pycodegate 0.1.2__tar.gz → 0.2.0__tar.gz

{pycodegate-0.1.2 → pycodegate-0.2.0}/.github/workflows/ci.yml

@@ -26,8 +26,8 @@ jobs:
       - name: Run tests
         run: uv run pytest --tb=short -q
 
-      - name: Run py-gate on itself
-        run: uv run py-gate . --fail-on error
+      - name: Run pycodegate on itself
+        run: uv run pycodegate . --fail-on error
 
   lint:
     runs-on: ubuntu-latest

{pycodegate-0.1.2 → pycodegate-0.2.0}/AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-pycodegate is a Python code quality gate that produces a 0–100 health score. It detects your framework, runs parallel lint and dead-code analysis across 40+ rules, and reports findings by severity so you always know what to fix first.
+PyCodeGate is the quality gate for AI-generated Python code. It produces a 0–100 health score by detecting your framework, running parallel lint and dead-code analysis across 40+ rules, and reporting findings by severity — so you can trust what your AI agent just wrote.
 
 ## Quick Start
 

{pycodegate-0.1.2 → pycodegate-0.2.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: pycodegate
-Version: 0.1.2
-Summary: One command. One score. Your Python quality gate.
+Version: 0.2.0
+Summary: Trust, but verify. The quality gate for AI-generated Python code.
 Project-URL: Homepage, https://github.com/themohitkhare/pycodegate
 Project-URL: Repository, https://github.com/themohitkhare/pycodegate
 Project-URL: Issues, https://github.com/themohitkhare/pycodegate/issues
@@ -34,7 +34,7 @@ Description-Content-Type: text/markdown
 
 <h1 align="center">PyCodeGate</h1>
 <p align="center">
-  <strong>One command. One score. Your Python quality gate.</strong>
+  <strong>Trust, but verify. The quality gate for AI-generated Python code.</strong>
 </p>
 <p align="center">
   <a href="https://github.com/themohitkhare/pycodegate/actions/workflows/ci.yml"><img src="https://github.com/themohitkhare/pycodegate/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
@@ -45,9 +45,13 @@ Description-Content-Type: text/markdown
 
 ---
 
+## Why PyCodeGate?
+
+AI coding agents ship code fast — but fast doesn't mean safe. Every `eval()` an LLM drops in, every mutable default it forgets, every circular import it creates is a landmine waiting to go off. PyCodeGate is the trust layer between AI-generated code and your production codebase: one command, one score, zero ambiguity.
+
 ## How it works
 
-PyCodeGate starts by detecting your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
+PyCodeGate detects your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
 
 It then runs two analysis passes **in parallel**: a lint pass that evaluates 40+ rules across 8 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dead Code), and a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables.
 

{pycodegate-0.1.2 → pycodegate-0.2.0}/README.md

@@ -1,6 +1,6 @@
 <h1 align="center">PyCodeGate</h1>
 <p align="center">
-  <strong>One command. One score. Your Python quality gate.</strong>
+  <strong>Trust, but verify. The quality gate for AI-generated Python code.</strong>
 </p>
 <p align="center">
   <a href="https://github.com/themohitkhare/pycodegate/actions/workflows/ci.yml"><img src="https://github.com/themohitkhare/pycodegate/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
@@ -11,9 +11,13 @@
 
 ---
 
+## Why PyCodeGate?
+
+AI coding agents ship code fast — but fast doesn't mean safe. Every `eval()` an LLM drops in, every mutable default it forgets, every circular import it creates is a landmine waiting to go off. PyCodeGate is the trust layer between AI-generated code and your production codebase: one command, one score, zero ambiguity.
+
 ## How it works
 
-PyCodeGate starts by detecting your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
+PyCodeGate detects your project's context: framework (Django, FastAPI, Flask), Python version, package manager (uv, poetry, pip), and test framework. That context drives which rules are active — Django projects get SQL injection checks, FastAPI projects get async-correctness checks, and so on.
 
 It then runs two analysis passes **in parallel**: a lint pass that evaluates 40+ rules across 8 categories (Security, Correctness, Complexity, Architecture, Performance, Structure, Imports, Dead Code), and a dead-code pass powered by [Vulture](https://github.com/jendrikseipp/vulture) that finds unused functions, classes, imports, and variables.
 

