quin-scanner 0.1.0b1__tar.gz

quin_scanner-0.1.0b1/.env.example

@@ -0,0 +1,29 @@
+# ── LLM Provider API Keys ───────────────────────────────────────────────────
+# Uncomment and set the key for whichever provider you use.
+
+# OPENAI_API_KEY=sk-...
+# ANTHROPIC_API_KEY=sk-ant-...
+# GOOGLE_API_KEY=...
+
+# ── GitHub ───────────────────────────────────────────────────────────────────
+# Personal access token — required for scanning GitHub repos or orgs.
+# Needs at least read:org and repo (public_repo for public-only) scopes.
+# GITHUB_TOKEN=ghp_...
+
+# ── OpenAI-compatible endpoint (vLLM, LiteLLM, Azure, Ollama, etc.) ─────────
+# Set this to use a custom base URL instead of api.openai.com.
+# OPENAI_COMPATIBLE_URL=http://localhost:11434/v1
+
+# ── Vulnerability lookup ────────────────────────────────────────────────────
+# The scanner always queries OSV.dev (free, no auth) for the detected
+# framework+version. Optionally it can also ask an LLM with web-search
+# enabled for very recent advisories that may not be in OSV yet.
+#
+# Supported providers (each reuses that provider's existing API key env var):
+#   perplexity  →  requires PERPLEXITY_API_KEY
+#   gemini      →  requires GOOGLE_API_KEY
+#   openai      →  requires OPENAI_API_KEY
+#   anthropic   →  requires ANTHROPIC_API_KEY
+#   none        →  disable web search (OSV still runs)
+# VULN_SEARCH_PROVIDER=anthropic
+# PERPLEXITY_API_KEY=pplx-...

quin_scanner-0.1.0b1/.gitattributes

@@ -0,0 +1,24 @@
+# Normalize line endings
+* text=auto
+
+# Python
+*.py text diff=python
+*.pyx text diff=python
+
+# YAML
+*.yaml text
+*.yml text
+
+# JSON
+*.json text
+
+# Markdown
+*.md text diff=markdown
+
+# Shell
+*.sh text eol=lf
+
+# Templates
+*.jinja2 text
+*.j2 text
+*.mustache text

quin_scanner-0.1.0b1/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    name: Lint, build, and smoke test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Install dependencies
+        run: uv sync --all-extras
+
+      - name: Lint
+        run: uv run ruff check src/
+
+      - name: Test
+        run: uv run pytest tests/ -v
+
+      - name: Build package
+        run: uv run python -m build
+
+      - name: Smoke test
+        run: uv run quin-scanner --help

quin_scanner-0.1.0b1/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

quin_scanner-0.1.0b1/.gitignore

@@ -0,0 +1,51 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg-info/
+*.egg
+dist/
+build/
+*.whl
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# Testing
+.pytest_cache/
+htmlcov/
+.coverage
+.coverage.*
+coverage.xml
+reports/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Environment
+.env
+.env.*
+!.env.example
+
+# Build (keep uv.lock for reproducible builds)
+!uv.lock
+
+# Agent
+.agent/skills
+
+# Scan output (generated by quin-scanner; not source-controlled)
+report/*.html
+report/*.json
+report/*.yaml
+report/*.yml

