compliance-agent 0.1.0__tar.gz

compliance_agent-0.1.0/.gitignore

@@ -0,0 +1,42 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+venv/
+env/
+
+# Environment / secrets
+.env
+.env.*
+
+# Tooling caches
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+coverage.xml
+
+# Editor
+.idea/
+.vscode/
+.DS_Store
+
+# Generated compliance reports
+compliance-report-*.pdf
+compliance-report-*.md
+
+# Runtime artifacts from templates/demos
+ai_logs*/
+oversight_audit.jsonl
+risk_register.json
+dataset_cards*/
+
+# Unrelated sibling checkout (ECC plugin repo)
+ECC/

compliance_agent-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 latreon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

compliance_agent-0.1.0/PKG-INFO

@@ -0,0 +1,541 @@
+Metadata-Version: 2.4
+Name: compliance-agent
+Version: 0.1.0
+Summary: EU AI Act compliance scanner for AI projects
+Author-email: latreon <ferdakerim@gmail.com>
+License: MIT License
+        
+        Copyright (c) 2026 latreon
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: ai,cli,compliance,eu-ai-act,scanner
+Requires-Python: >=3.12
+Requires-Dist: pathspec>=1.1.1
+Requires-Dist: pydantic>=2.13.4
+Requires-Dist: pyyaml>=6.0.3
+Requires-Dist: rich>=15.0.0
+Requires-Dist: typer>=0.26.8
+Requires-Dist: weasyprint>=69.0
+Description-Content-Type: text/markdown
+
+# ComplianceAgent
+
+**Check if your AI project follows EU rules.**
+
+[![CI](https://github.com/latreon/compliance-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/latreon/compliance-agent/actions)
+[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+The EU has new rules for AI. If you're building with OpenAI, Anthropic, LangChain,
+or any AI framework, you need to check whether you comply. This tool does it for
+you — one command, about 5 seconds.
+
+[30-Second Start](#30-second-start) · [What It Does](#what-it-does-simple-version) · [How It Works](#how-it-works) · [Examples](#real-examples) · [All Commands](#command-reference) · [FAQ](#common-questions)
+
+---
+
+## 30-Second Start
+
+```bash
+# Install
+pip install compliance-agent
+
+# Check your project
+compliance-agent scan .
+
+# That's it — read what it found.
+```
+
+## What It Does (Simple Version)
+
+1. **Scans your code** — finds where you use AI (OpenAI, LangChain, etc.).
+2. **Checks the rules** — compares your code against EU AI Act requirements.
+3. **Tells you what's missing** — shows exactly what you need to fix.
+4. **Gives you the code** — provides copy-paste fixes for each problem.
+
+## What You'll See
+
+When you run `compliance-agent scan .`, you get something like:
+
+```text
+YOUR PROJECT STATUS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Risk Level: LIMITED (some rules apply)
+AI Found:   OpenAI chatbot, LangChain agent
+Issues:     3 things to fix
+
+WHAT TO FIX
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+1. Add a "You're talking to AI" notice to your chat
+   → Copy this file: templates/art50/transparency_notice.py
+
+2. Log all AI conversations (EU requires record-keeping)
+   → Copy this file: templates/art12/event_logging.py
+
+3. Add error handling for AI failures
+   → Add try/except blocks around AI calls
+
+NEXT STEPS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Get the fix files:  compliance-agent recommend . --output ./fixes
+```
+
+## Do I Need This?
+
+**Yes, if you:**
+
+- Use OpenAI, Anthropic, Google, or any AI API
+- Build chatbots or AI assistants
+- Use LangChain, CrewAI, AutoGen, or LangGraph
+- Deploy AI in the EU or serve EU users
+- Want to avoid fines (up to €35M)
+
+**No, if you:**
+
+- Don't use AI in your project
+- Only use AI for personal projects (not a business)
+- Don't operate in, or serve users in, the EU
+
+## Installation
+
+### For most users
+
+```bash
+pip install compliance-agent
+```
+
+That's it. Skip to the [30-Second Start](#30-second-start).