{pycodegate-0.1.2 → pycodegate-0.2.0}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "pycodegate"
-version = "0.1.2"
-description = "One command. One score. Your Python quality gate."
+version = "0.2.0"
+description = "Trust, but verify. The quality gate for AI-generated Python code."
 readme = "README.md"
 requires-python = ">=3.10"
 license = "MIT"
@@ -72,4 +72,8 @@ ignore = ["SIM102"]  # nested ifs in AST walking are clearer than combined condi
 
 [tool.pycodegate]
 [tool.pycodegate.ignore]
-files = ["tests/fixtures/**"]
+files = ["tests/fixtures/**", "tests/**"]
+
+[tool.pycodegate.per-file-suppress]
+# Click CLI entry-points must declare all options as individual parameters
+"src/pycodegate/cli.py" = ["too-many-arguments"]

{pycodegate-0.1.2 → pycodegate-0.2.0}/src/pycodegate/__init__.py

@@ -1,3 +1,3 @@
 """Python Doctor - Diagnose your Python project's health."""
 
-__version__ = "0.1.2"
+__version__ = "0.2.0"

{pycodegate-0.1.2 → pycodegate-0.2.0}/src/pycodegate/cli.py

@@ -3,12 +3,13 @@
 from __future__ import annotations
 
 import sys
+from dataclasses import dataclass
 
 import click
 
 from pycodegate import __version__
 from pycodegate.config import load_config
-from pycodegate.output import output_json, print_scan_result
+from pycodegate.output import output_json, output_sarif, print_scan_result
 from pycodegate.scan import scan_project
 from pycodegate.types import Severity
 from pycodegate.utils.badge import generate_badge, generate_ci_workflow
@@ -16,6 +17,97 @@ from pycodegate.utils.fixer import run_ruff_fix
 from pycodegate.utils.precommit import install_precommit_hook
 
 
+@dataclass
+class CliOptions:
+    """Bundle of all CLI flags passed to main()."""
+
+    directory: str
+    lint: bool
+    dead_code: bool
+    verbose: bool
+    score_only: bool
+    json_output: bool
+    diff_base: str | None
+    fail_on: str
+    fix: bool
+    profile_override: str | None
+    badge: bool
+    ci_workflow: bool
+    precommit: bool
+    min_score: int | None
+    sarif_output: bool
+
+
+def _handle_early_exits(opts: CliOptions) -> bool:
+    """Handle flags that exit before scanning. Returns True if handled."""
+    if opts.ci_workflow:
+        click.echo(generate_ci_workflow(), nl=False)
+        return True
+
+    if opts.precommit:
+        effective_min = opts.min_score if opts.min_score is not None else 50
+        msg = install_precommit_hook(opts.directory, min_score=effective_min)
+        click.echo(msg)
+        return True
+
+    return False
+
+
+def _maybe_run_fix(opts: CliOptions) -> None:
+    """Apply ruff auto-fix if --fix was passed."""
+    if not opts.fix:
+        return
+    fixes = run_ruff_fix(opts.directory)
+    if fixes == -1:
+        click.echo("ruff not found, skipping auto-fix")
+    else:
+        click.echo(f"Fixed {fixes} issues via ruff")
+
+
+def _build_config(opts: CliOptions):
+    """Load config and apply CLI overrides."""
+    config = load_config(opts.directory)
+    config.lint = opts.lint
+    config.dead_code = opts.dead_code
+    config.verbose = opts.verbose
+    config.fail_on = opts.fail_on
+    if opts.profile_override is not None:
+        config.profile = opts.profile_override
+    return config
+
+
+def _output_result(opts: CliOptions, result) -> None:
+    """Write scan result to stdout in the requested format."""
+    if opts.badge:
+        click.echo(generate_badge(result.score.value, result.score.label))
+        return
+
+    if opts.sarif_output:
+        output_sarif(result)
+    elif opts.json_output:
+        output_json(result)
+    elif opts.score_only:
+        click.echo(str(result.score.value))
+    else:
+        print_scan_result(result, verbose=opts.verbose)
+
+
+def _apply_exit_codes(opts: CliOptions, result) -> None:
+    """Exit with non-zero code based on --fail-on and --min-score."""
+    has_errors = any(d.severity == Severity.ERROR for d in result.diagnostics)
+    if (opts.fail_on == "error" and has_errors) or (
+        opts.fail_on == "warning" and result.diagnostics
+    ):
+        sys.exit(1)
+
+    if opts.min_score is not None and result.score.value < opts.min_score:
+        click.echo(
+            f"pycodegate: score {result.score.value} is below minimum {opts.min_score}",
+            err=True,
+        )
+        sys.exit(1)
+
+
 @click.command(context_settings={"help_option_names": ["-h", "--help"]})
 @click.version_option(__version__, "-v", "--version", prog_name="PyCodeGate")
 @click.argument("directory", default=".", type=click.Path(exists=True))
@@ -63,6 +155,13 @@ from pycodegate.utils.precommit import install_precommit_hook
     default=None,
     help="Minimum score threshold (exit 1 if below).",
 )
+@click.option(
+    "--sarif",
+    "sarif_output",
+    is_flag=True,
+    default=False,
+    help="Output in SARIF format for GitHub Code Scanning.",
+)
 def main(
     directory: str,
     lint: bool,
@@ -78,54 +177,34 @@ def main(
     ci_workflow: bool,
     precommit: bool,
     min_score: int | None,
+    sarif_output: bool,
 ) -> None:
     """PyCodeGate — Diagnose your Python project's health."""
-    if ci_workflow:
-        click.echo(generate_ci_workflow(), nl=False)
-        return
+    opts = CliOptions(
+        directory=directory,
+        lint=lint,
+        dead_code=dead_code,
+        verbose=verbose,
+        score_only=score_only,
+        json_output=json_output,
+        diff_base=diff_base,
+        fail_on=fail_on,
+        fix=fix,
+        profile_override=profile_override,
+        badge=badge,
+        ci_workflow=ci_workflow,
+        precommit=precommit,
+        min_score=min_score,
+        sarif_output=sarif_output,
+    )
 
