grey-panda 1.0.0__tar.gz

grey_panda-1.0.0/.gitignore

@@ -0,0 +1,33 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+*.egg
+
+# Virtual envs
+.venv/
+venv/
+env/
+
+# Tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.coverage
+htmlcov/
+
+# Grey Panda outputs
+grey-panda.sarif
+grey_panda_report.md
+findings.json
+*.greypanda.local.toml
+
+# OS / editor
+.DS_Store
+.idea/
+.vscode/
+*.swp

grey_panda-1.0.0/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to Grey Panda are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] — 2026-09-29
+
+The first public release. 🐼
+
+### Added
+- **Five module kits** — the bundle is organised into audience-facing kits
+  (Developer, Security Reviewer, Scanner & CI/CD, MCP & Agent Security, Standards &
+  Governance), each with its own friendly README and how-to guides, all powered by
+  one shared zero-dependency engine.
+- **Scanner** (`gp scan`) — **26 high-precision rules** for AI, agent, and MCP risks,
+  each citing an OWASP ID, with false-positive suppress guards and per-line /
+  per-file ignores. Outputs **Markdown**, **JSON**, and **SARIF 2.1.0** (renders
+  inline in VS Code + GitHub code scanning).
+- **SDK** (zero dependencies) — `PromptGuardrail`, `OutputGuardrail`, `DLPScanner`,
+  `SecureContextBuilder`, `AgentSecurityWrapper` (Rule of Two, HITL, kill switch,
+  call budgets), `AuditLogger`, plus **MCP** controls (`McpToolManifest`,
+  `McpServerGuard` — manifest pinning/hashing, rug-pull detection, schema/scope/origin
+  checks) and **ACS** controls (`Guardian` with five dispositions, `agent_bill_of_materials`).
+- **MCP server** (`gp mcp`) — Grey Panda ships as an MCP server (JSON-RPC over stdio)
+  so any MCP-capable IDE can call `scan`, `review_snippet`, `explain_risk`,
+  `list_standards`, and `checklist`.
+- **AISVS verification** (`gp verify`) — check a codebase against AISVS Level 1/2/3
+  and produce a signable report.
+- **Standards knowledge pack** — machine-readable JSON for OWASP LLM Top 10 2026,
+  GenAI Data Security, Agentic Apps Top 10, AISVS (C1–C12), MCP security, and the
+  Agent Control Standard; the single source of truth for scanner, verify, MCP, and skill.
+- **Integrations & governance** — Claude Code/Cursor skill, GitHub Action (SARIF +
+  PR comment + gate), pre-commit hooks, AppSec Reviewer Guide, and an OWASP Threat
+  Dragon template.
+- **Profiles** — `solo`, `team`, `enterprise`: same safety floor, scaled process.
+- **Docs** — README, Quickstart, Profiles, Architecture, standards mappings, and the
+  signature **What It Can and Cannot Do** honesty document.
+- **Examples** — `vulnerable_app` (flagged) vs `secure_app` (clean) and a full SDK tour.
+- **Tests** — 76 zero-dependency `unittest` tests; Grey Panda scans its own repo clean in CI.
+
+[1.0.0]: https://github.com/dibakshya01/grey-panda/releases/tag/v1.0.0

grey_panda-1.0.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but not
+      limited to compiled object code, generated documentation, and
+      conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and do
+          not modify the License. You may add Your own attribution notices
+          within Derivative Works that You distribute, alongside or as an
+          addendum to the NOTICE text from the Work, provided that such
+          additional attribution notices cannot be construed as modifying
+          the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions for
+      use, reproduction, or distribution of Your modifications, or for any
+      such Derivative Works as a whole, provided Your use, reproduction,
+      and distribution of the Work otherwise complies with the conditions
+      stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Grey Panda contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