+
+**If `pip install` fails**, try:
+
+```bash
+python -m pip install compliance-agent
+```
+
+**If you get "Permission denied":**
+
+```bash
+pip install --user compliance-agent
+```
+
+**If you use a virtual environment**, activate it first:
+
+```bash
+source venv/bin/activate   # Linux / macOS
+venv\Scripts\activate      # Windows
+pip install compliance-agent
+```
+
+**If you use `uv`:**
+
+```bash
+uv pip install compliance-agent
+```
+
+**Install the latest unreleased version from GitHub:**
+
+```bash
+pip install git+https://github.com/latreon/compliance-agent.git
+```
+
+**Verify it worked:**
+
+```bash
+compliance-agent version
+# ComplianceAgent v0.1.0
+```
+
+Trouble installing or running? See the [Troubleshooting guide](docs/TROUBLESHOOTING.md).
+
+## How It Works
+
+### Step 1: Scan your code
+
+The scanner reads your project files and looks for AI-related patterns:
+
+- `import openai` — you're using OpenAI
+- `from langchain` — you're using LangChain
+- `AgentExecutor()` — you're running an AI agent
+- `client.chat.completions.create()` — you're calling an AI API
+
+It uses **AST parsing** (not just text search) to avoid false positives. A comment
+that mentions "OpenAI" won't trigger a finding — only real code does.
+
+### Step 2: Classify risk
+
+Based on what it finds, the tool assigns a risk level:
+
+| Risk Level | What It Means | Rules That Apply |
+|------------|---------------|------------------|
+| **MINIMAL** | Basic AI usage, no user interaction | Almost none |
+| **LIMITED** | AI interacts with users | Transparency rules (Art. 50) |
+| **HIGH** | AI makes important decisions | Full compliance required |
+| **UNACCEPTABLE** | Banned AI practices (Art. 5) | Cannot be deployed |
+
+### Step 3: Check compliance
+
+The tool checks 12 specific articles of the EU AI Act:
+
+| Article | What It Checks | When It Matters |
+|---------|----------------|-----------------|
+| Art. 50 | "You're talking to AI" notice | Any user-facing AI |
+| Art. 12 | Logging AI conversations | All AI systems |
+| Art. 14 | Human oversight for decisions | High-risk / agentic AI |
+| Art. 15 | Error handling and robustness | All AI systems |
+| ... | [see the full list](#compliance-coverage) | ... |
+
+### Step 4: Recommend fixes
+
+For each issue found, the tool:
+
+1. Explains what's wrong
+2. Shows which rule requires the fix
+3. Provides a code template you can copy
+4. Tells you exactly where to put it
+
+```text
+ISSUE: No "You're talking to AI" notice
+RULE:  EU AI Act Article 50(1)
+FIX:   Copy templates/art50/transparency_notice.py into your project
+WHERE: Add it before your chat endpoint
+```
+
+## Real Examples
+
+### Example 1: Simple chatbot (Limited risk)
+
+A basic chatbot using OpenAI:
+
+```python
+# chatbot.py
+import openai
+
+client = openai.OpenAI()
+
+def chat(user_input):
+    return client.chat.completions.create(
+        model="gpt-4",
+        messages=[{"role": "user", "content": user_input}],
+    ).choices[0].message.content
+```
+
+Scan result:
+
+```text
+RISK: LIMITED (Article 50 applies)
+ISSUES: 2
+  1. No "You're talking to AI" notice
+  2. No logging of conversations
+FIX: Add a transparency notice + logging.
+```
+
+### Example 2: LangChain agent (Higher risk)
+
+An agent that can search the web and send emails:
+
+```python
+# agent.py
+from langchain.agents import AgentExecutor
+from langchain.tools import Tool
+
+tools = [
+    Tool(name="search", func=search_web, description="Search the web"),
+    Tool(name="email", func=send_email, description="Send an email"),
+]
+
+executor = AgentExecutor(agent=agent, tools=tools)
+```
+
+Scan result:
+
+```text
+RISK: HIGH (agent with tool access)
+FRAMEWORKS: LangChain (agent, tools)
+ISSUES: 5
+  1. No human oversight before tool use
+  2. No logging of tool calls
+  3. No error handling for API failures
+  4. No "You're talking to AI" notice
+  5. No data governance documentation
+FIX: Add human-in-the-loop, logging, error handling, transparency.