-    if precommit:
-        effective_min = min_score if min_score is not None else 50
-        msg = install_precommit_hook(directory, min_score=effective_min)
-        click.echo(msg)
+    if _handle_early_exits(opts):
         return
 
-    if fix:
-        fixes = run_ruff_fix(directory)
-        if fixes == -1:
-            click.echo("ruff not found, skipping auto-fix")
-        else:
-            click.echo(f"Fixed {fixes} issues via ruff")
-
-    config = load_config(directory)
-    config.lint = lint
-    config.dead_code = dead_code
-    config.verbose = verbose
-    config.fail_on = fail_on
-    if profile_override is not None:
-        config.profile = profile_override
+    _maybe_run_fix(opts)
 
+    config = _build_config(opts)
     result = scan_project(directory, config, diff_base=diff_base)
 
-    if badge:
-        click.echo(generate_badge(result.score.value, result.score.label))
-        return
-
-    if json_output:
-        output_json(result)
-    elif score_only:
-        click.echo(str(result.score.value))
-    else:
-        print_scan_result(result, verbose=verbose)
-
-    # Exit code based on --fail-on
-    has_errors = any(d.severity == Severity.ERROR for d in result.diagnostics)
-    if (fail_on == "error" and has_errors) or (fail_on == "warning" and result.diagnostics):
-        sys.exit(1)
-
-    if min_score is not None and result.score.value < min_score:
-        click.echo(
-            f"pycodegate: score {result.score.value} is below minimum {min_score}",
-            err=True,
-        )
-        sys.exit(1)
+    _output_result(opts, result)
+    _apply_exit_codes(opts, result)

{pycodegate-0.1.2 → pycodegate-0.2.0}/src/pycodegate/output.py

@@ -138,8 +138,6 @@ def print_scan_result(result: ScanResult, verbose: bool = False) -> None:
     # Project info header
     p = result.project
     console.print()
-    from pycodegate import __version__
-
     console.print(f"  [bold]PyCodeGate[/bold] — v{__version__}")
     console.print()
     console.print(f"  [dim]Path:[/dim]            {p.path}")
@@ -215,6 +213,109 @@ def output_json(result: ScanResult) -> None:
     sys.stdout.write(json.dumps(payload, indent=2) + "\n")
 
