owasp-audit-agent 0.1.0__tar.gz

owasp_audit_agent-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rio Nelson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

owasp_audit_agent-0.1.0/PKG-INFO

@@ -0,0 +1,236 @@
+Metadata-Version: 2.4
+Name: owasp-audit-agent
+Version: 0.1.0
+Summary: Agentic AI framework untuk audit keamanan kode Python berbasis OWASP Top 10 (2025).
+Author-email: Rio Nelson <rionelson1802@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/rionelson/owasp-audit-agent
+Project-URL: Repository, https://github.com/rionelson/owasp-audit-agent
+Keywords: owasp,security,static-analysis,sast,langgraph,agent,audit
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: langgraph<2,>=1.2
+Requires-Dist: langchain-groq<2,>=1.1
+Requires-Dist: pydantic<3,>=2.10
+Requires-Dist: python-dotenv>=1.0
+Requires-Dist: fpdf2>=2.8
+Requires-Dist: tomli>=2.0; python_version < "3.11"
+Provides-Extra: ui
+Requires-Dist: streamlit>=1.50; extra == "ui"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Provides-Extra: openai
+Requires-Dist: langchain-openai>=0.2; extra == "openai"
+Provides-Extra: anthropic
+Requires-Dist: langchain-anthropic>=0.2; extra == "anthropic"
+Provides-Extra: google
+Requires-Dist: langchain-google-genai>=2.0; extra == "google"
+Provides-Extra: ollama
+Requires-Dist: langchain-ollama>=0.2; extra == "ollama"
+Dynamic: license-file
+
+# owasp-audit-agent
+
+Framework *agentic AI* untuk audit keamanan kode Python berbasis **OWASP Top 10 (2025)**.
+Menganalisis kode sumber, mendeteksi kerentanan di 10 kategori OWASP, menghasilkan
+ringkasan eksekutif dari LLM, mencoba memperbaiki secara otomatis, lalu memverifikasi ulang.
+
+Orkestrasi dibangun di atas **LangGraph**; deteksi memakai *checker* modular yang
+ditemukan secara otomatis sehingga menambah aturan baru tidak menyentuh kode inti.
+
+## Instalasi
+
+```bash
+pip install -e .            # library + CLI
+pip install -e ".[ui]"      # + UI Streamlit
+pip install -e ".[dev]"     # + pytest
+```
+
+Buat file `.env` berisi kredensial LLM:
+
+```
+GROQ_API_KEY=your_key_here
+```
+
+## Pemakaian sebagai library
+
+```python
+from agent import audit_code
+
+result = audit_code(open("app.py").read(), "app.py")
+
+for f in result["findings"]:
+    print(f.severity.value, f.owasp_category.value, f.title, f.line_number)
+
+print(result["summary"])
+```
+
+## CLI
+
+```bash
+owasp-audit app.py               # audit satu file
+owasp-audit app.py --json        # keluaran JSON
+owasp-audit --list-checkers      # daftar checker terdaftar
+```
+
+## UI (Streamlit)
+
+```bash
+streamlit run app.py
+```
+
+## Konfigurasi
+
+Perilaku audit diatur lewat file `audit.toml` di root project (opsional) dan/atau
+environment variable. Salin `audit.example.toml` menjadi `audit.toml` lalu sesuaikan:
+
+```toml
+[llm]
+provider = "groq"
+model = "llama-3.1-8b-instant"
+temperature = 0.0
+
+[audit]
+escalation_threshold = 3      # eskalasi jika jumlah CRITICAL > nilai ini
+max_fix_iterations = 2
+auto_fix = true
+
+[checkers]
+enabled = []                  # kosong = semua; mis. ["A01","A05","A07"]
+disabled = ["A09"]            # kode kategori yang dimatikan
+```
+
+Env var menimpa file (berguna untuk CI): `OWASP_LLM_MODEL`,
+`OWASP_ESCALATION_THRESHOLD`, `OWASP_MAX_FIX_ITERATIONS`, `OWASP_AUTO_FIX`,
+`OWASP_ENABLED_CHECKERS`, `OWASP_DISABLED_CHECKERS`, `OWASP_CONFIG` (path file config).
+
+Dari kode, config bisa dimuat manual:
+
+```python
+from agent import AuditConfig
