Skip to content

AGENTS.md

Latest commit

 

History

History
67 lines (50 loc) · 2.24 KB

AGENTS.md

File metadata and controls

67 lines (50 loc) · 2.24 KB
Raw

@emisso/security

AI-powered security scanner for codebases and pull requests.

Overview

@emisso/security uses LLMs (Claude, Codex, Gemini) to scan repositories for security vulnerabilities, hardcoded secrets, and dependency issues. It produces SARIF output compatible with GitHub Code Scanning. Available as an SDK, CLI, and GitHub Action.

Architecture

Monorepo with three packages:

  • packages/engine (@emisso/security) — Pure scanning engine. Provider abstraction, analyzers, SARIF/Markdown/JSON output, rule loading.
  • packages/cli (@emisso/security-cli) — CLI with scan, review-pr, threat-model, init commands.
  • packages/action (@emisso/security-action) — GitHub Action for CI/CD integration.

Getting Started

npm install @emisso/security
import { scan } from '@emisso/security';

const result = await scan({
  path: '/path/to/repo',
  analyzers: ['sast', 'secrets'],
  provider: 'claude',
  verify: true,
});

console.log(result.summary);

Key Files

File Purpose
packages/engine/src/index.ts Public API — all engine exports
packages/engine/src/types.ts Zod schemas + TypeScript types
packages/engine/src/scanner.ts Main orchestrator
packages/engine/src/providers/ LLM provider abstraction (Claude, Codex)
packages/engine/src/analyzers/ SAST, secrets, dependencies analyzers
packages/engine/src/prompts/system.ts Security researcher system prompts
packages/engine/src/output/sarif.ts SARIF 2.1.0 formatter
packages/engine/src/utils/parser.ts LLM output parser
rules/ Security rule definitions

Development

pnpm install              # Install dependencies
pnpm build                # Build all packages (tsup)
pnpm test                 # Run tests (vitest, watch mode)
pnpm test:run             # Run tests (CI mode)
pnpm lint                 # Typecheck (tsc --noEmit)

Code Style

  • TypeScript strict mode, ESM-first (CJS compat via tsup)
  • Zod for all data validation at boundaries
  • Engine is pure — zero I/O beyond LLM provider calls
  • SARIF output follows OASIS SARIF 2.1.0 specification
  • Tests use vitest with deterministic assertions
  • Conventional Commits for git messages