 
+def _sarif_rules(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF rules registry from unique diagnostic rules."""
+    seen: dict[str, Diagnostic] = {}
+    for d in diagnostics:
+        if d.rule not in seen:
+            seen[d.rule] = d
+    return [
+        {
+            "id": rule_id,
+            "name": rule_id,
+            "shortDescription": {"text": diag.message},
+            "helpUri": "",
+            "help": {"text": diag.help},
+        }
+        for rule_id, diag in seen.items()
+    ]
+
+
+def _sarif_results(diagnostics: list[Diagnostic]) -> list[dict]:
+    """Build SARIF results array from diagnostics."""
+    return [
+        {
+            "ruleId": d.rule,
+            "level": "error" if d.severity == Severity.ERROR else "warning",
+            "message": {"text": d.message},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": d.file_path},
+                        "region": {
+                            "startLine": d.line,
+                            "startColumn": (d.column or 0) + 1,
+                        },
+                    }
+                }
+            ],
+        }
+        for d in diagnostics
+    ]
+
+
+def output_sarif(result: ScanResult) -> None:
+    """Output the scan result in SARIF 2.1.0 format for GitHub Code Scanning."""
+    sarif = {
+        "version": "2.1.0",
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "PyCodeGate",
+                        "version": __version__,
+                        "rules": _sarif_rules(result.diagnostics),
+                    }
+                },
+                "results": _sarif_results(result.diagnostics),
+            }
+        ],
+    }
+    sys.stdout.write(json.dumps(sarif, indent=2) + "\n")
+
+
+def _print_rule_details(
+    console: Console,
+    rule_diags: list[Diagnostic],
+    verbose: bool,
+) -> None:
+    """Print a single rule line and, in verbose mode, the file locations."""
+    rule = rule_diags[0].rule
+    count = len(rule_diags)
+    sev = rule_diags[0].severity
+    icon = "[red]✗[/red]" if sev == Severity.ERROR else "[yellow]⚠[/yellow]"
+    console.print(f"    {icon} {rule} × {count}")
+    if not verbose:
+        return
+    for d in rule_diags[:10]:
+        console.print(f"      [dim]{d.file_path}:{d.line}[/dim]")
+    if count > 10:
+        console.print(f"      [dim]... and {count - 10} more[/dim]")
+
+
+def _print_category_with_issues(
+    console: Console,
+    emoji: str,
+    name: str,
+    earned: int,
+    maximum: int,
+    cat_diags: list[Diagnostic],
+    verbose: bool,
+) -> None:
+    """Print a category header and its grouped rule findings."""
+    console.print(f"  [bold]{emoji} {name}[/bold] [yellow]({earned}/{maximum})[/yellow]")
+    by_rule: dict[str, list[Diagnostic]] = defaultdict(list)
+    for d in cat_diags:
+        by_rule[d.rule].append(d)
+    sorted_rules = sorted(
+        by_rule.keys(),
+        key=lambda r: (0 if by_rule[r][0].severity == Severity.ERROR else 1, r),
+    )
+    for rule in sorted_rules:
+        _print_rule_details(console, by_rule[rule], verbose)
+
+
 def _print_category_groups(
     console: Console,
     diagnostics: list[Diagnostic],
@@ -235,38 +336,15 @@ def _print_category_groups(
             continue
         emoji, name = CATEGORY_DISPLAY[cat]
         earned, maximum = sub_scores.get(cat, (CATEGORY_WEIGHTS[cat], CATEGORY_WEIGHTS[cat]))
-        # Recompute max from sub_scores (already normalised to 100-point scale)
         cat_diags = by_category.get(cat, [])
 