quin_scanner-0.1.0b1/.python-version

@@ -0,0 +1 @@
+3.11

quin_scanner-0.1.0b1/CHANGELOG.md

@@ -0,0 +1,146 @@
+# Changelog
+
+All notable changes to Quin Agent Scanner are documented here.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Unreleased]
+
+### Added
+
+#### Risk Signal Data Model
+- `RiskIndicator.threat_id` — new optional field (`str | None`) identifying the originating threat (e.g. `"T001"`) per risk signal. Additive / backward-compatible: `to_dict()` includes the field, consumers that don't read it are unaffected. Enables downstream reports and UIs to link each signal to its threat in the taxonomy.
+- LLM synthesis prompt updated to emit `threat_id` alongside each KRI in `risk_signals` (both repo-level and per-agent). Parser in `_parse_risk_signals` extracts the field; legacy string-format signals yield `threat_id=None`.
+- Hardcoded CVE/vulnerability risk signal in the orchestrator now carries `threat_id="T003"` (AI Supply Chain Compromise).
+
+#### Risk Framework Documentation
+- `docs/risk-framework.md` — generated reference documenting all 14 threats (T001–T014) and 14 controls (C001–C014) with description, rationale, key risk indicators, attack patterns, implementation guidance, common pitfalls, and sourced external references. Grounded in OWASP LLM Top 10, OWASP Agentic AI Top 10, OWASP MCP Top 10, OWASP MAESTRO, and Databricks DASF.
+- `src/quin_scanner/rules/risk_taxonomy.yaml` — extended with prose fields (`description`, `why_it_matters`, `attack_patterns`, `external_refs` on threats; `description`, `why_it_matters`, `how_to_implement`, `common_pitfalls`, `external_refs` on controls). YAML is the single source of truth — the MD is generated.
+- `scripts/generate_risk_framework_docs.py` — Jinja2-based generator with `--check` drift-gate flag suitable for CI. Template at `scripts/templates/risk-framework.md.j2`.
+- `src/quin_scanner/risk_taxonomy.py` — loader extended to surface the new prose fields via `ExternalRef`, `Threat`, and `Control` dataclasses (all new fields default-populated so existing consumers are unaffected).
+- `tests/test_risk_framework_docs.py` — drift, completeness, and referential-integrity tests: the on-disk MD must match what the generator produces, every T0NN/C0NN must have stable `t0NN`/`c0NN` anchors, every threat's `recommended_controls` must resolve to a real control, and every external ref must have a title and an http(s) URL.
+
+#### HTML Report Deep-Links to Risk Framework
+- `html_template.py` — control labels rendered inside risk signals (e.g. `C003: Access Control & Least Privilege`) are now clickable links that open `docs/risk-framework.md#c003` on GitHub. Each risk signal with a known `threat_id` renders a small `↗` icon linking to the matching `#t0NN` anchor. All external links use `target="_blank" rel="noopener"` to avoid reverse-tabnabbing. The click handler was refactored to ignore clicks on deep-link anchors so the row-toggle behavior still works for the rest of the signal.
+
+#### Scanner Plugins (+2, now 13 total)
+- `tool_definition` — extracts named tool definitions from code via `@tool`, `@function_tool`, `@register_tool`, `@kernel_function`, `@register_function` decorators, `BaseTool` / `StructuredTool` class inheritance, tool registration calls (`register_tool()`, `server.tool()`), and Markdown tool-definition tables
+- `agent_instance` — extracts named agent instantiations from code (`Agent(name=...)`, `AssistantAgent`, `UserProxyAgent`, `ConversableAgent`, etc.) and YAML/JSON agent config files
+
+#### Risk Taxonomy & Classification
+- `risk_taxonomy.yaml` — structured threat catalog sourced from OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MAESTRO, and Databricks DASF
+- `risk_taxonomy.py` — loader and query interface for the threat taxonomy
+- `classification_agent.py` — LLM Pass 1 that classifies system type (`standard_ai`, `agentic_ai`, `mcp_enabled`, `multi_agent`) and identifies relevant threats from the taxonomy
+- `RiskIndicator` dataclass — pairs a key risk indicator signal with its recommended controls
+- `ClassificationResult` dataclass — captures system types and relevant threat IDs
+- Repo-level `risk_signals` field on `SynthesisResult` and `ScanReport`
+
+#### External Service Detection
+- `tool_services.yaml` — maps high-signal packages to service categories: web search, web browsing, code execution, database access, file system, email, and more
+- `ToolUsage` now includes `tool_type` (tool_definition / external_service / skill / mcp_tool) and `service_category`
+
+#### Signal Groups
+- `signal_groups.yaml` — cross-scanner framework corroboration rules that boost confidence when multiple co-occurring signals appear (e.g. OpenClaw: `SOUL.md` + `AGENTS.md` + `openclaw.json`)
+
+#### HTML Report Output
+- `html_template.py` — self-contained HTML report template with embedded JS dashboard
+- `--format html` output option via `ReportGenerator.to_html()`
+
+#### Detection Rules (expanded)
+- New entries in `code_patterns.yaml`, `dependencies.yaml`, `file_markers.yaml`, `frameworks.yaml`, and `frameworks_lookup.yaml`
+
+### Changed
+- `findings` field renamed to `artifacts` in `ScanReport` output
+- `risk_signals` on `AgentProfile` changed from `list[str]` to `list[RiskIndicator]` (now includes recommended controls)
+- CLI help text and option descriptions overhauled for all scan commands
+- Orchestrator expanded with two-pass LLM pipeline (classification → synthesis)
+
+### Fixed
+- Removed compiled Python bytecache files (`.pyc`) from repository
+
+### Maintenance
+- `pyproject.toml` — added `jinja2>=3.1` to the `dev` extra (used only by the risk-framework doc generator; not a runtime dependency).
+- Updated dependency versions in `pyproject.toml`
+- Updated scanner configuration defaults in `scanner-config.yaml`
+- PyPI publish workflow switched to OIDC authentication with `contents: read` permission
+- Updated project branding, repository URL, and company information in README
+- Removed testing documentation and references from project files
+
+---
+
+## [0.1.0] — 2026-03-31
+
+**Drop 1 — Scan Any Repo for AI**
+
+### Added
+
+#### Scan Modes
+- `scan` command — scan a local folder or GitHub repo URL
+- `scan-org` command — scan all repos in a GitHub org sequentially
+- `scan-batch` command — scan multiple targets from a file
+- `GitHubAPIAccessor` — shallow-clone any GitHub repo URL via REST API
+- `GitHubMCPAccessor` — MCP-based accessor for interactive use
+- `RepoAccessorFactory` — auto-selects accessor from target string (local path vs GitHub URL)
+- `--github-token` flag and `GITHUB_TOKEN` env var for GitHub PAT authentication
+- `--skip-archived` and `--skip-forks` flags on `scan-org`
+
+#### Scanner Plugins (11 total)