+```
+
+### Example 3: CrewAI multi-agent (High risk)
+
+A crew of agents researching and writing:
+
+```python
+# crew.py
+from crewai import Agent, Task, Crew
+
+researcher = Agent(role="Researcher", tools=[search])
+writer = Agent(role="Writer", tools=[write])
+
+crew = Crew(
+    agents=[researcher, writer],
+    tasks=[Task(description="Research", agent=researcher),
+           Task(description="Write", agent=writer)],
+)
+crew.kickoff()
+```
+
+Scan result:
+
+```text
+RISK: HIGH (multiple autonomous agents)
+FRAMEWORKS: CrewAI (agent, crew, task)
+ISSUES: 4
+  1. No oversight before crew execution
+  2. No logging of agent actions
+  3. No documentation of agent roles
+  4. No incident reporting procedure
+FIX: Add an approval workflow, logging, documentation, incident plan.
+```
+
+## Command Reference
+
+```bash
+# Scan a folder ('.' = current folder)
+compliance-agent scan .
+
+# Output types
+compliance-agent scan . --format markdown   # for reading (default)
+compliance-agent scan . --format json       # for computers / CI
+compliance-agent scan . --format pdf         # for sharing
+
+# Only show serious issues
+compliance-agent scan . --severity high
+
+# Skip folders
+compliance-agent scan . --exclude "tests/*" --exclude "docs/*"
+
+# Show how to fix each problem
+compliance-agent scan . --fix
+
+# Copy fix templates into your project
+compliance-agent recommend . --output ./fixes
+
+# Make a shareable report file
+compliance-agent report . --output audit-2026.pdf
+
+# For CI/CD: plain output, fail the build on serious issues
+compliance-agent scan . --ci --fail-on high
+```
+
+Run `compliance-agent scan --help` to see every option explained.
+
+**Exit codes:** `0` success · `1` `--fail-on` threshold met · `2` usage error.
+`.gitignore` is honored automatically, and vendored directories are always skipped.
+
+JSON output is a versioned envelope — safe to parse in CI:
+
+```json
+{
+  "schema_version": "1.0",
+  "tool_version": "0.1.0",
+  "scan_result": { "files_scanned": 2, "risk_tier": "limited", "findings": ["..."] }
+}
+```
+
+## What It Detects
+
+**AI providers**
+
+- OpenAI (GPT-4, GPT-4o, o1)
+- Anthropic (Claude)
+- Google (Gemini)
+- Mistral
+- Local models (Ollama, vLLM, transformers, llama.cpp, torch)
+
+**Agent patterns**
+
+- MCP servers and tool definitions
+- Tool calls and function calling
+- Multi-agent orchestration (CrewAI, AutoGen, LangGraph)
+- Prompt templates and system prompts
+
+### Framework-aware detection
+
+Beyond generic provider detection, dedicated detectors understand what each
+framework construct means for compliance (only in files that actually import the
+framework — AST-verified):
+
+| Framework | Detection | Compliance Mapping |
+|-----------|-----------|--------------------|
+| LangChain | Agents, tools, memory, chains | Art. 14 (oversight), Art. 9 (risk), Art. 12 (logging), Art. 50 (transparency) |
+| CrewAI | Crews, agents, tasks, processes | Art. 14 (oversight), Art. 12 (logging), Art. 11 (docs) |
+| AutoGen | Agents, group chat, function/code execution | Art. 50 (transparency), Art. 12 (logging), Art. 9 (risk) |
+| LangGraph | State graphs, conditional edges, tool nodes, checkpoints | Art. 12 (logging), Art. 11 (docs), Art. 14 (oversight) |
+
+## Compliance Coverage
+
+ComplianceAgent checks the following EU AI Act articles and reports a per-article
+status (Met / Partial / Missing / Not applicable):
+
+| Article | Title | When Applicable |
+|---------|-------|-----------------|
+| 6 | High-risk definition | High-risk tier |
+| 7 | Conformity assessment | High-risk tier |
+| 9 | Risk management | High-risk tier |
+| 10 | Data governance | Data processing or high-risk tier |
+| 11 | Technical documentation | Any AI usage |
+| 12 | Record-keeping | Any AI usage |
+| 13 | Transparency to deployers | User-facing systems |
+| 14 | Human oversight | Agentic patterns or high-risk tier |
+| 15 | Accuracy, robustness, cybersecurity | Any AI usage |
+| 26 | Provider obligations | High-risk tier |
+| 28 | Distributor obligations | Deployment artifacts present |
+| 50 | User transparency | User-facing AI |
+
+## Fix Templates
+
+ComplianceAgent doesn't just find problems — it ships solutions. Every gap maps to
+a real, copy-pasteable template ([index](templates/README.md)):
+
+| Article | Template | Purpose |
+|---------|----------|---------|
+| 50 | `transparency_notice.py` | AI interaction disclosure (decorator + ASGI middleware) |
+| 50 | `content_marking.py` | Machine-readable AI content marking |
+| 50 | `deepfake_disclosure.py` | Synthetic media labeling |
+| 12 | `event_logging.py` | AI event logging with retention + cleanup |
+| 14 | `human_oversight.py` | Human-in-the-loop checkpoints with audit trail |
+| 9 | `risk_management.py` | Risk register and review cycle |
+| 10 | `data_governance.py` | Dataset provenance cards |
+| 11 | `technical_documentation.py` | Annex IV technical documentation generator |
+
+Each template is fully working Python (compile-checked in CI), well-commented, and
+framework-agnostic (FastAPI, Flask, Streamlit).