grey_panda-1.0.0/Module 1 - Developer Kit/HOW-TO-add-guardrails.md

@@ -0,0 +1,91 @@
+# How to add Grey Panda guardrails to an existing LLM call
+
+**Time:** ~2 minutes. **Rule:** you never rewrite your LLM call — you wrap it.
+
+## The idea: a 7-step pipeline
+
+```
+1. PromptGuardrail.assert_safe()   # block injection, strip invisible Unicode, size cap
+2. DLPScanner.redact()             # remove PII + secrets before the model sees input
+3. SecureContextBuilder            # tag trust per segment, enforce a size budget
+4. (your LLM call)                 # unchanged
+5. DLPScanner.redact()             # scan the response for leaked PII
+6. OutputGuardrail.sanitize()      # block exfil image URLs / unsafe HTML
+7. AuditLogger                     # structured event, zero raw text, SIEM-ready
+```
+
+## Step by step
+
+### 1–2. Screen and redact the input
+```python
+from greypanda import PromptGuardrail, DLPScanner
+
+guard = PromptGuardrail()          # add extra_patterns=[...] for your domain
+dlp   = DLPScanner()               # categories=["pii","secrets"] by default
+
+safe  = guard.assert_safe(user_input)   # raises ValueError on a known injection
+clean = dlp.redact(safe, context="chat_input")
+```
+> `assert_safe` raises in strict mode. For a monitor-only rollout, use
+> `PromptGuardrail(strict=False)` and inspect `guard.check(text).violations`.
+
+### 3. Build context with trust tags
+```python
+from greypanda import SecureContextBuilder
+
+messages = (
+    SecureContextBuilder(user_id=user_id, max_tokens=8000)
+    .add_system("You are a helpful assistant.")
+    .add_rag_chunk(doc_text, source="kb")             # wrapped as untrusted data
+    .add_external_content(web_text, source="web")     # wrapped as untrusted data
+    .add_user(clean)
+    .build()                                          # OpenAI-format messages list
+)
+```
+
+### 4. Your call — unchanged
+```python
+reply = your_client.chat(messages=messages, max_tokens=512)   # keep an output cap
+```
+
+### 5–6. Clean the output
+```python
+from greypanda import OutputGuardrail
+
+reply = dlp.redact(reply, context="chat_output")
+out   = OutputGuardrail(allowed_url_domains=["yourcdn.example"])
+answer = out.sanitize(reply).sanitized_text
+```
+
+### 7. Audit without leaking
+```python
+from greypanda import AuditLogger
+
+audit = AuditLogger(agent_id="support-bot", session_id=session_id)
+audit.log_prompt_check(user_id, passed=True, metadata={"tokens": len(messages)})
+audit.log_output_check(user_id, passed=out.sanitize(reply).passed)
+```
+`AuditLogger` emits single-line JSON via the standard `logging` module under
+`greypanda.ai.audit` (or `<org>.ai.audit`) — point your SIEM at it. It **never**
+logs raw prompt/response text.
+
+## Customising for your domain
+- **Injection:** `PromptGuardrail(extra_patterns=[r"your-domain-attack"])`
+- **DLP:** enable regional packs (`DLPScanner(categories=["pii","secrets","regional_in"])`)
+  or add your ID formats via `custom_patterns={"org_pii": [("customer_id", r"CUST-\d{8}")]}`.
+- **Output:** set `allowed_url_domains` to your real CDN/domains.
+
+## Verify it worked
+Run the scanner on your file — the SDK forms are recognised and pass cleanly:
+```bash
+gp scan path/to/your_file.py
+```
+See the full runnable version in [`/examples/example_usage.py`](../examples/example_usage.py)
+and the before/after in [`/examples/secure_app/app.py`](../examples/secure_app/app.py).
+
+## What this does not do
+Guardrails are a **strong first layer**, not a guarantee. They cannot stop novel or
+paraphrased injection, and DLP regex is language-specific. Pair them with the agent
+controls ([Module 4](../Module%204%20-%20MCP%20and%20Agent%20Security%20Kit)) and a
+review ([Module 2](../Module%202%20-%20Security%20Reviewer%20Kit)) for anything
+high-stakes. Full honesty: [WHAT_IT_CAN_AND_CANNOT_DO](../Module%205%20-%20Standards%20and%20Governance%20Kit/WHAT_IT_CAN_AND_CANNOT_DO.md).