+cfg = AuditConfig.load()          # audit.toml + env
+print(cfg.escalation_threshold, cfg.llm_model, cfg.is_checker_enabled("A05"))
+```
+
+## Provider LLM
+
+Provider dipilih lewat `[llm] provider` di `audit.toml` (atau env `OWASP_LLM_PROVIDER`).
+Built-in: `groq` (default, sudah termasuk), `openai`, `anthropic`, `google`, `ollama`.
+Paket integrasi di-import lazy — install hanya yang dipakai:
+
+```bash
+pip install -e ".[openai]"      # atau .[anthropic] / .[google] / .[ollama]
+```
+
+```toml
+[llm]
+provider = "openai"
+model = "gpt-4o-mini"
+# base_url = "http://localhost:11434"   # untuk Ollama / endpoint OpenAI-compatible
+```
+
+API key dibaca dari env sesuai provider (`GROQ_API_KEY`, `OPENAI_API_KEY`,
+`ANTHROPIC_API_KEY`, dst). Menambah provider kustom:
+
+```python
+from agent import register_provider
+
+@register_provider("myllm")
+def _build(config):
+    from my_pkg import MyChat
+    return MyChat(model=config.llm_model, temperature=config.llm_temperature)
+```
+
+Lalu set `provider = "myllm"` di config.
+
+## Kategori OWASP yang dicakup
+
+| Kode | Kategori |
+|------|----------|
+| A01 | Broken Access Control |
+| A02 | Security Misconfiguration |
+| A03 | Software Supply Chain Failures |
+| A04 | Cryptographic Failures |
+| A05 | Injection |
+| A06 | Insecure Design |
+| A07 | Authentication Failures |
+| A08 | Software or Data Integrity Failures |
+| A09 | Security Logging and Alerting Failures |
+| A10 | Mishandling of Exceptional Conditions |
+
+## Menulis checker baru
+
+Buat subclass `BaseChecker` dan implementasi `category`, `name`, dan `analyze()`:
+
+```python
+# agent/tools/my_checker.py
+from typing import List
+from agent.base_checker import BaseChecker
+from agent.models import Finding, OWASPCategory, SeverityLevel
+
+class MyChecker(BaseChecker):
+    @property
+    def category(self) -> OWASPCategory:
+        return OWASPCategory.A05
+
+    @property
+    def name(self) -> str:
+        return "My Custom Checker"
+
+    def analyze(self, code: str, filename: str) -> List[Finding]:
+        findings = []
+        # ... logika deteksi ...
+        return findings
+```
+
+Cukup letakkan file di `agent/tools/` — **auto-discovery** akan mendaftarkannya
+otomatis saat `registry.discover()` dipanggil. Tidak perlu mengubah `graph.py`
+maupun `registry.py`.
+
+### Plugin eksternal (paket terpisah)
+
+Checker juga bisa didistribusikan sebagai paket pihak ketiga tanpa menyentuh
+repo ini. Deklarasikan *entry point* pada group `owasp_audit_agent.checkers`:
+
+```toml
+# pyproject.toml paket plugin kamu
+[project.entry-points."owasp_audit_agent.checkers"]
+my_checker = "my_package.my_module:MyChecker"
+```
+
+Setelah paket terpasang, `registry.discover_entry_points()` akan memuatnya otomatis.
+
+## Arsitektur
+
+```
+agent/
+├── base_checker.py     # abstract BaseChecker (kontrak checker)
+├── registry.py         # CheckerRegistry + auto-discovery + entry points
+├── models.py           # Finding, OWASPCategory, SeverityLevel (Pydantic)
+├── state.py            # AuditState (state LangGraph)
+├── graph.py            # workflow LangGraph + audit_code()
+├── rule_fixer.py       # perbaikan berbasis aturan
+├── sarif_exporter.py   # ekspor hasil ke SARIF
+├── dependency_scanner.py
+├── history.py          # riwayat scan
+├── report.py           # laporan PDF
+├── cli.py              # command owasp-audit
+└── tools/              # satu file per checker (auto-discovered)
+```
+
+## Lisensi
+
+MIT — lihat [LICENSE](LICENSE).