+- `dependency` — AI packages in requirements.txt, pyproject.toml, package.json, go.mod, Cargo.toml, pom.xml, build.gradle
+- `code_pattern` — AI imports and API calls in .py, .js, .ts, .go, .rs, .java
+- `config` — AI API keys in .env and config files
+- `file_structure` — AI-related directories (prompts/, agents/, chains/, vector_store/)
+- `framework` — framework config files (langgraph.json, crew.yaml, .mcp.json, dify.yaml, and 10+ more)
+- `prompt_discovery` — system prompts from Python strings, YAML, .prompt, .jinja2, .mustache
+- `dockerfile` — AI base images and pip installs in Dockerfile and docker-compose
+- `jupyter` — AI imports and prompts in Jupyter notebooks (.ipynb)
+- `ci` — AI API keys and installs in GitHub Actions, GitLab CI, Azure Pipelines, CircleCI, Jenkins
+- `iac` — AI services in Terraform (.tf) and Kubernetes/Helm YAML
+- `mcp` — MCP server configs (.mcp.json, claude_desktop_config.json, cline settings, etc.)
+
+#### Framework Detection (23+ frameworks)
+- LangChain, LangGraph, CrewAI, AutoGen, OpenAI Agents SDK
+- **New**: Anthropic Agent SDK (`claude-agent-sdk`)
+- **New**: Google ADK (`google-adk`)
+- **New**: Databricks Agent Framework (`databricks-agents`)
+- LlamaIndex, Haystack, Semantic Kernel, Dify, Flowise, PromptFlow, Vercel AI SDK, MCP
+
+#### LLM Model Identification
+- `model_identifier.py` — detects LLM model names from code, config files, and env vars
+- Identifies provider (openai, anthropic, google, meta, mistral, cohere, aws, databricks)
+- Detects primary/fallback routing patterns from YAML config and code structures
+- `rules/models.yaml` — known model name registry across all major providers
+- `ModelUsage` dataclass with provider, model_name, source, file_path, line_number, role
+- `model_usages` section added to `ScanReport` output
+
+#### LLM Providers (5 total)
+- OpenAI (`openai`) — default model: `gpt-4o-mini`
+- Anthropic (`anthropic`) — default model: `claude-haiku-4-5-20251001`
+- Google (`google`) — default model: `gemini-2.0-flash`
+- Ollama (`ollama`) — default model: `llama3.2`
+- **New**: OpenAI-compatible (`openai-compatible`) — any endpoint implementing the OpenAI chat API (vLLM, LiteLLM, Azure OpenAI, AWS Bedrock via gateway, LocalAI)
+- `--openai-compatible-url` flag for base URL configuration
+
+#### Output & Configuration
+- JSON and YAML output formats
+- `--no-llm` flag — run all 11 scanners without LLM calls
+- `--output-file` flag — write report to file instead of stdout
+- `--config` flag — load settings from `scanner-config.yaml`
+- `--branch` flag — specify git branch for GitHub URL scans
+
+#### Detection Rules
+- `dependencies.yaml` — 100+ AI packages across PyPI, npm, Go, crates.io, Maven
+- `code_patterns.yaml` — 60+ regex patterns across Python, JS, TS, Go, Rust, Java
+- `file_markers.yaml` — AI-related directory and file extension markers
+- `frameworks.yaml` — 23+ framework config file signatures
+- `models.yaml` — known LLM model names by provider
+
+#### 12 Capability Tags
+`llm-api` · `embeddings` · `rag` · `tool-use` · `multi-agent` · `memory` · `prompt-templates` · `fine-tuning` · `image-gen` · `voice-ai` · `code-gen` · `orchestration`
+
+---
+
+[Unreleased]: https://github.com/quin-scanner/quin-agent-scanner/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/quin-scanner/quin-agent-scanner/releases/tag/v0.1.0