grey_panda-1.0.0/Module 1 - Developer Kit/HOW-TO-use-in-your-ide.md

@@ -0,0 +1,64 @@
+# How to use Grey Panda inside your IDE
+
+Grey Panda meets you where you code, three ways: **inline findings (SARIF)**, an
+**MCP server** your AI assistant can call, and a **skill** that turns that assistant
+into an AI Security Advisor.
+
+## 1. Inline findings in VS Code (SARIF)
+
+Grey Panda emits SARIF 2.1.0, which VS Code and GitHub render right on the offending
+line — no plugin needed beyond the SARIF viewer.
+
+```bash
+gp scan . --format sarif --output grey-panda.sarif
+```
+
+- **VS Code:** install the "SARIF Viewer" extension, then open `grey-panda.sarif`.
+- **GitHub:** the [CI workflow](../Module%203%20-%20Scanner%20and%20CI-CD%20Kit/HOW-TO-add-to-ci.md)
+  uploads SARIF to code scanning, so findings appear inline in the PR diff.
+
+## 2. Grey Panda as an MCP server
+
+Grey Panda ships **as** a Model Context Protocol server, so any MCP-capable client
+(Claude Code, Cursor, Windsurf, VS Code) can call it while you work.
+
+Register it once:
+```jsonc
+// Claude Code / Cursor / Windsurf MCP config
+{
+  "mcpServers": {
+    "grey-panda": { "command": "gp", "args": ["mcp"] }
+  }
+}
+```
+
+Now you can ask your assistant things like:
+- *"Review this file with grey panda."* → calls `greypanda_review_snippet`
+- *"Scan the repo for AI security issues."* → `greypanda_scan_path`
+- *"Explain LLM03."* → `greypanda_explain_risk`
+- *"Show me the AI security checklist."* → `greypanda_checklist`
+
+Tools exposed: `greypanda_scan_path`, `greypanda_review_snippet`,
+`greypanda_explain_risk`, `greypanda_list_standards`, `greypanda_checklist`.
+
+Full details: [Module 4 → HOW-TO-run-the-mcp-server](../Module%204%20-%20MCP%20and%20Agent%20Security%20Kit/HOW-TO-run-the-mcp-server.md).
+
+## 3. The AI Security Advisor skill
+
+The [`skill/SKILL.md`](../skill/SKILL.md) file turns Claude Code / Cursor into an AI
+Security Advisor scoped to Grey Panda's standards and remediations.
+
+Install it (Claude Code):
+```bash
+mkdir -p .claude/skills/grey-panda
+cp skill/SKILL.md .claude/skills/grey-panda/SKILL.md
+```
+Then invoke `/grey-panda` (or `/aisec`) and paste code, or let it scan the current
+file. If the MCP server is also registered, the skill uses it for ground-truth
+findings and then explains + prioritises them.
+
+## What this does not do
+The IDE integration surfaces Grey Panda's **static** findings and advice — it does
+not run your code or observe runtime behaviour, and it inherits every limit in
+[WHAT_IT_CAN_AND_CANNOT_DO](../Module%205%20-%20Standards%20and%20Governance%20Kit/WHAT_IT_CAN_AND_CANNOT_DO.md).
+Treat AI-assistant suggestions as input to your judgment, not a verdict.

grey_panda-1.0.0/Module 1 - Developer Kit/PROFILES.md

@@ -0,0 +1,53 @@
+# Profiles: Solo, Team, Enterprise
+
+Grey Panda gives **everyone the same safety floor** and lets the **profile scale the
+process, not the safety**. A solo developer isn't drowned in process; an enterprise
+gets the full gate. Pick a profile with `--profile` (default: `team`).
+
+| Profile | For | Active rules | Fails build on |
+|---|---|---|---|
+| `solo` | Indie / solo developers, prototypes, hackathons | High-signal core (CRITICAL + key HIGH) | **CRITICAL** |
+| `team` | Startups, product teams | + DLP-before-call, RAG isolation, logging, MCP, shadow-AI | **HIGH** |
+| `enterprise` | Regulated / large orgs | Every rule, incl. cost/consumption + memory-poisoning + AISVS L1/L2/L3 | **HIGH** |
+
+## Solo
+```bash
+gp scan . --profile solo
+```
+Quiet and precise. Only the rules a single developer must not ship without. No CI,
+no reviewer process required — though `gp init --profile solo` still gives you a
+one-file GitHub Action if you want it.
+
+## Team
+```bash
+gp init . --profile team      # config + GitHub Action + pre-commit
+gp scan . --profile team
+```
+Adds the controls a team sharing a codebase needs: DLP before model calls, RAG
+per-user isolation, no-raw-logging, MCP tool checks, and shadow-AI detection. The
+gate fails on HIGH so risky code doesn't merge.
+
+## Enterprise
+```bash
+gp scan   . --profile enterprise
+gp verify . --level 2
+```
+Everything on, including MEDIUM cost/consumption and agent-memory checks, plus the
+AppSec reviewer workflow and AISVS verification. Pair with the
+[AppSec Reviewer Guide](../Module%202%20-%20Security%20Reviewer%20Kit/APPSEC_REVIEWER_GUIDE.md).
+
+## Configuring
+`gp init` writes a `.greypanda.toml` you can commit:
+```toml
+[greypanda]
+profile = "team"
+fail_on = "HIGH"
+paths = ["."]
+```
+
+## Customising rules for your domain
+- **DLP:** enable regional packs (`regional_in`, `regional_eu`) or add your customer/
+  order/seller ID formats via `custom_patterns` (see `dlp.py`).
+- **Injection:** pass `extra_patterns` to `PromptGuardrail` for domain-specific attacks.
+- **Scanner:** add a `Rule` to `src/greypanda/scanner/rules.py` (see [CONTRIBUTING](../CONTRIBUTING.md)).
+- **Gateway allowlist:** add your AI gateway domain so `GP-AI-013` stops flagging it.

grey_panda-1.0.0/Module 1 - Developer Kit/QUICKSTART.md

@@ -0,0 +1,79 @@
+# Quick Start
+
+Two five-minute paths: one for **developers**, one for **security reviewers**.
+
+## For developers
+
+### 1. Install
+```bash
+pip install grey-panda      # or: pipx install grey-panda / uvx grey-panda
+```
+
+### 2. Scan your repo
+```bash
+gp scan .                   # Markdown report to your terminal
+gp scan . --format sarif -o grey-panda.sarif   # for VS Code / GitHub code scanning
+```
+
+### 3. Add drop-in guardrails (under 2 minutes)
+```python
+from greypanda import PromptGuardrail, DLPScanner, OutputGuardrail
+
+guard, dlp, out = PromptGuardrail(), DLPScanner(), OutputGuardrail()
+
+safe   = guard.assert_safe(user_input)        # block injection, strip invisible Unicode
+clean  = dlp.redact(safe)                       # redact PII & secrets
+reply  = call_your_llm(clean)                   # your existing call — unchanged
+answer = out.sanitize(reply).sanitized_text     # neutralise exfil URLs / unsafe HTML
+```
+
+### 4. Wire it into your IDE (MCP)
+```jsonc
+{ "mcpServers": { "grey-panda": { "command": "gp", "args": ["mcp"] } } }
+```
+Now your AI assistant can `review this file with grey panda` or `explain LLM03`.
+
+### 5. Gate your CI
+```bash
+gp init .                   # writes .github/workflows/grey-panda.yml + config + pre-commit
+```
+
+### 6. Complete the checklist
+```bash
+gp checklist > SECURITY_CHECKLIST.md
+```
+
+---
+
+## For security reviewers
+
+### 1. Get the artifact
+Pull the JSON/SARIF report from CI, or run it yourself:
+```bash
+gp scan <service_dir> --profile enterprise --format json -o findings.json
+```
+
+### 2. Run AISVS verification
+```bash
+gp verify <service_dir> --level 2 -o aisvs-l2.md
+```
+
+### 3. Follow the reviewer guide
+See the [AppSec Reviewer Guide](../Module%202%20-%20Security%20Reviewer%20Kit/APPSEC_REVIEWER_GUIDE.md): scanner review → manual threat-model review → utility checks (injection battery, RAG isolation, DLP output) → OWASP Threat Dragon model → sign-off.
+
+### 4. Import the threat model
+Load the [threat-model template](../Module%202%20-%20Security%20Reviewer%20Kit/threat-models/sample-agentic-system.json) into OWASP Threat Dragon and adapt it to the feature's real architecture.
+
+### 5. Sign off
+Use the sign-off template in the reviewer guide. Any 🔴 Critical blocks the release.
+
+---
+
+## Retrospective scan of an existing service
+```bash
+gp scan ./services/payments --profile enterprise --format markdown
+gp scan ./services/payments --profile enterprise --format json -o payments.json
+```
+
+## Honest limits
+Before you rely on any of this, read [WHAT_IT_CAN_AND_CANNOT_DO.md](../Module%205%20-%20Standards%20and%20Governance%20Kit/WHAT_IT_CAN_AND_CANNOT_DO.md).

grey_panda-1.0.0/Module 1 - Developer Kit/README.md

@@ -0,0 +1,73 @@
+# 🧰 Module 1 — Developer Kit
+
+> **For:** developers building anything with an LLM, an agent, or MCP.
+> **Goal:** make the secure choice the *frictionless* choice. You should be able to
+> add real protection to an existing LLM call in **under two minutes** — without
+> rewriting the call.
+
+This is the kit you reach for first. It gives you the **drop-in SDK** (runtime
+guardrails), the **scanner** for your own code, and the **IDE integration** so your
+AI assistant reviews security as you type.
+
+---
+
+## What's in this kit
+
+| Piece | What it does | Where |
+|---|---|---|
+| **The SDK** | Drop-in runtime controls: input/output guardrails, DLP, secure context, agent security, audit | `import greypanda` |
+| **The scanner** | Finds AI/agent/MCP issues in your code (`gp scan`) | see [Module 3](../Module%203%20-%20Scanner%20and%20CI-CD%20Kit) |
+| **IDE / AI integration** | Grey Panda as an MCP server + a Claude/Cursor skill | [HOW-TO-use-in-your-ide.md](HOW-TO-use-in-your-ide.md) |
+| **Quickstart & Profiles** | Get running in 60 seconds; pick your rigor level | [QUICKSTART.md](QUICKSTART.md) · [PROFILES.md](PROFILES.md) |
+| **Runnable examples** | `vulnerable_app` (flagged) vs `secure_app` (clean) + a full SDK tour | [`/examples`](../examples) |
+
+## The 60-second version
+
+```bash
+pip install grey-panda
+gp scan .                       # scan your repo
+```
+
+```python
+from greypanda import PromptGuardrail, DLPScanner, OutputGuardrail
+
+guard, dlp, out = PromptGuardrail(), DLPScanner(), OutputGuardrail()
+
+safe   = guard.assert_safe(user_input)        # block known injection + strip invisible Unicode
+clean  = dlp.redact(safe)                       # remove PII & secrets before the model sees them
+reply  = call_your_llm(clean)                   # ← your existing call, unchanged
+answer = out.sanitize(reply).sanitized_text     # block data-exfil URLs & unsafe HTML
+```
+
+## The SDK at a glance
+
+| Control | Import | Protects against |
+|---|---|---|
+| `PromptGuardrail` | `from greypanda import PromptGuardrail` | Prompt injection, invisible-Unicode smuggling (`LLM01`) |
+| `DLPScanner` | `from greypanda import DLPScanner` | PII & secret leakage (`LLM02`, `DSGAI01`) |
+| `OutputGuardrail` | `from greypanda import OutputGuardrail` | XSS / data-exfil via model output (`LLM10`, `LLM02`) |
+| `SecureContextBuilder` | `from greypanda import SecureContextBuilder` | Indirect injection, cross-user bleed (`LLM01`, `LLM09`) |
+| `AgentSecurityWrapper` | `from greypanda import AgentSecurityWrapper` | Excessive agency, lethal trifecta (`LLM03`) → see [Module 4](../Module%204%20-%20MCP%20and%20Agent%20Security%20Kit) |
+| `AuditLogger` | `from greypanda import AuditLogger` | Telemetry leakage (`DSGAI14`) |
+
+Full walkthroughs:
+- **[HOW-TO-add-guardrails.md](HOW-TO-add-guardrails.md)** — wire the 7-step pipeline into a real request.
+- **[HOW-TO-use-in-your-ide.md](HOW-TO-use-in-your-ide.md)** — Grey Panda in Claude Code / Cursor / VS Code.
+
+## ✅ What this kit can do — and ❌ what it can't
+
+**Can:** block *known* injection patterns cheaply at the edge; redact structured PII
+and known secret shapes; keep instructions and untrusted data structurally
+separate; give you an auditable, SIEM-ready event stream — all with **zero runtime
+dependencies**.
+
+**Cannot:** stop *all* prompt injection, catch paraphrased/novel attacks, or
+understand meaning. Regex DLP is language-specific. Treat this as the **first layer
+of defense in depth**, never as "injection-proof." The complete, honest breakdown
+(with confidence levels per capability) is in
+**[Module 5 → WHAT_IT_CAN_AND_CANNOT_DO](../Module%205%20-%20Standards%20and%20Governance%20Kit/WHAT_IT_CAN_AND_CANNOT_DO.md)**.
+
+## Where to go next
+- Shipping an agent or MCP server? → **[Module 4 — MCP & Agent Security Kit](../Module%204%20-%20MCP%20and%20Agent%20Security%20Kit)**
+- Want a CI gate? → **[Module 3 — Scanner & CI/CD Kit](../Module%203%20-%20Scanner%20and%20CI-CD%20Kit)**
+- Getting reviewed by security? → **[Module 2 — Security Reviewer Kit](../Module%202%20-%20Security%20Reviewer%20Kit)**