owasp_audit_agent-0.1.0/README.md

@@ -0,0 +1,192 @@
+# owasp-audit-agent
+
+Framework *agentic AI* untuk audit keamanan kode Python berbasis **OWASP Top 10 (2025)**.
+Menganalisis kode sumber, mendeteksi kerentanan di 10 kategori OWASP, menghasilkan
+ringkasan eksekutif dari LLM, mencoba memperbaiki secara otomatis, lalu memverifikasi ulang.
+
+Orkestrasi dibangun di atas **LangGraph**; deteksi memakai *checker* modular yang
+ditemukan secara otomatis sehingga menambah aturan baru tidak menyentuh kode inti.
+
+## Instalasi
+
+```bash
+pip install -e .            # library + CLI
+pip install -e ".[ui]"      # + UI Streamlit
+pip install -e ".[dev]"     # + pytest
+```
+
+Buat file `.env` berisi kredensial LLM:
+
+```
+GROQ_API_KEY=your_key_here
+```
+
+## Pemakaian sebagai library
+
+```python
+from agent import audit_code
+
+result = audit_code(open("app.py").read(), "app.py")
+
+for f in result["findings"]:
+    print(f.severity.value, f.owasp_category.value, f.title, f.line_number)
+
+print(result["summary"])
+```
+
+## CLI
+
+```bash
+owasp-audit app.py               # audit satu file
+owasp-audit app.py --json        # keluaran JSON
+owasp-audit --list-checkers      # daftar checker terdaftar
+```
+
+## UI (Streamlit)
+
+```bash
+streamlit run app.py
+```
+
+## Konfigurasi
+
+Perilaku audit diatur lewat file `audit.toml` di root project (opsional) dan/atau
+environment variable. Salin `audit.example.toml` menjadi `audit.toml` lalu sesuaikan:
+
+```toml
+[llm]
+provider = "groq"
+model = "llama-3.1-8b-instant"
+temperature = 0.0
+
+[audit]
+escalation_threshold = 3      # eskalasi jika jumlah CRITICAL > nilai ini
+max_fix_iterations = 2
+auto_fix = true
+
+[checkers]
+enabled = []                  # kosong = semua; mis. ["A01","A05","A07"]
+disabled = ["A09"]            # kode kategori yang dimatikan
+```
+
+Env var menimpa file (berguna untuk CI): `OWASP_LLM_MODEL`,
+`OWASP_ESCALATION_THRESHOLD`, `OWASP_MAX_FIX_ITERATIONS`, `OWASP_AUTO_FIX`,
+`OWASP_ENABLED_CHECKERS`, `OWASP_DISABLED_CHECKERS`, `OWASP_CONFIG` (path file config).
+
+Dari kode, config bisa dimuat manual:
+
+```python
+from agent import AuditConfig
+cfg = AuditConfig.load()          # audit.toml + env
+print(cfg.escalation_threshold, cfg.llm_model, cfg.is_checker_enabled("A05"))
+```
+
+## Provider LLM
+
+Provider dipilih lewat `[llm] provider` di `audit.toml` (atau env `OWASP_LLM_PROVIDER`).
+Built-in: `groq` (default, sudah termasuk), `openai`, `anthropic`, `google`, `ollama`.
+Paket integrasi di-import lazy — install hanya yang dipakai:
+
+```bash
+pip install -e ".[openai]"      # atau .[anthropic] / .[google] / .[ollama]
+```
+
+```toml
+[llm]
+provider = "openai"
+model = "gpt-4o-mini"
+# base_url = "http://localhost:11434"   # untuk Ollama / endpoint OpenAI-compatible
+```
+
+API key dibaca dari env sesuai provider (`GROQ_API_KEY`, `OPENAI_API_KEY`,
+`ANTHROPIC_API_KEY`, dst). Menambah provider kustom:
+
+```python
+from agent import register_provider
+
+@register_provider("myllm")
+def _build(config):
+    from my_pkg import MyChat
+    return MyChat(model=config.llm_model, temperature=config.llm_temperature)
+```
+
+Lalu set `provider = "myllm"` di config.
+
+## Kategori OWASP yang dicakup
+
+| Kode | Kategori |
+|------|----------|
+| A01 | Broken Access Control |
+| A02 | Security Misconfiguration |
+| A03 | Software Supply Chain Failures |
+| A04 | Cryptographic Failures |
+| A05 | Injection |
+| A06 | Insecure Design |
+| A07 | Authentication Failures |
+| A08 | Software or Data Integrity Failures |
+| A09 | Security Logging and Alerting Failures |
+| A10 | Mishandling of Exceptional Conditions |
+
+## Menulis checker baru
+
+Buat subclass `BaseChecker` dan implementasi `category`, `name`, dan `analyze()`:
+
+```python
+# agent/tools/my_checker.py
+from typing import List
+from agent.base_checker import BaseChecker
+from agent.models import Finding, OWASPCategory, SeverityLevel
+
+class MyChecker(BaseChecker):
+    @property
+    def category(self) -> OWASPCategory:
+        return OWASPCategory.A05
+
+    @property
+    def name(self) -> str:
+        return "My Custom Checker"
+
+    def analyze(self, code: str, filename: str) -> List[Finding]:
+        findings = []
+        # ... logika deteksi ...
+        return findings
+```
+
+Cukup letakkan file di `agent/tools/` — **auto-discovery** akan mendaftarkannya
+otomatis saat `registry.discover()` dipanggil. Tidak perlu mengubah `graph.py`
+maupun `registry.py`.
+
+### Plugin eksternal (paket terpisah)
+
+Checker juga bisa didistribusikan sebagai paket pihak ketiga tanpa menyentuh
+repo ini. Deklarasikan *entry point* pada group `owasp_audit_agent.checkers`:
+
+```toml
+# pyproject.toml paket plugin kamu
+[project.entry-points."owasp_audit_agent.checkers"]
+my_checker = "my_package.my_module:MyChecker"
+```
+
+Setelah paket terpasang, `registry.discover_entry_points()` akan memuatnya otomatis.
+
+## Arsitektur
+
+```
+agent/
+├── base_checker.py     # abstract BaseChecker (kontrak checker)
+├── registry.py         # CheckerRegistry + auto-discovery + entry points
+├── models.py           # Finding, OWASPCategory, SeverityLevel (Pydantic)
+├── state.py            # AuditState (state LangGraph)
+├── graph.py            # workflow LangGraph + audit_code()
+├── rule_fixer.py       # perbaikan berbasis aturan
+├── sarif_exporter.py   # ekspor hasil ke SARIF
+├── dependency_scanner.py
+├── history.py          # riwayat scan
+├── report.py           # laporan PDF
+├── cli.py              # command owasp-audit
+└── tools/              # satu file per checker (auto-discovered)
+```
+
+## Lisensi
+
+MIT — lihat [LICENSE](LICENSE).

owasp_audit_agent-0.1.0/agent/__init__.py

@@ -0,0 +1,38 @@
+"""
+owasp-audit-agent — framework audit keamanan kode Python berbasis OWASP Top 10 (2025).
+
+API publik yang stabil:
+
+    from agent import audit_code, build_graph, registry
+    from agent import BaseChecker, Finding, OWASPCategory, SeverityLevel
+
+Menulis checker baru: subclass `BaseChecker`, taruh file di `agent/tools/`
+(otomatis ditemukan), atau distribusikan sebagai plugin lewat entry point
+group "owasp_audit_agent.checkers".
+"""
+
+from agent.base_checker import BaseChecker
+from agent.models import Finding, AuditResult, OWASPCategory, SeverityLevel
+from agent.registry import CheckerRegistry, registry
+from agent.config import AuditConfig
+from agent.llm import build_llm, register_provider, available_providers
+from agent.graph import build_graph, audit_code
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "audit_code",
+    "build_graph",
+    "build_llm",
+    "register_provider",
+    "available_providers",
+    "registry",
+    "CheckerRegistry",
+    "AuditConfig",
+    "BaseChecker",
+    "Finding",
+    "AuditResult",
+    "OWASPCategory",
+    "SeverityLevel",
+    "__version__",
+]