         if earned == maximum:
-            # Perfect score for this category
             console.print(
                 f"  [bold]{emoji} {name}[/bold] "
                 f"[green]({earned}/{maximum})[/green] [green]✓[/green]"
             )
             console.print("    [green]✓ All clear.[/green]")
         else:
-            console.print(f"  [bold]{emoji} {name}[/bold] [yellow]({earned}/{maximum})[/yellow]")
-            # Group by rule within this category
-            by_rule: dict[str, list[Diagnostic]] = defaultdict(list)
-            for d in cat_diags:
-                by_rule[d.rule].append(d)
-
-            # Sort: errors first, then by rule name
-            sorted_rules = sorted(
-                by_rule.keys(),
-                key=lambda r: (0 if by_rule[r][0].severity == Severity.ERROR else 1, r),
-            )
-            for rule in sorted_rules:
-                rule_diags = by_rule[rule]
-                count = len(rule_diags)
-                sev = rule_diags[0].severity
-                icon = "[red]✗[/red]" if sev == Severity.ERROR else "[yellow]⚠[/yellow]"
-                console.print(f"    {icon} {rule} × {count}")
-                if verbose:
-                    for d in rule_diags[:10]:
-                        console.print(f"      [dim]{d.file_path}:{d.line}[/dim]")
-                    if count > 10:
-                        console.print(f"      [dim]... and {count - 10} more[/dim]")
+            _print_category_with_issues(console, emoji, name, earned, maximum, cat_diags, verbose)
 
         console.print()

{pycodegate-0.1.2 → pycodegate-0.2.0}/src/pycodegate/profile.py

@@ -32,6 +32,56 @@ PROFILES = {
 }
 
 
+def _normalise_dep(dep: str) -> str:
+    """Strip version specifiers and extras from a dependency string."""
+    return dep.split("[")[0].split(">")[0].split("<")[0].split("=")[0].split("!")[0].strip().lower()
+
+
+def _deps_from_pyproject(pyproject: Path) -> tuple[set[str], bool, bool]:
+    """Parse pyproject.toml and return (deps, has_build_system, has_scripts)."""
+    deps: set[str] = set()
+    has_build_system = False
+    has_scripts = False
+    try:
+        with open(pyproject, "rb") as f:
+            data = tomllib.load(f)
+        for dep in data.get("project", {}).get("dependencies", []):
+            deps.add(_normalise_dep(dep))
+        has_build_system = "build-system" in data
+        has_scripts = bool(data.get("project", {}).get("scripts"))
+    except (OSError, ValueError, KeyError):
+        pass
+    return deps, has_build_system, has_scripts
+
+
+def _deps_from_requirements(path: Path) -> set[str]:
+    """Parse requirements files and return the set of normalised dep names."""
+    deps: set[str] = set()
+    for req_file in ["requirements.txt", "requirements-dev.txt"]:
+        req_path = path / req_file
+        if not req_path.exists():
+            continue
+        try:
+            for line in req_path.read_text().splitlines():
+                line = line.strip()
+                if line and not line.startswith("#") and not line.startswith("-"):
+                    deps.add(_normalise_dep(line))
+        except (OSError, ValueError):
+            pass
+    return deps
+
+
+def _classify_by_deps(deps: set[str], has_scripts: bool) -> str | None:
+    """Return a profile name based on dependencies, or None if undetermined."""
+    web_deps = {"flask", "django", "fastapi", "starlette", "tornado", "aiohttp", "sanic", "bottle"}
+    if deps & web_deps:
+        return "web"
+    cli_deps = {"click", "typer", "fire", "cement", "cliff", "argparse"}
+    if (deps & cli_deps) or has_scripts:
+        return "cli"
+    return None
+
+
 def detect_profile(project_path: str) -> Profile:
     """Auto-detect project profile from project structure and dependencies."""
     path = Path(project_path)
@@ -42,56 +92,15 @@ def detect_profile(project_path: str) -> Profile:
     has_scripts = False
 
     if pyproject.exists():
-        try:
-            with open(pyproject, "rb") as f:
-                data = tomllib.load(f)
-            # Collect dependency names
-            for dep in data.get("project", {}).get("dependencies", []):
-                deps.add(
-                    dep.split("[")[0]
-                    .split(">")[0]
-                    .split("<")[0]
-                    .split("=")[0]
-                    .split("!")[0]
-                    .strip()
-                    .lower()
-                )
-            has_build_system = "build-system" in data
-            has_scripts = bool(data.get("project", {}).get("scripts"))
-        except Exception:
-            pass
+        pyproject_deps, has_build_system, has_scripts = _deps_from_pyproject(pyproject)
+        deps |= pyproject_deps
 