+
+## PDF Reports
+
+Generate an audit-ready PDF for compliance teams, legal, or auditors:
+
+```bash
+compliance-agent scan . --format pdf
+# Report saved to: compliance-report-myproject.pdf
+
+# Or the dedicated report command (PDF or Markdown, custom path)
+compliance-agent report . --output audit-2026.pdf
+```
+
+The PDF includes a cover page, an executive summary with a risk-tier badge and
+metrics, a risk assessment with deadlines, a color-coded findings table, compliance
+gaps with remediation steps, fix recommendations with code snippets, and an EU AI
+Act reference appendix.
+
+> PDF generation uses [WeasyPrint](https://weasyprint.org/), which needs the pango
+> native libraries: `brew install pango` (macOS — run with
+> `DYLD_FALLBACK_LIBRARY_PATH=/opt/homebrew/lib` if needed) or
+> `apt install libpango-1.0-0 libpangoft2-1.0-0` (Debian/Ubuntu). Markdown and JSON
+> formats work without it.
+
+## CI/CD Integration
+
+**GitHub Actions**
+
+```yaml
+- name: EU AI Act Compliance Check
+  run: |
+    pip install compliance-agent
+    compliance-agent scan . --ci --fail-on high
+```
+
+**Pre-commit hook**
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/latreon/compliance-agent
+    rev: v0.1.0
+    hooks:
+      - id: compliance-agent-scan
+        args: [--fail-on, high]
+```
+
+## Common Questions
+
+**Is this legal advice?**
+No. It's a technical tool that checks your code. Consult a lawyer for legal advice.
+
+**Will this slow down my CI/CD?**
+No. It takes about 5 seconds on most projects.
+
+**What if I'm not in the EU?**
+If you serve EU users, you still need to comply. The EU AI Act applies to anyone
+providing AI to EU residents.
+
+**What if I find issues?**
+The tool gives you exact code fixes. Copy the templates into your project and
+re-run the scan.
+
+**Can I use this in production?**
+Yes. Add it to your CI/CD pipeline to catch issues automatically.
+
+## Troubleshooting
+
+Common problems and fixes are in the [Troubleshooting guide](docs/TROUBLESHOOTING.md).
+Quick hits:
+
+- **`command not found: compliance-agent`** → run `python -m compliance_agent scan .`
+- **PDF generation fails** → `brew install pango` (macOS), or just use
+  `--format markdown` / `--format json`
+- **Too many findings** → `--exclude "tests/*"` or `--severity high`
+
+## Development
+
+```bash
+git clone https://github.com/latreon/compliance-agent.git
+cd compliance-agent
+uv sync
+uv run pytest                     # tests with coverage
+uv run compliance-agent scan .    # dogfood: scan this repo
+```
+
+## Contributing
+
+Contributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+Priority areas:
+
+- New detector patterns (LlamaIndex, Haystack)
+- Additional templates for other articles
+- Integration with more AI frameworks
+- Documentation improvements
+
+## Roadmap
+
+- [ ] PyPI release + GitHub Action on the Marketplace
+- [ ] Project config file (`compliance.yaml`) for declared posture and scan defaults
+- [ ] SARIF output for GitHub code scanning integration
+- [ ] JS/TS project scanning
+
+## Resources
+
+- [EU AI Act (Regulation (EU) 2024/1689) — full text](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
+- [EU AI Act explorer](https://artificialintelligenceact.eu/)
+
+## License
+
+MIT License — see [LICENSE](LICENSE).
+
+## Disclaimer
+
+This tool provides technical analysis, not legal advice. Consult qualified legal
+counsel for EU AI Act compliance decisions.