apisec-code-bolt 0.1.0__tar.gz

apisec_code_bolt-0.1.0/.gitignore

@@ -0,0 +1,54 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+**/__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+build/
+dist/
+wheels/
+*.egg
+*.egg-info/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Test / coverage / type-check caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+.hypothesis/
+
+# Environment / secrets
+.env
+.env.*
+!.env.example
+
+# Editors / OS
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+
+# Demo recordings (local-only)
+*.mp4
+
+# Benchmark per-run output (clones are cached at ~/.cache/apisec-benchmark,
+# manifests go under benchmark/runs/<suite>-<version>/)
+benchmark/runs/

apisec_code_bolt-0.1.0/PKG-INFO

@@ -0,0 +1,230 @@
+Metadata-Version: 2.4
+Name: apisec-code-bolt
+Version: 0.1.0
+Summary: Static analysis probe for extracting architectural metadata from codebases
+Project-URL: Homepage, https://apisec.ai
+Project-URL: Documentation, https://docs.apisec.ai/code-bolt
+Project-URL: Repository, https://github.com/apisec-inc/apisec-code-bolt
+Author-email: APIsec <engineering@apisec.ai>
+License: Proprietary
+Keywords: api,security,static-analysis,vulnerability
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1.0
+Requires-Dist: httpx>=0.26.0
+Requires-Dist: javalang>=0.13.0
+Requires-Dist: libcst>=1.1.0
+Requires-Dist: networkx>=3.2
+Requires-Dist: pathspec>=0.12.0
+Requires-Dist: pydantic-settings>=2.1.0
+Requires-Dist: pydantic>=2.5.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: tree-sitter-c-sharp>=0.23
+Requires-Dist: tree-sitter-javascript>=0.23
+Requires-Dist: tree-sitter-typescript>=0.23
+Requires-Dist: tree-sitter>=0.23
+Requires-Dist: typing-extensions>=4.9.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.8.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.1.0; extra == 'dev'
+Requires-Dist: pytest>=7.4.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Provides-Extra: semgrep
+Requires-Dist: semgrep>=1.50.0; extra == 'semgrep'
+Description-Content-Type: text/markdown
+
+# apisec-code-bolt
+
+Static analysis probe for extracting architectural metadata from codebases.
+
+## Overview
+
+apisec-code-bolt analyzes source code to extract:
+
+- **Routes/Endpoints** — HTTP routes, parameters, request/response types
+- **Data Flows** — How data moves from entry points to sinks
+- **Authentication** — Auth schemes, dependencies, role requirements
+- **Integrations** — External services, databases, APIs
+- **Dependencies** — Package dependencies and versions
+
+The output is a structured **manifest** that can be uploaded to the APIsec cloud
+for vulnerability analysis. **Raw source code never leaves your environment.**
+
+## Installation
+
+```bash
+pip install apisec-code-bolt
+```
+
+## Quick Start
+
+```bash
+# Analyze a project and upload to cloud
+apisec-code-bolt analyze /path/to/project
+
+# Analyze and save manifest locally
+apisec-code-bolt analyze . --output manifest.json --no-upload
+
+# With framework hints
+apisec-code-bolt analyze . --frameworks fastapi,sqlalchemy
+```
+
+## Supported Languages & Frameworks
+
+### Currently Supported
+
+| Language | Frameworks |
