agent-vetter 0.2.0__tar.gz

agent_vetter-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install
+        run: python -m pip install -e . pytest
+      - name: Run tests
+        run: pytest -q
+
+  scan-clean-skill:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Scan a clean skill (must pass)
+        uses: ./action
+        with:
+          path: tests/fixtures/clean-skill
+          fail-on: high

agent_vetter-0.2.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+dist/
+build/
+PLAN.md
+*.egg-info/
+.DS_Store

agent_vetter-0.2.0/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.2.0] - 2026-11-10
+
+### Added
+- **Windows rule pack** (`windows/*`): `iex (iwr …)` pipe-to-PowerShell,
+  `Invoke-Expression`, encoded commands, certutil / mshta / bitsadmin
+  downloads, `Set-ExecutionPolicy Bypass`, schtasks and registry-Run
+  persistence, broad recursive deletes, `format d:`. Scans `.ps1`,
+  `.psm1`, `.psd1`, `.bat`, `.cmd`.
+- **LLM deep-scan mode** (opt-in `--llm`): one chat-completion call that
+  explains each deterministic finding and flags semantic risks (multi-stage
+  injection chains, social engineering, tool-allowlist contradictions).
+  Works with any OpenAI-compatible endpoint (`OPENAI_BASE_URL`,
+  `AGENTSCAN_LLM_MODEL`). Advisory by default; `--llm-fail` lets LLM
+  findings at HIGH+ affect the exit code.
+- **GitHub Action** (`action/action.yml`): composite action that installs
+  and runs agentscan; inputs `path`, `fail-on`, `version`, `json`.
+- **CI workflow**: test suite + action scanning a clean skill fixture on
+  every push/PR.
+- `--version` flag.
+
+## [0.1.0] - 2026-11-09
+
+### Added
+- Initial release: static security scanner for AI agent assets.
+- Rule families: `secret/*`, `injection/*` (EN + VN), `dangerous/*`,
+  `exfil/*`, `privilege/*`.
+- CLI with `--json`, `--fail-on`, `--no-color`; exit code 1 on findings
+  at or above the threshold (default: high).
+- Fixture-based unit tests for every rule.

agent_vetter-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 agentscan contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agent_vetter-0.2.0/PKG-INFO

@@ -0,0 +1,164 @@
+Metadata-Version: 2.5
+Name: agent-vetter
+Version: 0.2.0
+Summary: Static security scanner for AI agent skill packs, MCP servers, and agent configs
+Author: sinhduc01
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agents,audit,claude-code,mcp,prompt-injection,scanner,security,skill
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <img src="assets/demo.gif" alt="agentscan demo" width="880">
+</p>
+
+# agentscan
+
+**Snyk for AI agents.** A static security scanner for AI agent assets: skill
+packs (Claude Code / Codex / Cursor), MCP server code, and agent instruction
+docs (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `.mcp.json`, `.env`) —
+including Windows skill scripts (`.ps1` / `.bat`).
+
+Everyone is now installing skills into their agents. A skill is third-party
+code *and* instructions. A malicious one ships prompt injection, hardcoded
+keys, `curl | sh`, and exfiltration to a raw IP — and your agent runs it with
+your permissions.
+
+agentscan catches that **before** the skill is loaded: fast, offline,
+deterministic rules — zero dependencies — and every rule is unit-tested
+against a fixture corpus. An optional LLM pass adds semantic depth
+(§ LLM deep-scan).
+
+## What it detects
+
+| Family | Severity | Examples |
+|---|---|---|
+| `secret/*` | CRITICAL | AWS access keys, OpenAI / Anthropic / GitHub / Google / Slack / ServiceNow tokens, PEM private keys, GCP service-account JSON, JWTs |
+| `injection/*` | CRITICAL / HIGH | "ignore all previous instructions", fetch-and-follow remote commands (English **and Vietnamese**), zero-width / invisible text, hidden HTML comments, white-on-white spans, base64 blobs, pastebin / ngrok URLs |
+| `dangerous/*` | CRITICAL | `curl \| sh`, base64-decode-then-execute, `eval` of network-fetched content, `rm -rf ~` / `--no-preserve-root`, `chmod 777`, crontab persistence |
+| `windows/*` | CRITICAL / HIGH / MEDIUM | `iex (iwr …)`, `Invoke-Expression`, encoded commands (`-enc`), certutil / mshta / bitsadmin downloads, `Set-ExecutionPolicy Bypass`, schtasks / registry-Run persistence, `format d:` |
+| `exfil/*` | MEDIUM | network sends in files that read env vars / local files, raw-IP URLs, abuse-prone TLDs (`.top` / `.xyz` / …) |
+| `privilege/*` | HIGH / MEDIUM | `--dangerously-skip-permissions` in agent docs, "never ask for confirmation" (EN + VN), `allowed-tools: Bash(*)` in SKILL.md frontmatter |
+
+The rule set is deliberately bilingual (EN/VN) and aimed at the
+agentic-skill attack surface, not generic secret scanning.
+
+## Install
+
+```bash
+pip install agent-vetter
+```
+
+Python 3.10+. No other dependencies. Install from git instead:
+`pip install git+https://github.com/sinhduc01/agentscan.git`.
+```bash
+agentscan ./path/to/skill-pack   # human-readable table
+agentscan . --json               # machine-readable, for CI
+agentscan . --fail-on medium     # exit 1 on >= medium (default: high)
+```
+
+Exit code `1` when a finding at or above the threshold is found, so it plugs
+directly into CI, pre-install hooks, or a skill registry gate:
+
+```yaml
+- name: Scan agent assets
+  run: agentscan skills/ .mcp.json AGENTS.md --fail-on medium
+```
+
+Example finding:
+
+```
+  CRITICAL  secret/aws-access-key              scripts/deploy.py:4
+            AWS access key ID
+            > AWS_KEY = "AKIAQ7…01
+            fix: Rotate the key in IAM; move credentials to environment
+                 variables or a secret manager.
+```
+
+## LLM deep-scan (opt-in)
+
+The deterministic core is offline and free by design. `--llm` adds an
+advisory second pass that (1) explains *why* each finding is dangerous and
+(2) flags semantic risks patterns can't see — multi-stage injection chains,
+social engineering, instructions that weaken safety controls:
+
+```bash
+export OPENAI_API_KEY=…            # any OpenAI-compatible endpoint
+export OPENAI_BASE_URL=http://…    # optional — self-hosted vLLM works
+export AGENTSCAN_LLM_MODEL=qwen    # optional — default gpt-4o-mini
+
+agentscan ./skill --llm --json
+```
+
+- LLM results are **advisory by default**: the exit code is still driven
+  only by deterministic findings. Add `--llm-fail` to let LLM findings at
+  HIGH or above fail the scan.
+- A missing API key or unreachable endpoint prints a warning and never
+  breaks the scan.
+- One chat-completion call: the scanner findings plus up to 8 instruction
+  documents (12 KB each) are sent to the model; the reply is strict JSON.
+- LLM severity labels are non-deterministic across runs — treat `--llm-fail`
+  as a review signal, not a hard gate.
+
+## GitHub Action
+
+```yaml
+- uses: sinhduc01/agentscan@main   # composite action, installs the tool itself
+  with:
+    path: skills/
+    fail-on: high
+    # version: 0.1.0   # pin a PyPI release instead of git@main
+    # json: true       # machine-readable output
+```
+
+The repo's own CI runs the test suite and scans a clean skill fixture with
+the action on every push/PR.
+
+## Why deterministic rules first?
+
+- **Testable**: every rule has a fixture; the suite runs in 0.1 s.
+- **Offline & free**: a pre-install security gate that needs an API key or a
+  network call is not a gate.
+- **Reproducible**: same input, same findings, no model drift.
+
+The LLM pass is therefore opt-in and advisory — it improves triage, it does
+not change what "safe" means.
+
+## Limitations (read before relying on this)
+
+- Static analysis: obfuscated payloads (decode → exec in two stages across
+  files) and purely semantic malice are out of scope for the deterministic
+  core — the LLM pass narrows, but does not close, that gap.
+- Heuristics produce false positives: a legitimate telemetry POST that reads
+  an env var will be flagged `exfil/possible-exfiltration`.
+- This is a first-pass filter, not a substitute for reviewing a skill's code.
+
+## Development
+
+```bash
+pip install -e .
+pytest
+```
+
+Layout: `agentscan/rules/` holds one module per rule family
+(`secrets`, `injection`, `dangerous`, `exfil`, `privilege`, `windows`);
+adding a rule is one tuple in a module's `_PATTERNS` list plus a fixture
+line in `tests/fixtures/`. `agentscan/llm.py` holds the advisory LLM pass.
+
+## Roadmap
+
+- pre-commit hook
+- more targets: Rust/Go MCP servers, `.mcp.json` tool-grant analysis
+- ignore/allowlist file for repository-wide scans
+
+## License
+
+MIT — see [LICENSE](LICENSE).

agent_vetter-0.2.0/README.md

@@ -0,0 +1,146 @@
+<p align="center">
+  <img src="assets/demo.gif" alt="agentscan demo" width="880">
+</p>
+
+# agentscan
+
+**Snyk for AI agents.** A static security scanner for AI agent assets: skill
+packs (Claude Code / Codex / Cursor), MCP server code, and agent instruction
+docs (`AGENTS.md`, `CLAUDE.md`, `.cursorrules`, `.mcp.json`, `.env`) —
+including Windows skill scripts (`.ps1` / `.bat`).
+
+Everyone is now installing skills into their agents. A skill is third-party
+code *and* instructions. A malicious one ships prompt injection, hardcoded
+keys, `curl | sh`, and exfiltration to a raw IP — and your agent runs it with
+your permissions.
+
+agentscan catches that **before** the skill is loaded: fast, offline,
+deterministic rules — zero dependencies — and every rule is unit-tested
+against a fixture corpus. An optional LLM pass adds semantic depth
+(§ LLM deep-scan).
+
+## What it detects
+
+| Family | Severity | Examples |
+|---|---|---|
+| `secret/*` | CRITICAL | AWS access keys, OpenAI / Anthropic / GitHub / Google / Slack / ServiceNow tokens, PEM private keys, GCP service-account JSON, JWTs |
+| `injection/*` | CRITICAL / HIGH | "ignore all previous instructions", fetch-and-follow remote commands (English **and Vietnamese**), zero-width / invisible text, hidden HTML comments, white-on-white spans, base64 blobs, pastebin / ngrok URLs |
+| `dangerous/*` | CRITICAL | `curl \| sh`, base64-decode-then-execute, `eval` of network-fetched content, `rm -rf ~` / `--no-preserve-root`, `chmod 777`, crontab persistence |
+| `windows/*` | CRITICAL / HIGH / MEDIUM | `iex (iwr …)`, `Invoke-Expression`, encoded commands (`-enc`), certutil / mshta / bitsadmin downloads, `Set-ExecutionPolicy Bypass`, schtasks / registry-Run persistence, `format d:` |
+| `exfil/*` | MEDIUM | network sends in files that read env vars / local files, raw-IP URLs, abuse-prone TLDs (`.top` / `.xyz` / …) |
+| `privilege/*` | HIGH / MEDIUM | `--dangerously-skip-permissions` in agent docs, "never ask for confirmation" (EN + VN), `allowed-tools: Bash(*)` in SKILL.md frontmatter |
+
+The rule set is deliberately bilingual (EN/VN) and aimed at the
+agentic-skill attack surface, not generic secret scanning.
+
+## Install
+
+```bash
+pip install agent-vetter
+```
+
+Python 3.10+. No other dependencies. Install from git instead:
+`pip install git+https://github.com/sinhduc01/agentscan.git`.
+```bash
+agentscan ./path/to/skill-pack   # human-readable table
+agentscan . --json               # machine-readable, for CI
+agentscan . --fail-on medium     # exit 1 on >= medium (default: high)
+```
+
+Exit code `1` when a finding at or above the threshold is found, so it plugs
+directly into CI, pre-install hooks, or a skill registry gate:
+
+```yaml
+- name: Scan agent assets
+  run: agentscan skills/ .mcp.json AGENTS.md --fail-on medium
+```
+
+Example finding:
+
+```
+  CRITICAL  secret/aws-access-key              scripts/deploy.py:4
+            AWS access key ID
+            > AWS_KEY = "AKIAQ7…01
+            fix: Rotate the key in IAM; move credentials to environment
+                 variables or a secret manager.
+```
+
+## LLM deep-scan (opt-in)
+
+The deterministic core is offline and free by design. `--llm` adds an
+advisory second pass that (1) explains *why* each finding is dangerous and
+(2) flags semantic risks patterns can't see — multi-stage injection chains,
+social engineering, instructions that weaken safety controls:
+
+```bash
+export OPENAI_API_KEY=…            # any OpenAI-compatible endpoint
+export OPENAI_BASE_URL=http://…    # optional — self-hosted vLLM works
+export AGENTSCAN_LLM_MODEL=qwen    # optional — default gpt-4o-mini
+
+agentscan ./skill --llm --json
+```
+
+- LLM results are **advisory by default**: the exit code is still driven
+  only by deterministic findings. Add `--llm-fail` to let LLM findings at
+  HIGH or above fail the scan.
+- A missing API key or unreachable endpoint prints a warning and never
+  breaks the scan.
+- One chat-completion call: the scanner findings plus up to 8 instruction
+  documents (12 KB each) are sent to the model; the reply is strict JSON.
+- LLM severity labels are non-deterministic across runs — treat `--llm-fail`
+  as a review signal, not a hard gate.
+
+## GitHub Action
+
+```yaml
+- uses: sinhduc01/agentscan@main   # composite action, installs the tool itself
+  with:
+    path: skills/
+    fail-on: high
+    # version: 0.1.0   # pin a PyPI release instead of git@main
+    # json: true       # machine-readable output
+```
+
+The repo's own CI runs the test suite and scans a clean skill fixture with
+the action on every push/PR.
+
+## Why deterministic rules first?
+
+- **Testable**: every rule has a fixture; the suite runs in 0.1 s.
+- **Offline & free**: a pre-install security gate that needs an API key or a
+  network call is not a gate.
+- **Reproducible**: same input, same findings, no model drift.
+
+The LLM pass is therefore opt-in and advisory — it improves triage, it does
+not change what "safe" means.
+
+## Limitations (read before relying on this)
+
+- Static analysis: obfuscated payloads (decode → exec in two stages across
+  files) and purely semantic malice are out of scope for the deterministic
+  core — the LLM pass narrows, but does not close, that gap.
+- Heuristics produce false positives: a legitimate telemetry POST that reads
+  an env var will be flagged `exfil/possible-exfiltration`.
+- This is a first-pass filter, not a substitute for reviewing a skill's code.
+
+## Development
+
+```bash
+pip install -e .
+pytest
+```
+
+Layout: `agentscan/rules/` holds one module per rule family
+(`secrets`, `injection`, `dangerous`, `exfil`, `privilege`, `windows`);
+adding a rule is one tuple in a module's `_PATTERNS` list plus a fixture
+line in `tests/fixtures/`. `agentscan/llm.py` holds the advisory LLM pass.
+
+## Roadmap
+
+- pre-commit hook
+- more targets: Rust/Go MCP servers, `.mcp.json` tool-grant analysis
+- ignore/allowlist file for repository-wide scans
+
+## License
+
+MIT — see [LICENSE](LICENSE).

agent_vetter-0.2.0/action/action.yml

@@ -0,0 +1,46 @@
+name: agentscan
+description: >-
+  Scan AI agent assets (skill packs, MCP servers, agent configs) for hardcoded
+  secrets, prompt injection, dangerous commands, and data exfiltration.
+
+inputs:
+  path:
+    description: "File or directory to scan (default: current directory)"
+    required: false
+    default: "."
+  fail-on:
+    description: Fail when a finding at or above this severity is present (critical|high|medium|low|info)
+    required: false
+    default: "high"
+  version:
+    description: agentscan version to install (e.g. 0.1.0) or "git" for the latest commit on main
+    required: false
+    default: "git"
+  json:
+    description: Emit machine-readable JSON output
+    required: false
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Install agentscan
+      shell: bash
+      env:
+        AGENTSCAN_VERSION: ${{ inputs.version }}
+      run: |
+        if [ "$AGENTSCAN_VERSION" = "git" ]; then
+          python -m pip install --quiet "git+https://github.com/sinhduc01/agentscan.git@main"
+        else
+          python -m pip install --quiet "agent-vetter==$AGENTSCAN_VERSION"
+        fi
+
+    - name: Run agentscan
+      shell: bash
+      env:
+        AGENTSCAN_JSON: ${{ inputs.json }}
+      run: |
+        if [ "$AGENTSCAN_JSON" = "true" ]; then
+          agentscan "${{ inputs.path }}" --fail-on "${{ inputs.fail-on }}" --json --no-color
+        else
+          agentscan "${{ inputs.path }}" --fail-on "${{ inputs.fail-on }}" --no-color
+        fi

agent_vetter-0.2.0/agentscan/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.0"

agent_vetter-0.2.0/agentscan/cli.py

@@ -0,0 +1,147 @@
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+
+from . import __version__, llm
+from .models import Finding, Severity
+from .scanner import scan, scan_with_docs
+
+RESET = "\x1b[0m"
+_SEV = {s.name.lower(): s for s in Severity}
+
+
+def _render(findings: list[Finding], scanned: int, root: Path, no_color: bool,
+            llm_report: dict | None = None, model: str = "") -> str:
+    sev = lambda s: "" if no_color else s.color  # noqa: E731
+    out = [f"agentscan {__version__} — {scanned} files scanned in {root}"]
+    if not findings:
+        out.append("  No findings — PASS")
+    else:
+        for f in findings:
+            out.append(
+                f"  {sev(f.severity)}{f.severity.name:<8}{RESET}  "
+                f"{f.rule_id:<36} {f.path}:{f.line}"
+            )
+            out.append(f"  {'':<8}  {f.title}")
+            if f.snippet:
+                out.append(f"  {'':<8}  > {f.snippet[:140]}")
+            if f.fix:
+                out.append(f"  {'':<8}  fix: {f.fix}")
+            out.append("")
+        counts: dict[str, int] = {}
+        for f in findings:
+            counts[f.severity.name] = counts.get(f.severity.name, 0) + 1
+        summary = ", ".join(
+            f"{n} {k.lower()}" for k, n in sorted(counts.items(), key=lambda kv: -Severity[kv[0]])
+        )
+        out.append(f"{len(findings)} findings ({summary}) — FAIL")
+    if llm_report is not None:
+        out.append("")
+        out.append(f"  LLM review ({model}):")
+        for e in llm_report.get("explanations", []):
+            out.append(f"    {e.get('rule', '?')} — risk: {e.get('risk', '')}")
+            rec = e.get("recommendation", "")
+            if rec:
+                out.append(f"    {'':<4}recommendation: {rec}")
+        for x in llm_report.get("extra_findings", []):
+            sev_name = str(x.get("severity", "?")).upper()
+            out.append(
+                f"    LLM-{sev_name:<5} {x.get('title', '?')}"
+                f"  {x.get('path', '?')}:{x.get('line', 0)}"
+            )
+            if x.get("message"):
+                out.append(f"    {'':<4}{x['message']}")
+    return "\n".join(out)
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(
+        prog="agentscan",
+        description="Static security scanner for AI agent skill packs, "
+                    "MCP servers, and agent configs.",
+    )
+    ap.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    ap.add_argument("path", nargs="?", default=".",
+                    help="file or directory to scan (default: current directory)")
+    ap.add_argument("--json", action="store_true", help="machine-readable output")
+    ap.add_argument("--fail-on", default="high",
+                    choices=["critical", "high", "medium", "low", "info"],
+                    help="exit 1 when a finding at or above this severity "
+                         "is present (default: high)")
+    ap.add_argument("--no-color", action="store_true")
+    ap.add_argument("--llm", action="store_true",
+                    help="opt-in LLM deep review: explains findings and flags "
+                         "semantic risks (needs OPENAI_API_KEY; OPENAI_BASE_URL "
+                         "and AGENTSCAN_LLM_MODEL are honored)")
+    ap.add_argument("--llm-model",
+                    default=os.environ.get("AGENTSCAN_LLM_MODEL", llm.DEFAULT_MODEL),
+                    help="model name for the LLM review (default: %(default)s)")
+    ap.add_argument("--llm-fail", action="store_true",
+                    help="let LLM extra findings at HIGH or above affect the exit code")
+    args = ap.parse_args(argv)
+    threshold = Severity[args.fail_on.upper()]
+
+    root = Path(args.path)
+    if not root.exists():
+        ap.error(f"path not found: {root}")
+
+    llm_report: dict | None = None
+    docs: list[tuple[str, str]] = []
+    if args.llm:
+        scanned, findings, docs = scan_with_docs(root)
+    else:
+        scanned, findings = scan(root)
+    findings.sort(key=Finding.sort_key)
+
+    failed = any(f.severity >= threshold for f in findings)
+
+    if args.llm:
+        api_key = os.environ.get("OPENAI_API_KEY", "")
+        base_url = os.environ.get("OPENAI_BASE_URL", llm.DEFAULT_BASE_URL)
+        if not api_key:
+            print("  warning: --llm set but OPENAI_API_KEY is not set; "
+                  "skipping LLM review", file=sys.stderr)
+        else:
+            try:
+                llm_report = llm.llm_review(findings, docs, args.llm_model,
+                                            api_key, base_url)
+            except llm.LLMError as e:
+                print(f"  warning: LLM review unavailable: {e}", file=sys.stderr)
+            if llm_report and args.llm_fail:
+                for x in llm_report.get("extra_findings", []):
+                    if _SEV.get(str(x.get("severity", "")).lower(), Severity.INFO) >= Severity.HIGH:
+                        failed = True
+
+    if args.json:
+        payload = {
+            "scanned_files": scanned,
+            "result": "fail" if failed else "pass",
+            "findings": [
+                {
+                    "rule": f.rule_id,
+                    "severity": f.severity.name,
+                    "title": f.title,
+                    "path": f.path,
+                    "line": f.line,
+                    "message": f.message,
+                    "fix": f.fix,
+                }
+                for f in findings
+            ],
+        }
+        if llm_report is not None:
+            payload["llm"] = {"model": args.llm_model, **llm_report}
+        print(json.dumps(payload, indent=2, ensure_ascii=False))
+    else:
+        print(_render(findings, scanned, root, args.no_color,
+                      llm_report, args.llm_model))
+
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())