owasp_audit_agent-0.1.0/agent/base_checker.py

@@ -0,0 +1,39 @@
+from abc import ABC, abstractmethod
+from typing import List
+from agent.models import Finding, OWASPCategory
+
+
+class BaseChecker(ABC):
+    """
+    Abstract base class untuk semua OWASP checker.
+    Setiap checker baru WAJIB mengimplementasi method analyze().
+    """
+
+    @property
+    @abstractmethod
+    def category(self) -> OWASPCategory:
+        """Kategori OWASP yang dicek oleh checker ini."""
+        pass
+
+    @property
+    @abstractmethod
+    def name(self) -> str:
+        """Nama checker yang mudah dibaca."""
+        pass
+
+    @abstractmethod
+    def analyze(self, code: str, filename: str) -> List[Finding]:
+        """
+        Analisis kode dan kembalikan list of Finding.
+
+        Args:
+            code: Source code Python sebagai string
+            filename: Nama file yang dianalisis
+
+        Returns:
+            List of Finding yang ditemukan
+        """
+        pass
+
+    def __repr__(self) -> str:
+        return f"<{self.__class__.__name__}: {self.category.value}>"

owasp_audit_agent-0.1.0/agent/cli.py

@@ -0,0 +1,80 @@
+"""
+CLI untuk owasp-audit-agent.
+
+Pemakaian:
+    owasp-audit path/ke/file.py
+    owasp-audit file.py --json
+    owasp-audit --list-checkers
+"""
+import argparse
+import json
+import sys
+
+from agent.registry import registry
+from agent.graph import audit_code
+
+
+def _cmd_list_checkers() -> int:
+    registry.discover()
+    checkers = registry.list_registered()
+    print(f"{len(checkers)} checker terdaftar:")
+    for line in sorted(checkers):
+        print(f"  - {line}")
+    return 0
+
+
+def _cmd_audit(path: str, as_json: bool) -> int:
+    try:
+        with open(path, "r", encoding="utf-8") as fh:
+            code = fh.read()
+    except OSError as exc:
+        print(f"Gagal membaca file: {exc}", file=sys.stderr)
+        return 2
+
+    result = audit_code(code, filename=path)
+    findings = result.get("findings", [])
+
+    if as_json:
+        payload = {
+            "filename": path,
+            "summary": result.get("summary", ""),
+            "escalated": result.get("escalated", False),
+            "findings": [f.model_dump(mode="json") for f in findings],
+        }
+        print(json.dumps(payload, indent=2, ensure_ascii=False))
+        return 1 if findings else 0
+
+    if not findings:
+        print(f"✓ Tidak ada temuan pada {path}.")
+        return 0
+
+    print(f"Ditemukan {len(findings)} isu pada {path}:\n")
+    for f in findings:
+        loc = f" (baris {f.line_number})" if f.line_number else ""
+        print(f"  [{f.severity.value}] {f.owasp_category.value}{loc}")
+        print(f"      {f.title}")
+    if result.get("escalated"):
+        print(f"\n⚠  {result.get('escalation_message', 'Eskalasi keamanan.')}")
+    print(f"\nRingkasan:\n{result.get('summary', '')}")
+    return 1
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="owasp-audit",
+        description="Audit keamanan kode Python berbasis OWASP Top 10 (2025).",
+    )
+    parser.add_argument("path", nargs="?", help="File Python yang akan diaudit.")
+    parser.add_argument("--json", action="store_true", help="Keluarkan hasil sebagai JSON.")
+    parser.add_argument("--list-checkers", action="store_true", help="Tampilkan checker terdaftar lalu keluar.")
+    args = parser.parse_args(argv)
+
+    if args.list_checkers:
+        return _cmd_list_checkers()
+    if not args.path:
+        parser.error("berikan path file, atau gunakan --list-checkers")
+    return _cmd_audit(args.path, args.json)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())