+|----------|-----------|
+| Python | FastAPI |
+| Java | Spring Boot |
+
+### Planned
+
+| Language | Frameworks |
+|----------|-----------|
+| Python | Flask, Django |
+| Java | Micronaut, Quarkus |
+| Kotlin | Spring Boot, Ktor |
+| JavaScript/TypeScript | Express, NestJS |
+
+## Configuration
+
+Create a `.codebolt.yaml` file in your project root:
+
+```yaml
+analysis:
+  file_discovery:
+    exclude_patterns:
+      - "tests/**"
+      - "**/migrations/**"
+    max_files: 10000
+  
+  data_flow:
+    mode: inter_procedural
+    max_depth: 10
+
+cloud:
+  enabled: true
+  api_url: https://api.apisec.ai
+
+output:
+  format: json
+```
+
+## Commands
+
+### analyze
+
+Analyze a codebase and generate a manifest.
+
+```bash
+apisec-code-bolt analyze [PATH] [OPTIONS]
+
+Options:
+  -o, --output FILE     Save manifest to file
+  --no-upload           Skip uploading to cloud
+  --format [json|yaml]  Output format
+  --config FILE         Path to config file
+  --frameworks TEXT     Comma-separated framework hints
+  --exclude TEXT        Glob patterns to exclude
+  --max-files INTEGER   Maximum files to analyze
+  --timeout INTEGER     Analysis timeout in seconds
+```
+
+### auth
+
+Authenticate with the APIsec cloud.
+
+```bash
+apisec-code-bolt auth [API_KEY] [OPTIONS]
+
+Options:
+  --check   Check if already authenticated
+  --logout  Remove stored credentials
+```
+
+### answer
+
+Answer verification queries (for air-gapped environments).
+
+```bash
+apisec-code-bolt answer [OPTIONS]
+
+Options:
+  -q, --questions FILE  Input questions file (required)
+  -o, --output FILE     Output answers file
+  -r, --repo PATH       Repository path
+  --timeout INTEGER     Query timeout in seconds
+```
+
+## Architecture
+
+```
+apisec-code-bolt/
+├── cli/                 # Command-line interface
+├── core/                # Types, config, manifest schema
+├── parsing/             # Language-specific parsers
+│   ├── python/          # LibCST-based Python parser
+│   └── jvm/             # Java/Kotlin via subprocess
+├── frameworks/          # Framework plugins
+│   ├── python/          # FastAPI, Flask, Django
+│   └── java/            # Spring Boot, Micronaut
+├── analysis/            # Call graph, data flow
+├── fingerprinting/      # Integration detection
+├── query/               # Query API executor
+└── cloud/               # Cloud communication
+```
+
+## Development
+
+### Setup
+
+```bash
+# Clone and install in development mode
+git clone https://github.com/apisec-inc/apisec-code-bolt.git
+cd apisec-code-bolt
+pip install -e ".[dev]"
+```
+
+### Running Tests
+
+```bash
+pytest
+```
+
+### Type Checking
+
+```bash
+mypy src/apisec_code_bolt
+```
+
+### Linting
+
+```bash
+ruff check src/
+black --check src/
+```
+
+## Privacy
+
+apisec-code-bolt is designed with privacy as a core principle:
+
+- **No raw code egress** — Source code never leaves your environment
+- **Metadata only** — The manifest contains structural information, not code
+- **Outbound only** — Only makes outbound HTTPS calls to upload manifests
+- **Air-gapped support** — Can run completely offline with file-based workflow
+
+## License
+
+Proprietary. Copyright © APIsec.

apisec_code_bolt-0.1.0/README.md

@@ -0,0 +1,184 @@
+# apisec-code-bolt
+
+Static analysis probe for extracting architectural metadata from codebases.
+
+## Overview
+
+apisec-code-bolt analyzes source code to extract:
+
+- **Routes/Endpoints** — HTTP routes, parameters, request/response types
+- **Data Flows** — How data moves from entry points to sinks
+- **Authentication** — Auth schemes, dependencies, role requirements
+- **Integrations** — External services, databases, APIs
+- **Dependencies** — Package dependencies and versions
+
+The output is a structured **manifest** that can be uploaded to the APIsec cloud
+for vulnerability analysis. **Raw source code never leaves your environment.**
+
+## Installation
+
+```bash
+pip install apisec-code-bolt
+```
+
+## Quick Start
+
+```bash
+# Analyze a project and upload to cloud
+apisec-code-bolt analyze /path/to/project
+
+# Analyze and save manifest locally
+apisec-code-bolt analyze . --output manifest.json --no-upload
+
+# With framework hints
+apisec-code-bolt analyze . --frameworks fastapi,sqlalchemy
+```
+
+## Supported Languages & Frameworks
+
+### Currently Supported
+
+| Language | Frameworks |
+|----------|-----------|
+| Python | FastAPI |
+| Java | Spring Boot |
+
+### Planned
+
+| Language | Frameworks |
+|----------|-----------|
+| Python | Flask, Django |
+| Java | Micronaut, Quarkus |
+| Kotlin | Spring Boot, Ktor |
+| JavaScript/TypeScript | Express, NestJS |
+
+## Configuration
+
+Create a `.codebolt.yaml` file in your project root:
+
+```yaml
+analysis:
+  file_discovery:
+    exclude_patterns:
+      - "tests/**"
+      - "**/migrations/**"
+    max_files: 10000
+  
+  data_flow:
+    mode: inter_procedural
+    max_depth: 10
+
+cloud:
+  enabled: true
+  api_url: https://api.apisec.ai
+
+output:
+  format: json
+```
+
+## Commands
+
+### analyze
+
+Analyze a codebase and generate a manifest.
+
+```bash
+apisec-code-bolt analyze [PATH] [OPTIONS]
+
+Options:
+  -o, --output FILE     Save manifest to file
+  --no-upload           Skip uploading to cloud
+  --format [json|yaml]  Output format
+  --config FILE         Path to config file
+  --frameworks TEXT     Comma-separated framework hints
+  --exclude TEXT        Glob patterns to exclude
+  --max-files INTEGER   Maximum files to analyze
+  --timeout INTEGER     Analysis timeout in seconds
+```
+
+### auth
+
+Authenticate with the APIsec cloud.
+
+```bash
+apisec-code-bolt auth [API_KEY] [OPTIONS]
+
+Options:
+  --check   Check if already authenticated
+  --logout  Remove stored credentials
+```
+
+### answer
+
+Answer verification queries (for air-gapped environments).
+
+```bash
+apisec-code-bolt answer [OPTIONS]
+
+Options:
+  -q, --questions FILE  Input questions file (required)
+  -o, --output FILE     Output answers file
+  -r, --repo PATH       Repository path
+  --timeout INTEGER     Query timeout in seconds
+```
+
+## Architecture
+
+```
+apisec-code-bolt/
+├── cli/                 # Command-line interface
+├── core/                # Types, config, manifest schema
+├── parsing/             # Language-specific parsers
+│   ├── python/          # LibCST-based Python parser
+│   └── jvm/             # Java/Kotlin via subprocess
+├── frameworks/          # Framework plugins
+│   ├── python/          # FastAPI, Flask, Django
+│   └── java/            # Spring Boot, Micronaut
+├── analysis/            # Call graph, data flow
+├── fingerprinting/      # Integration detection
+├── query/               # Query API executor
+└── cloud/               # Cloud communication
+```
+
+## Development
+
+### Setup
+
+```bash
+# Clone and install in development mode
+git clone https://github.com/apisec-inc/apisec-code-bolt.git
+cd apisec-code-bolt
+pip install -e ".[dev]"
+```
+
+### Running Tests
+
+```bash
+pytest
+```
+
+### Type Checking
+
+```bash
+mypy src/apisec_code_bolt
+```
+
+### Linting
+
+```bash
+ruff check src/
+black --check src/
+```
+
+## Privacy
+
+apisec-code-bolt is designed with privacy as a core principle:
+
+- **No raw code egress** — Source code never leaves your environment
+- **Metadata only** — The manifest contains structural information, not code
+- **Outbound only** — Only makes outbound HTTPS calls to upload manifests
+- **Air-gapped support** — Can run completely offline with file-based workflow
+
+## License
+
+Proprietary. Copyright © APIsec.

apisec_code_bolt-0.1.0/pyproject.toml

@@ -0,0 +1,150 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "apisec-code-bolt"
+version = "0.1.0"
+description = "Static analysis probe for extracting architectural metadata from codebases"
+readme = "README.md"
+license = {text = "Proprietary"}
+requires-python = ">=3.11"
+authors = [
+    { name = "APIsec", email = "engineering@apisec.ai" }
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Typing :: Typed",
+]
+keywords = ["security", "static-analysis", "api", "vulnerability"]
+
+dependencies = [
+    # Parsing
+    "libcst>=1.1.0",                    # Python CST parsing
+
+    # JVM parsing
+    "javalang>=0.13.0",                  # Pure-Python Java parser
+
+    # C# / .NET parsing
+    "tree-sitter>=0.23",                 # Generic tree-sitter bindings
+    "tree-sitter-c-sharp>=0.23",         # C# grammar for tree-sitter
+
+    # JavaScript / TypeScript parsing
+    "tree-sitter-javascript>=0.23",      # JS grammar for tree-sitter
+    "tree-sitter-typescript>=0.23",      # TypeScript grammar for tree-sitter
+
+    # Graph operations
+    "networkx>=3.2",                    # Call graph, data flow graphs
+    
+    # Data validation and serialization
+    "pydantic>=2.5.0",                  # Schema validation, settings
+    "pydantic-settings>=2.1.0",         # Configuration from env
+    
+    # CLI
+    "click>=8.1.0",                     # CLI framework
+    "rich>=13.7.0",                     # Rich terminal output
+    
+    # HTTP client (for cloud communication only)
+    "httpx>=0.26.0",                    # Async HTTP client
+    
+    # File handling
+    "pathspec>=0.12.0",                 # Gitignore pattern matching
+    "pyyaml>=6.0",                      # YAML configuration
+    
+    # Utilities
+    "typing-extensions>=4.9.0",         # Extended typing support
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4.0",
+    "pytest-cov>=4.1.0",
+    "pytest-asyncio>=0.23.0",
+    "mypy>=1.8.0",
+    "ruff>=0.6",
+]
+
+semgrep = [
+    "semgrep>=1.50.0",                  # Optional: pattern-based analysis
+]
+
+[project.scripts]
+apisec-code-bolt = "apisec_code_bolt.cli.main:cli"
+
+[project.urls]
+Homepage = "https://apisec.ai"
+Documentation = "https://docs.apisec.ai/code-bolt"
+Repository = "https://github.com/apisec-inc/apisec-code-bolt"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/apisec_code_bolt"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "/src",
+    "/tests",
+    "/README.md",
+]
+
+# Include bundled JVM analyzer JAR
+[tool.hatch.build.targets.wheel.shared-data]
+"src/apisec_code_bolt/parsing/jvm/lib" = "apisec_code_bolt/parsing/jvm/lib"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+addopts = "-v --tb=short"
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = true
+disallow_incomplete_defs = true
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+exclude = ["scripts"]
+
+[tool.ruff.lint]
+select = [
+    "E",    # pycodestyle errors
+    "W",    # pycodestyle warnings
+    "F",    # pyflakes
+    "I",    # isort
+    "B",    # flake8-bugbear
+    "C4",   # flake8-comprehensions
+    "UP",   # pyupgrade
+    "ARG",  # flake8-unused-arguments
+    "SIM",  # flake8-simplify
+]
+ignore = [
+    "E501",   # line too long (handled by black)
+    "B008",   # function calls in argument defaults
+    "F821",   # forward-reference string annotations reported as undefined
+    "ARG001", # unused function argument — common in interface/plugin stubs
+    "ARG002", # unused method argument — common in interface/plugin stubs
+    "ARG005", # unused lambda argument
+    "SIM102", # use single if — style opinion, not a bug
+    "SIM103", # return condition directly — style opinion
+]
+
+[tool.ruff.lint.per-file-ignores]
+"**/__init__.py" = ["F401"]  # intentional re-exports
+
+[tool.ruff.lint.isort]
+known-first-party = ["apisec_code_bolt"]
+
+[tool.ruff.format]
+# Ruff's built-in formatter (black-compatible).  Inherits target-version
+# and line-length from [tool.ruff] above, so no duplication needed.

apisec_code_bolt-0.1.0/src/apisec_code_bolt/__init__.py

@@ -0,0 +1,42 @@
+"""
+apisec-code-bolt: Static analysis probe for extracting architectural metadata.
+
+This package provides tools for analyzing codebases to extract architectural
+information (routes, data flows, authentication patterns) without sending
+raw source code outside the customer's environment.
+"""
+
+__version__ = "0.1.0"
+__author__ = "APIsec"
+
+from .core.config import CodeBoltConfig, load_config
+from .core.manifest import Manifest
+from .core.types import (
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    OriginType,
+    QualifiedName,
+)
+
+__all__ = [
+    # Version
+    "__version__",
+    # Types
+    "Language",
+    "Framework",
+    "OriginType",
+    "AuthSchemeType",
+    "HttpMethod",
+    "CodeLocation",
+    "QualifiedName",
+    "Confidence",
+    # Config
+    "CodeBoltConfig",
+    "load_config",
+    # Output
+    "Manifest",
+]

apisec_code_bolt-0.1.0/src/apisec_code_bolt/__main__.py

@@ -0,0 +1,11 @@
+"""
+Entry point for running as a module.
+
+Usage:
+    python -m apisec_code_bolt [COMMAND] [OPTIONS]
+"""
+
+from .cli.main import main
+
+if __name__ == "__main__":
+    main()