-    # Also check requirements.txt
-    for req_file in ["requirements.txt", "requirements-dev.txt"]:
-        req_path = path / req_file
-        if req_path.exists():
-            try:
-                for line in req_path.read_text().splitlines():
-                    line = line.strip()
-                    if line and not line.startswith("#") and not line.startswith("-"):
-                        deps.add(
-                            line.split("[")[0]
-                            .split(">")[0]
-                            .split("<")[0]
-                            .split("=")[0]
-                            .split("!")[0]
-                            .strip()
-                            .lower()
-                        )
-            except Exception:
-                pass
-
-    # Web frameworks
-    web_deps = {"flask", "django", "fastapi", "starlette", "tornado", "aiohttp", "sanic", "bottle"}
-    if deps & web_deps:
-        return PROFILES["web"]
+    deps |= _deps_from_requirements(path)
 
-    # CLI tools
-    cli_deps = {"click", "typer", "fire", "cement", "cliff", "argparse"}
-    if (deps & cli_deps) or has_scripts:
-        return PROFILES["cli"]
+    profile_name = _classify_by_deps(deps, has_scripts)
+    if profile_name is not None:
+        return PROFILES[profile_name]
 
-    # Library
     if has_build_system and not has_scripts:
         return PROFILES["library"]
 
@@ -103,5 +112,4 @@ def detect_profile(project_path: str) -> Profile:
     if not has_init and len(py_files) <= 5:
         return PROFILES["script"]
 
-    # Default to library
     return PROFILES["library"]

{pycodegate-0.1.2 → pycodegate-0.2.0}/src/pycodegate/rules/dependencies.py

@@ -14,15 +14,8 @@ from pycodegate.types import Category, Diagnostic, Severity
 class DependencyRules:
     """Dependency vulnerability checks using pip-audit (optional)."""
 
-    def check_project(self, project_path: str) -> list[Diagnostic]:
-        if not shutil.which("pip-audit"):
-            return []
-
-        path = Path(project_path)
-        req_file = self._find_or_export_requirements(path)
-        if not req_file:
-            return []
-
+    def _run_pip_audit(self, req_file: Path) -> dict | None:
+        """Run pip-audit against *req_file* and return parsed JSON, or None on failure."""
         try:
             result = subprocess.run(
                 [
@@ -38,17 +31,14 @@ class DependencyRules:
                 text=True,
                 timeout=60,
             )
-            # pip-audit exits non-zero when vulnerabilities found
             if not result.stdout.strip():
-                return []
-            data = json.loads(result.stdout)
+                return None
+            return json.loads(result.stdout)
         except (subprocess.TimeoutExpired, json.JSONDecodeError, OSError):
-            return []
-        finally:
-            # Clean up temp file if we created one
-            if req_file and str(req_file).startswith(tempfile.gettempdir()):
-                req_file.unlink(missing_ok=True)
+            return None
 
+    def _build_vuln_diagnostics(self, data: dict) -> list[Diagnostic]:
+        """Convert pip-audit JSON output into Diagnostic objects."""
         diags: list[Diagnostic] = []
         for vuln in data.get("dependencies", []):
             pkg_name = vuln.get("name", "unknown")
@@ -71,6 +61,26 @@ class DependencyRules:
                 )
         return diags
 
+    def check_project(self, project_path: str) -> list[Diagnostic]:
+        if not shutil.which("pip-audit"):
+            return []
+
+        path = Path(project_path)
+        req_file = self._find_or_export_requirements(path)
+        if not req_file:
+            return []
+
+        try:
+            data = self._run_pip_audit(req_file)
+        finally:
+            # Clean up temp file if we created one
+            if req_file and str(req_file).startswith(tempfile.gettempdir()):
+                req_file.unlink(missing_ok=True)
+
+        if data is None:
+            return []
+        return self._build_vuln_diagnostics(data)
+
     def _find_or_export_requirements(self, path: Path) -> Path | None:
         # Try existing requirements.txt
         for name in ["requirements.txt", "requirements.lock"]: