only when bounded repository\nsignals identify Flutter; an ordinary Dart package does not activate it. Android and iOS packs\nlikewise require bounded platform-project evidence and report their own platform metadata.\nReact Native and Expo are separate technology-gated packs: an Expo project can run both, while a\nbare React Native project never implies that Expo configuration rules ran.\nThe Python AI/API pack requires bounded Python/package/framework evidence. It reports unsupported\nsyntax, source bounds, and deliberately excluded corpora as explicit coverage notes instead of\ninferring that omitted source is safe.\nThe Go, Java, and C# AI packs require their language plus the exact official OpenAI SDK dependency.\nThe PHP pack requires PHP plus exact `openai-php/client` or `openai-php/laravel` Composer evidence;\nthose packages are community-maintained, not official OpenAI SDKs. A generic `openai` framework tag\nalone cannot activate it.\nThe Rust pack requires Rust plus exact `async-openai` Cargo dependency evidence; that crate is\ncommunity-maintained, not an official OpenAI SDK. The Ruby pack requires Ruby plus exact official\n`openai` production Gemfile or runtime gemspec evidence; lockfiles remain Ruby-language evidence\nbecause they do not preserve dependency groups. A generic `openai` framework tag alone\ncannot activate Go, Java, C#, PHP, Rust, Ruby, or Python analyzers.\n`dependency_coverage` separately reports whether the native Pub matcher ran, which lockfiles and\neligible packages it analyzed, what it deliberately skipped, and the bundled snapshot version.\n\n## Honest claims (please read)\n\n- **\"No egress\" is precise: zero egress _at scan time_.** Engine binaries and the\n  Trivy DB are fetched only by explicit setup/repair commands from verified sources, with\n  SHA256 verification. Normal CodeInspectus installation does not install the optional C2PA peer;\n  users who explicitly install that upstream package allow its lifecycle download. Nothing is\n  downloaded during a scan. The scanner functions with the network unplugged. There is **no\n  telemetry, ever.**\n- **Supply-chain pinning is mandatory.** Trivy was supply-chain-compromised twice\n  in early 2026; every engine binary is SHA-pinned in `engines.lock.json` and its\n  hash is verified before execution. CodeInspectus refuses to run an unpinned or\n  mismatched binary.\n- **Secret values are redacted** in all output — type + location + a redacted\n  preview only.\n- **Compliance = code-level control coverage, never certification.** CodeInspectus\n  reports \"X of N **code-visible** controls have findings\", with the code-visible\n  subset as the explicit denominator, plus a standing disclaimer. It never emits\n  \"you are X% compliant\" or \"you pass [framework]\". The severity-weighted posture\n  score is a separate view and is not a percent-compliant figure. **Essential\n  Eight** especially: only ~1 of 8 mitigations (Patch Applications) is\n  code-evidenced — this is **not** an Essential Eight assessment.\n- **Prompt-injection detection is heuristic and immature** — those findings are\n  worded \"potential …\" and marked medium confidence.\n- **Flutter/Dart native coverage is six narrow, first-party structural checks:**\n  `ci-flutter-tls-verification-disabled`, `ci-flutter-sensitive-shared-preferences`,\n  `ci-flutter-webview-untrusted-content`, `ci-flutter-sensitive-log`,\n  `ci-flutter-supabase-privileged-key-client`, and `ci-flutter-cleartext-network`.\n  They inspect Dart tokens and local source structure without type resolution or whole-program\n  dataflow. Project-root scans exclude generated files and test/example corpora unless those paths\n  are scanned directly. Unreadable Dart files, files over 2 MiB, and source beyond the\n  10,000-file/64 MiB project bounds are skipped and named in `pack_coverage`. This is repository\n  evidence, not runtime mobile testing or complete Flutter coverage. Native Pub vulnerability/SBOM\n  analysis is a separate `vuln`-class engine, so it can run for Flutter and plain Dart projects\n  without implying that the Flutter source pack applied. Android/iOS configuration is handled by\n  separate native platform packs; existing Trivy behavior is unchanged.\n  The shipped [Flutter TP/FP/fixed corpus](fixtures/README.md) locks exactly one\n  expected finding per rule in the vulnerable project and zero findings in both the near-miss and\n  remediated projects. E23/E24 exercise that corpus through the built MCP stdio server, including\n  pack execution accounting and redaction of the planted synthetic sentinel.\n- **Android/iOS native coverage is eight narrow, first-party repository-configuration checks.**\n  Android flags an explicitly debuggable release, effective production cleartext opt-in,\n  production trust of user-added CAs, and an exported AndroidX FileProvider. iOS flags global ATS\n  arbitrary loads, insecure production-domain exceptions, weak production-domain TLS policy, and\n  disabled default data protection. The packs parse bounded, literal XML/Xcode repository evidence;\n  they never run Gradle, Xcode, or target code, and parsed configuration is never executed. Dynamic\n  build settings,\n  arbitrary Android product flavors, full manifest merging, provisioning profiles, runtime behavior,\n  and complete mobile-platform security remain out of scope. Skipped or unsupported configuration is\n  named in `pack_coverage`, not inferred as secure or vulnerable. The shipped\n  [Android/iOS TP/FP/fixed corpus](fixtures/README.md)\n  and E25/E26 lock exact findings, zero-finding near-miss/remediated states, provenance, redaction,\n  execution accounting, and bidirectional same-path rescan behavior.\n- **React Native/Expo native coverage is six narrow, first-party structural checks.** The React\n  Native pack flags sensitive credential writes to proven AsyncStorage receivers, untrusted route/\n  deep-link content entering an imported JavaScript-enabled WebView, explicit mixed-content opt-in,\n  and universal-origin access from a file-backed WebView. The separate Expo pack flags sensitive\n  server environment values placed in public app config and unsigned updates fetched over cleartext\n  production URLs. Both use bounded read-only parsing and never import, execute, or evaluate target\n  code/configuration. Dynamic values, spreads, unresolved guards, unreadable/oversized input, and\n  bounded-out source become named coverage limitations rather than inferred findings. Framework\n  evidence is required; ordinary JavaScript/TypeScript or native Android/iOS skeletons do not\n  activate these packs. This is intrafile/static repository evidence, not complete dataflow,\n  deployment proof, or runtime mobile testing. The shipped\n  [React Native/Expo TP/FP/fixed corpus](fixtures/README.md) and E30/E31 lock exact findings,\n  precision, redaction, provenance, execution accounting, and same-path resolution/reintroduction.\n- **Python AI/API native coverage is ten narrow first-party structural checks.** The pack flags\n  hardcoded framework signing secrets, credentialed all-origin CORS, request-controlled file\n  responses and redirects, request-controlled template source, and unsanitized OpenAI/Anthropic\n  output returned as HTML, explicit LangChain FAISS pickle-deserialization opt-in, and request-controlled\n  complete URLs fetched by a proven LangChain WebBaseLoader, plus medium-confidence potential\n  prompt-injection sinks where request input reaches proven OpenAI/Anthropic privileged instructions\n  or shares the LLM call with configured tool access, and model tool arguments reaching proven\n  Python shell-execution APIs without a visible checked guard. It uses a bounded Lezer syntax gate plus source-ordered intrafile\n  analysis; it never imports or executes target Python. There is no type checker, module graph,\n  interprocedural flow, or path-sensitive branch merge. Lezer-validated format strings are retained\n  as opaque dynamic values, so their replacement expressions are not inspected; leading-tab indentation\n  still fails closed with a named coverage note. Generated, migration, dependency, build, test,\n  fixture, demo, sample, and example trees are excluded from project-root scans. Unsupported,\n  malformed, symlinked, unreadable, oversized, or bounded-out source is reported, not inferred as\n  secure. The shipped [Python AI/API TP/FP/fixed corpus](fixtures/README.md) and E32/E33 lock exact\n  findings, precision, redaction, provenance, execution accounting, and same-path\n  resolution/reintroduction.\n- **Go AI native coverage is one narrow, medium-confidence structural check.**\n  `ci-go-llm-tool-argument-command-execution` requires the exact official OpenAI Go SDK Chat\n  Completions tool-call argument shape and import-proven `os/exec` invocation of a recognized shell\n  with its command flag. It supports direct aliases, `encoding/json.Unmarshal`, one local JSON\n  parser, and one local command wrapper. Checked rejection/approval or allowlist guards and\n  validated replacement values suppress findings. It does not cover general Go SAST, other model\n  SDKs, cross-module dispatch, runtime sandboxing, or complete agent safety. The shipped\n  [Go TP/FP/fixed corpus](fixtures/README.md) and E37/E38 lock exact findings, zero-finding safe and\n  fixed states, provenance, pack dispatch, and same-path resolution/reintroduction.\n- **Java and C# AI native coverage is one narrow, medium-confidence structural check per ecosystem.**\n  Each requires the exact official OpenAI SDK dependency and tool-call argument shape before model\n  data can reach a recognized, actually-started shell process. Direct aliases, one local parser,\n  and one local command wrapper are supported; checked rejection/approval or allowlist guards and\n  validated replacement values suppress findings. These packs do not provide general Java or C#\n  SAST, cross-module dispatch, runtime sandbox proof, or complete agent review. The shipped\n  [Java and C# TP/FP/fixed corpora](fixtures/README.md) and E39-E42 lock exact findings, safe/fixed\n  silence, provenance, language-gated dispatch, and same-path resolution/reintroduction.\n- **PHP AI native coverage is one narrow, medium-confidence structural check.**\n  `ci-php-llm-tool-argument-command-execution` requires exact community-maintained\n  `openai-php/client` or `openai-php/laravel` Composer evidence and model tool-call\n  `function->arguments` reaching `exec`, `system`, `shell_exec`, or `passthru`. It supports direct\n  aliases, associative `json_decode`, one local parser, one local command wrapper, and one exact\n  mapped variadic method dispatch. Checked approval/full-command allowlists and validated\n  replacement values suppress findings; first-token executable checks do not neutralize shell\n  metacharacters and do not suppress them. It does not provide general PHP SAST, cross-file flow,\n  runtime sandbox proof, or complete agent review. The shipped [PHP TP/FP/fixed corpus](fixtures/README.md)\n  and E43/E44 lock exact findings, safe/fixed silence, provenance, language-gated dispatch, and\n  same-path resolution/reintroduction.\n- **Rust AI native coverage is one narrow, medium-confidence structural check.**\n  `ci-rust-llm-tool-argument-command-execution` requires exact community-maintained\n  `async-openai` Cargo evidence and recognized model tool arguments reaching an import-proven\n  standard/Tokio process shell or literal Bollard Docker exec shell vector. It supports direct\n  aliases, `serde_json` extraction, one recognized `generate_function_call` result, and one local\n  command wrapper. Checked approval/allowlist rejection and validated replacement values suppress\n  findings. It does not provide general Rust SAST, rustc/type/Cargo-graph resolution, cross-crate\n  flow, runtime container/sandbox proof, or complete agent review. The shipped\n  [Rust TP/FP/fixed corpus](fixtures/README.md) and E45/E46 lock exact findings, safe/fixed silence,\n  provenance, language-gated dispatch, and same-path resolution/reintroduction. `async-openai` is\n  community maintained and is not represented as an official OpenAI SDK.\n- **Ruby AI native coverage is one narrow, medium-confidence structural check.**\n  `ci-ruby-llm-tool-argument-command-execution` requires exact official production `openai` Gemfile\n  or runtime gemspec evidence and\n  recognizes Chat tool-call `function.arguments` or explicitly typed Responses function-tool\n  arguments reaching `system`, `exec`, `IO.popen`, or import-proven Open3 shell execution. It\n  supports direct aliases, `JSON.parse` command extraction, one local parser, and one local command\n  wrapper. Checked approval/full-command allowlists and validated replacements stay silent. It\n  does not provide general Ruby SAST, Bundler/type resolution, cross-file flow, backtick/percent-x/\n  spawn coverage, runtime sandbox proof, or complete agent review. The shipped\n  [Ruby TP/FP/fixed corpus](fixtures/README.md) and E47/E48 lock exact findings, safe/fixed silence,\n  provenance, language-gated dispatch, and same-path resolution/reintroduction.\n- **Firebase native coverage is three narrow, high-confidence configuration checks.**\n  `ci-firebase-firestore-public-write`, `ci-firebase-storage-public-write`, and\n  `ci-firebase-realtime-database-public-write` flag only checked-in literal write grants with no\n  condition or a condition exactly equal to `true` (Realtime Database boolean/string `true`).\n  Public reads stay silent because they are often intentional. The bounded parser masks Rules\n  comments/strings, requires exact Firestore/Storage service declarations, requires strict JSON\n  for Realtime Database, excludes non-production/dependency/generated trees, and never runs\n  Firebase tooling or target code. It does not evaluate helper functions, deployed policy, IAM,\n  App Check, or runtime access. The shipped [Firebase TP/FP/fixed corpus](fixtures/README.md) and\n  E49/E50 lock exact findings, safe/fixed silence, provenance, pack dispatch, and same-path\n  resolution/reintroduction.\n- **GitHub Actions native coverage is two narrow workflow checks.**\n  `ci-github-actions-untrusted-expression-command` flags direct documented attacker-controlled\n  `github` expressions embedded in `run`; using an intermediate `env` value or action `with` input\n  stays silent. `ci-github-actions-pwn-request` requires the complete high-risk chain: exact\n  `pull_request_target`, checkout of the pull request's untrusted ref into the default workspace,\n  and subsequent execution of checked-out code or a local action. Checkout v7 is treated as\n  protected unless `allow-unsafe-pr-checkout` is explicitly enabled. The bounded YAML 1.2 parser\n  reads only direct `.github/workflows/*.yml`/`.yaml` files and never executes workflows or target\n  code. It does not provide general workflow taint analysis, custom-action analysis, artifact-flow\n  analysis, permission-policy proof, or runner/runtime verification. The shipped\n  [GitHub Actions TP/FP/fixed corpus](fixtures/README.md) and E51/E52 lock exact findings,\n  safe/fixed silence, provenance, dispatch, and same-path resolution/reintroduction.\n- **Client-side authorization that trusts `user_metadata` is flagged** (`ci-ai-client-metadata-authz`).\n  CodeInspectus detects an authorization decision that reads client-writable Supabase\n  `user_metadata` — e.g. `if (user.user_metadata.role === 'admin')` — at **high** severity,\n  **medium** confidence (CWE-639). `user_metadata` is editable by the signed-in user themselves\n  (Supabase's `/auth/v1/user` endpoint), so anyone can self-assign `role: 'admin'`; **gate\n  privileged logic on the server-controlled `app_metadata.role` instead.** Detection is intrafile\n  (inline + split-variable/destructured); it does **not** yet trace cross-file or whole-object-alias\n  flows (planned) — see the [good-first-issue](docs/good-first-issues/user-metadata-authz-rule.md).\n  It also catches the related footgun: a Supabase **`service_role` JWT or modern `sb_secret_`\n  key value** in client-reachable code (**critical**), and a privileged key behind a\n  **client-exposed env prefix** such as `NEXT_PUBLIC_…` (**high**). Exact-format\n  `sb_publishable_` keys remain silent because they are public by design. Each secret class is\n  bounded to 1,024 remediation locations per file; repeated values on one minified line collapse,\n  separate source lines remain visible, and reaching the bound emits an explicit coverage note.\n- **Unsanitized model or user output rendered as raw HTML is flagged** (`ci-ai-llm-output-dangerous-html`).\n  CodeInspectus detects untrusted **request input** or **LLM/model output** flowing into\n  `dangerouslySetInnerHTML` without sanitization — a direct XSS sink (CWE-79/116; OWASP **LLM05** on\n  the model-output path), **high** severity, **medium** confidence; wrapping the value in\n  `DOMPurify.sanitize(...)` silences it. It follows one local function-component hop when a\n  destructured prop is passed directly to `__html`; sanitizing at the JSX call site stays silent.\n  It does **not** trace cross-file or arrow-component props, database rows, template data,\n  object-spread sinks, or custom sanitizer wrappers.\n- **Model output passed to dynamic execution is flagged** (`ci-ai-llm-output-dynamic-execution`).\n  CodeInspectus follows direct and split-variable intrafile flows from recognized OpenAI,\n  Anthropic, Google GenAI, Vercel AI SDK, Cohere, Groq, and Mistral call/output shapes into global\n  `eval`/`Function`, import-proven Node `child_process.exec`/`execSync`, or import-proven Execa\n  command-string APIs. The rule is **high** severity and **medium** confidence (CWE-94/78/1426;\n  OWASP **LLM05**). Constants, fixed allowlisted dispatch, `execFile`/`spawn` argument arrays,\n  shadowed globals, and explicitly validated replacement values stay silent. Cross-file flows,\n  custom model wrappers, stream accumulation, indirect sink aliases, and runtime sandbox or\n  approval state are not resolved.\n- **Conventional Next.js admin API routes need authentication and authorization**\n  (`ci-ai-nextjs-admin-route-no-authz`). Pages Router handlers under `pages/api/admin` and App\n  Router handlers under `app/api/admin/**/route.*` are flagged when either boundary is not visible\n  in the file (**high**, medium confidence; CWE-862/863/306; OWASP A01 and API5). Recognized\n  server-session/token checks plus role/permission decisions stay silent; Supabase client-writable\n  `user_metadata` is deliberately not accepted as authorization. Non-admin/public routes stay\n  silent. The bounded detector follows exact direct, one-local-helper-hop evidence; unsupported\n  cross-file middleware, custom guard semantics, and dynamic dispatch remain explicit unknowns.\n- **Import-proven Express admin routes and explicitly anonymous Supabase Edge Functions are checked.**\n  Express analysis requires a literal admin route and direct handler evidence, respects supported\n  middleware/mount ordering, and reports unresolved custom middleware as coverage metadata. Edge\n  analysis treats default or explicit `verify_jwt = true` as platform authentication; only explicit\n  anonymous deployment requires visible request authentication, and service-role/admin operations\n  additionally require visible server authorization. Cross-module custom wrappers remain unknown.\n- **Server/API-boundary checks are narrow and code-visible.** Four JavaScript/TypeScript\n  analyzers flag client-visible raw/internal error details (`CWE-209`), explicit credential\n  fields in response objects (`CWE-201`), whole request objects passed directly to common\n  Prisma/Supabase/Mongoose writes without visible validation or allow-listing (`CWE-915`),\n  and explicit credentials/headers/cookies or auth/payment request bodies sent to logs\n  (`CWE-532`). They use intrafile dataflow and prefer silence when validation, a public-error\n  mapper, or an explicit field projection is visible. Build output and minified vendor files are\n  outside these source checks. They do not claim generic response minimization, complete\n  business-authorization review, or runtime/gateway verification.\n- **Runtime security controls use three evidence states, never absence-as-vulnerability.**\n  Supported header/CSP/cookie/CAPTCHA controls report `verified_in_repository`,\n  `insecure_configuration_found`, or `not_verifiable_from_repository`. Only an explicit\n  insecure repository configuration becomes a finding; missing headers, dashboard-only\n  CAPTCHA, dynamic/conflicting layers, and hosted/gateway configuration remain metadata with\n  no posture penalty. “Verified” means only that recognized source configuration passed the\n  rule’s narrow literal check; it is not runtime or complete policy proof. Current findings\n  cover security headers explicitly disabled or\n  neutralized, production CSP with bare wildcard or `'unsafe-eval'` script sources,\n  an effective literal `Referrer-Policy: unsafe-url`, unrestricted camera/microphone/geolocation\n  delegation in a literal `Permissions-Policy`,\n  auth/session cookies with explicit insecure attributes, and checked-in Supabase CAPTCHA\n  enablement paired with a recognized signup, password/OTP/SSO/Web3 signin, or password-reset\n  call missing `captchaToken`. The CAPTCHA finding\n  describes an integration failure that Supabase should reject—not a bot-protection bypass.\n  CodeInspectus still does not prove deployed headers, gateway rate limits, DNS mail posture,\n  complete CSP quality, runtime overrides, or behavioral authentication. SPF/DMARC absence is not\n  emitted as a repository finding because authoritative state is live DNS, and DMARC `p=none` is a\n  valid monitoring mode; verify mail domains explicitly at deployment time.\n\n## Language support\n\nPlainly, what runs on what. The commodity engines are broad; the **CodeInspectus\nnative checks are predominantly JavaScript/TypeScript, plus targeted Flutter/Dart,\nAndroid/iOS configuration, React Native, Expo, Python AI/API, and one-rule Go, Java, C#, PHP, Rust,\nand Ruby AI packs, plus Firebase Security Rules and GitHub Actions workflow configuration packs**. A Python\nrepository gets native coverage only for the ten documented framework/source shapes; a Go/OpenAI,\nJava/OpenAI, C#/OpenAI, PHP/openai-php, Rust/async-openai, or Ruby/OpenAI repository gets only its one documented\ntool-execution rule. Other unsupported native-pack ecosystems still receive the selected\ncommodity-engine coverage but no native pack applies. Plain Dart without Flutter also does not activate the Flutter source pack\n(the separate native Pub SCA/SBOM engine can still run). This is stated so you don't infer broader\ncoverage than the executed pack reports.\n\n| Layer | What it covers | Language / ecosystem scope |\n|-------|----------------|----------------------------|\n| **Secrets** — Gitleaks + applicable native client-secret checks | hard-coded credentials, leaked keys | **Gitleaks: any language** because its detection is value/pattern-based. Native client-secret analysis remains pack-specific: JavaScript/TypeScript bundle and env exposure, plus Supabase privileged keys passed to Flutter client initialization. |\n| **Dependencies (CVEs/SCA), IaC misconfig, SBOM, license** — Trivy | vulnerable deps, infra misconfig, bill of materials | **Many language & package ecosystems and IaC formats** — see [Trivy's docs](https://trivy.dev). |\n| **Native Pub SCA/SBOM** — CodeInspectus Pub | exact locked-version matches against the bundled advisory snapshot; native Pub inventory and Trivy merge/fallback | **Dart/Flutter `pubspec.lock` only.** Official `pub.dev`/legacy official-host packages are matched by exact enumerated version. Custom registries, Git, path, SDK, malformed, oversized, and unreadable inputs are excluded and reported. No generic SemVer inference, reachability claim, license inference, or complete dependency-graph claim. |\n| **SAST** — Opengrep + CodeInspectus `security-baseline` | injection, XSS, SSRF, weak crypto, insecure deserialization, explicit CORS misconfiguration | **JavaScript, TypeScript, Python.** CodeInspectus ships its own Apache-2.0 ruleset and runs Opengrep with **no network registry packs**, so SAST coverage is exactly these languages — deliberately narrower than Opengrep's full engine. |\n| **Native JavaScript/TypeScript pack** | client-side secret/bundle exposure, Supabase RLS, prompt-injection sinks, model tool arguments reaching Node shell execution, client-writable `user_metadata` authz, unsanitized-output XSS, API response/error leaks, unsafe request writes, sensitive logging, explicit runtime-control misconfiguration | **JavaScript / TypeScript** (incl. `.jsx/.tsx/.mjs/.cjs`; client-secret checks also read `.vue/.svelte/.astro/.html`). Supabase RLS analyzes `.sql` plus `.ts/.js` Edge Functions; runtime-control evidence also reads recognized configuration formats. Model-tool command flow is intrafile and bounded to direct flow or one named wrapper; it does not resolve cross-module dispatch or runtime approval/sandbox state. |\n| **Native Flutter/Dart pack** | disabled TLS verification, sensitive SharedPreferences writes, untrusted JavaScript-enabled WebView navigation, sensitive logs, Supabase privileged client keys, cleartext production endpoints | **Flutter projects only.** Token-aware, source-ordered intrafile Dart analysis; no type resolution, path-sensitive branch merge, complete dataflow, or runtime mobile testing. Pub SCA/SBOM is reported by the separate native Pub engine. File/total bounds and omissions are explicit in pack coverage. |\n| **Native Android configuration pack** | debuggable release manifests, effective cleartext traffic, production user-CA trust, exported AndroidX FileProvider | **Android project evidence only.** Bounded structured XML with supported main-to-release precedence; no Gradle execution, arbitrary flavor/DSL evaluation, full manifest merger, runtime testing, or complete Android review. |\n| **Native iOS configuration pack** | global ATS arbitrary loads, insecure domain exceptions, weak TLS policy, disabled default data protection | **iOS project evidence only.** Bounded XML plist/entitlements parsing plus literal Release/AppStore Xcode references; no Xcode execution, dynamic setting expansion, provisioning-profile inspection, runtime testing, or complete iOS review. |\n| **Native React Native pack** | sensitive AsyncStorage writes; untrusted, mixed-content, or file-origin WebView configurations | **Exact React Native dependency or statically proven Expo project evidence.** Expo uses React Native, so proven Expo evidence activates both packs; bare React Native evidence does not activate Expo rules. Bounded token/structure-aware JS/TS/JSX analysis; no module execution, type resolution, whole-program flow, dynamic-prop evaluation, runtime testing, or complete React Native review. |\n| **Native Expo pack** | server secrets exposed through public app config; unsigned cleartext production updates | **Exact Expo dependency or explicit top-level `expo` config evidence only; generic `name` + `slug` fields do not activate it.** Bounded root and nested-package discovery, comments/trailing-comma-aware JSON, and non-executing direct-object JavaScript/TypeScript config parsing; dynamic config is omitted and reported, never evaluated. |\n| **Native Python AI/API pack** | hardcoded signing secrets; credentialed wildcard CORS; untrusted file responses, redirects, and template source; LLM output returned as unsafe HTML; explicit dangerous LangChain FAISS deserialization; request-controlled LangChain web-loader fetches; prompt-injection sinks; model tool arguments reaching Python shell execution | **Python with bounded Django, Flask, FastAPI, Starlette, Jinja2, OpenAI, Anthropic, or LangChain evidence.** Non-executing Lezer-gated intrafile analysis; no type resolution, module graph, general interprocedural/path-sensitive flow, artifact-trust proof, complete SSRF/agent guard analysis, complete Python review, or runtime proof. Tool execution supports direct flow and one named local wrapper, not generic/cross-module dispatch. Unsupported syntax and bounded-out input fail closed and are reported in pack coverage. |\n| **Native Go AI pack** | model-produced OpenAI Go tool arguments reaching a recognized `os/exec` shell invocation | **Go with the exact official `github.com/openai/openai-go` module only.** One bounded, non-executing, intrafile medium-confidence rule; no general Go security coverage, other model SDKs, type/module resolution, cross-module flow, runtime approval/sandbox proof, or complete agent review. |\n| **Native Java AI pack** | model-produced OpenAI Java tool arguments reaching an actually-started recognized `ProcessBuilder` or `Runtime` shell invocation | **Java with exact official `com.openai:openai-java` or `openai-java-core` dependency evidence only.** One bounded, non-executing, intrafile medium-confidence rule; no general Java security coverage, Spring AI/LangChain4j/Azure OpenAI support, type/module resolution, cross-module flow, Java text-block parsing, runtime approval/sandbox proof, or complete agent review. |\n| **Native C# AI pack** | model-produced official OpenAI .NET tool arguments reaching an actually-started recognized `System.Diagnostics.Process` shell invocation | **C# with exact official `OpenAI` NuGet package evidence only.** One bounded, non-executing, intrafile medium-confidence rule; no general C# security coverage, Semantic Kernel/Azure OpenAI support, type/project-reference resolution, cross-file flow, raw-string-content analysis, runtime approval/sandbox proof, or complete agent review. |\n| **Native PHP AI pack** | model-produced OpenAI PHP ecosystem tool arguments reaching `exec`, `system`, `shell_exec`, or `passthru` | **PHP with exact community-maintained `openai-php/client` or `openai-php/laravel` Composer evidence only.** One bounded, non-executing, intrafile medium-confidence rule; no general PHP security coverage, official-SDK claim, type/Composer-graph resolution, cross-file flow, generic callable dispatch, runtime approval/sandbox proof, or complete agent review. |\n| **Native Rust AI pack** | model-produced community `async-openai` tool arguments reaching recognized standard/Tokio process or Bollard Docker exec shell invocations | **Rust with exact community-maintained `async-openai` Cargo dependency evidence only.** One bounded, non-executing, intrafile medium-confidence rule; no general Rust security coverage, official-SDK claim, rustc/type/Cargo-graph resolution, cross-crate flow, generic dispatch, runtime container/approval/sandbox proof, or complete agent review. |\n| **Native Ruby AI pack** | model-produced official OpenAI Ruby tool arguments reaching `system`, `exec`, `IO.popen`, or import-proven Open3 shell execution | **Ruby with exact official production `openai` Gemfile or runtime gemspec evidence only; lockfile-only evidence does not activate.** One bounded, non-executing, intrafile medium-confidence rule; no general Ruby security coverage, Bundler/type resolution, cross-file flow, backtick/percent-x/spawn coverage, runtime approval/sandbox proof, or complete agent review. |\n| **Native Firebase configuration pack** | literal unconditional public writes in Cloud Firestore, Cloud Storage, and Realtime Database Security Rules | **Firebase project/config/rule evidence only.** Three bounded, non-executing, high-confidence rules; public reads and non-literal conditions stay silent. No helper-function evaluation, deployed-policy/IAM/App Check proof, runtime testing, or complete Firebase review. |\n| **Native GitHub Actions workflow pack** | direct attacker-controlled GitHub context interpolation in `run`; exact `pull_request_target` untrusted checkout-and-execute chains | **Direct root `.github/workflows/*.yml`/`.yaml` files only.** Two bounded, non-executing rules with strict YAML 1.2 parsing. Safe `env`/`with` indirection, normal `pull_request`, checkout without execution, and protected checkout v7 stay silent. No general taint, custom-action, artifact, runner, deployed-policy, or complete Actions review. |\n\n## Compliance frameworks (code-visible subset)\n\nNIST CSF 2.0 · ISO/IEC 27001:2022 · SOC 2 · CIS Controls v8.1 · Essential Eight\n(Patch Applications only) · OWASP Top 10 (2021) · OWASP LLM Top 10 (2025).\nMITRE ATT&CK techniques are shown as related-adversary context only, never as a\ncoverage score.\n\nRelevant findings can also carry OWASP API Security Top 10 (2023) category tags.\nThose tags describe the detected failure pattern; they are not an OWASP API review,\ncoverage score, compliance claim, or certification.\n\n> **Compliance mappings are AI-drafted, reviewed by a cybersecurity practitioner\n> (Synvoya) — code-level coverage only, not an audit or certification. Community review\n> welcome.** The CWE→control mappings are self-audited with per-mapping confidence and an\n> open community-verification process — see\n> [`docs/COMPLIANCE-RATIONALE.md`](docs/COMPLIANCE-RATIONALE.md) and\n> [`CONTRIBUTING.md`](CONTRIBUTING.md). Essential Eight is **not** a coverage view: only\n> Patch Applications is code-evidenced (~1 of 8) — this is not an Essential Eight assessment.\n\n## How it works\n\n```\nagent → codeinspectus_scan → [Opengrep | Gitleaks | Trivy | native Pub] + applicable native packs\n      → normalize → dedup (incl. Trivy/native-Pub advisory aliases + secret overlap)\n      → CWE-keyed findings + runtime-control evidence → compliance map → compact JSON + summary\nALL LOCAL. NO NETWORK EGRESS AT SCAN TIME.\n```\n\n## Example reports\n\n- [V2.1 public-repository scan → fix → rescan → sealed-evidence case study](examples/reports/rich-v2.1.0-sealed-workflow.md)\n- [V1.5 public-repository scan → fix → rescan case study](examples/reports/rich-github-actions-v1.5.0.md)\n- [Reproducible v0.3.1 scan of the shipped vulnerable fixture](examples/reports/vulnerable-app-v0.3.1.md)\n\n## Trademark\n\n\"CodeInspectus\" is the name of this free, open-source project (npm `codeinspectus`,\n`codeinspectus.com`). \"Code Inspect\" is a descriptive phrase in a crowded namespace;\nregistry availability is not trademark clearance, and the name is **not claimed as a\ntrademark**.\n\n## Development\n\n```bash\nnpm install\nnpm run build      # tsc --noEmit && tsup  (must compile clean)\nnpm run eval       # 53 MCP stdio evals across the shipped verification fixtures\nnpm run inspector  # npx @modelcontextprotocol/inspector node dist/index.js\n```\n\nHow this repository is generated (an auditable, allow-list seed) and built end-to-end:\n[`docs/BUILD.md`](docs/BUILD.md).\n\n## Contributing\n\nCodeInspectus is a **solo, free, open-source** project, built and maintained by\none cybersecurity practitioner under the **Synvoya** name. There is no company\nbehind it and nothing to sell — which is exactly why outside eyes matter.\n**Independent review is genuinely wanted**, not a courtesy line. If you work in\nsecurity, your scrutiny is the contribution.\n\nTwo areas where review helps most:\n\n- **Compliance CWE→control mappings.** These are **AI-drafted, then policy-reviewed\n  by the maintainer** — they are **NOT independently verified.** Every mapping is\n  tracked through three explicit states: **AI-drafted → maintainer-policy-reviewed →\n  community-verified.** Today almost everything sits in the first two; the\n  community-verified count is **0 of 96**, and that is reported honestly rather than hidden.\n  Moving a mapping to *community-verified* takes evidence (a quote from the control's\n  primary source + your basis) — the bar and process are in\n  [`CONTRIBUTING.md`](CONTRIBUTING.md); the per-mapping rationale and confidence live\n  in [`docs/COMPLIANCE-RATIONALE.md`](docs/COMPLIANCE-RATIONALE.md).\n- **Detection rules** (`detection-db/**`, `src/ai-checks/**`, `src/packs/**`). New rules, precision\n  fixes, and false-positive reports are all welcome. The merge bar is **precision**:\n  a fixture proving the true positive, and a near-miss fixture proving the rule does\n  **not** over-fire. Details in [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\nWhat CodeInspectus claims — and what it deliberately does **not** — is written down so\nyou can check it before trusting a number: the standing compliance disclaimer (in the\n[Compliance frameworks](#compliance-frameworks-code-visible-subset) section above and in\n[`docs/COMPLIANCE-RATIONALE.md`](docs/COMPLIANCE-RATIONALE.md)) and the three-state\nhonesty metric. If something reads as over-claiming, that is a bug — please open an issue.\n\nWorkflow: **fork → branch → PR**; the maintainer reviews and merges (external\ncontributors don't push directly). — *Synvoya (the maintainer, a cybersecurity\npractitioner)*\n\n## Good first contributions\n\n- [Community-verify one CWE to OWASP Top 10 mapping](https://github.com/Synvoya/codeinspectus/issues/4)\n- [Community-verify one CWE to SOC 2 or ISO 27001](https://github.com/Synvoya/codeinspectus/issues/5)\n\n[Browse all good first issues](https://github.com/Synvoya/codeinspectus/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22).\n\n## Changelog\n\nPer-version release notes live in [`CHANGELOG.md`](CHANGELOG.md).\n\n## Licenses\n\nCodeInspectus is licensed under Apache-2.0. The separately downloaded engines retain their own\nlicenses: Opengrep (LGPL-2.1), Gitleaks (MIT), and Trivy (Apache-2.0). Engine binaries are not\nincluded in the npm package. See [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for versions,\ncopyright notices, upstream source, and license links.\nThe transformed Pub advisory snapshot is derived from OSV.d",
  "bytes": 60000,
  "sha": "ad98db3072793f35a55a841755c5750856bf3b2fe94ea657238b7d1f039cab85",
  "repo_slug": "synvoya/codeinspectus",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_synvoya_codeinspectus_77313231/readme"
}