quin_scanner-0.1.0b1/CODE_OF_CONDUCT.md

@@ -0,0 +1,29 @@
+# Code of Conduct
+
+## Our Standards
+
+Quin Agent Scanner is an open-source project. We expect all participants — contributors, maintainers, and users — to interact with professionalism and respect.
+
+**Expected behavior:**
+- Be respectful and constructive in discussions, code reviews, and issue comments
+- Welcome contributors of all experience levels
+- Focus feedback on ideas and code, not people
+- Accept differing viewpoints and technical opinions gracefully
+
+**Unacceptable behavior:**
+- Disrespectful, insulting, or dismissive language
+- Personal attacks or harassment of any kind
+- Sharing others' private information without consent
+- Sustained disruption of discussions or reviews
+
+## Scope
+
+This Code of Conduct applies in all project spaces: GitHub Issues, Pull Requests, Discussions, and any other official communication channels.
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported by opening a GitHub Issue or contacting the maintainers directly via the repository. Maintainers will review and respond to reports, and may remove comments, close issues, or restrict access as appropriate.
+
+## Attribution
+
+This Code of Conduct is adapted from community standards common to open-source projects. It applies to all contributors and participants in the Quin Agent Scanner project.

quin_scanner-0.1.0b1/CONTRIBUTING.md

@@ -0,0 +1,136 @@
+# Contributing to Quin Agent Scanner
+
+Thank you for your interest in contributing. This document covers how to get started, the development workflow, and what we look for in contributions.
+
+---
+
+## Getting Started
+
+### Prerequisites
+
+- Python 3.11+
+- [uv](https://docs.astral.sh/uv/) package manager
+
+### Set Up the Dev Environment
+
+```bash
+git clone https://github.com/quin-scanner/quin-agent-scanner
+cd quin-agent-scanner
+uv sync --all-extras
+```
+
+This installs all dependencies into a local `.venv`.
+
+---
+
+## Ways to Contribute
+
+### Bug Reports
+
+Open an issue with:
+- Quin Scanner version (`quin-scanner --version`)
+- OS and Python version
+- Command you ran
+- Expected vs actual output
+- Minimal reproducer (a small repo or fixture that triggers the bug)
+
+### Feature Requests
+
+Open an issue describing:
+- What you want to do that you can't do today
+- Why it matters (use case)
+- Any ideas on how it could work
+
+Check the [drop plan](docs/plans/2026-03-31-quin-agent-scanner-drop-plan.md) first — features may already be scheduled.
+
+### Pull Requests
+
+1. **Fork** the repo and create a branch from `main`
+2. **Keep scope tight** — one feature or fix per PR
+3. **Update CHANGELOG.md** under `[Unreleased]`
+4. Open the PR with a clear description of what and why
+
+---
+
+## Adding a New Scanner Plugin
+
+1. Create `src/quin_scanner/scanners/my_scanner.py` extending `BaseScanner`
+2. Implement `name() -> str` and `scan(accessor, file_index) -> list[ScanFinding]`
+3. Register it in `orchestrator.py` `_SCANNER_REGISTRY`
+4. Add detection rules to the appropriate `rules/*.yaml` file if needed
+
+```python
+from quin_scanner.scanners.base import BaseScanner
+from quin_scanner.models import ScanFinding
+from quin_scanner.repo_accessor import RepoAccessor
+from quin_scanner.file_index import FileIndex
+
+
+class MyScanner(BaseScanner):
+    def name(self) -> str:
+        return "my_scanner"
+
+    def scan(self, accessor: RepoAccessor, file_index: FileIndex) -> list[ScanFinding]:
+        findings = []
+        for path in file_index.glob("**/*.ext"):
+            content = accessor.read_file(path)
+            # detect and append ScanFinding objects
+        return findings
+```
+
+## Adding Framework Detection Rules
+
+Framework rules live in `src/quin_scanner/rules/`. Add entries to:
+
+- `dependencies.yaml` — package names per ecosystem
+- `code_patterns.yaml` — regex import/call patterns per language
+- `frameworks.yaml` — config file names with confidence and capability tags
+
+No code changes needed for most new frameworks — just YAML.
+
+---
+
+## Code Style
+
+- Python 3.11+ with type hints on all public functions
+- Dataclasses for data models (not Pydantic)
+- `pathlib.Path` for all filesystem operations
+- No hardcoded detection rules — use YAML rule files
+- No docstrings on internal helpers — only on public APIs
+- Keep functions small and focused; prefer composition over inheritance
+
+---
+
+## Commit Messages
+
+Use the imperative mood and keep the subject under 72 characters:
+
+```
+feat: add support for Bedrock runtime scanner
+fix: handle empty notebook cells in jupyter scanner
+docs: update framework list in README
+```
+
+---
+
+## Project Roadmap
+
+Features are released in numbered drops. The full plan is in [`docs/plans/2026-03-31-quin-agent-scanner-drop-plan.md`](docs/plans/2026-03-31-quin-agent-scanner-drop-plan.md).
+
+| Drop | Theme | Status |
+|---|---|---|
+| v0.1.0 | Scan Any Repo for AI | ✅ Released |
+| v0.2.0 | Understand the Risk | Planned |
+| v0.3.0 | Prove Compliance | Planned |
+| v0.4.0 | Automate in CI | Planned |
+| v0.5.0 | Scale to the Org | Planned |
+| v0.6.0 | Generate the Guardrails | Planned |
+| v0.7.0 | Make It Yours | Planned |
+
+If your contribution fits a planned drop, reference it in your PR.
+
+---
+
+## Questions?
+
+Open a [GitHub Discussion](https://github.com/quin-scanner/quin-agent-scanner/discussions) or file an issue.

quin_scanner-0.1.0b1/LICENSE

@@ -0,0 +1,183 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship made available under
+      the License, as indicated by a copyright notice that is included in
+      or attached to the work (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean, as submitted to the Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal Entity
+      authorized to submit on behalf of the copyright owner. For the purposes
+      of this definition, "submitted" means any form of electronic, verbal,
+      or written communication sent to the Licensor or its representatives,
+      including but not limited to communication on electronic mailing lists,
+      source code control systems, and issue tracking systems that are managed
+      by, or on behalf of, the Licensor for the purpose of developing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or designated in writing by the copyright owner as "Not a
+      Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor and included
+      within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by the combined work (in which such
+      Contribution(s) was submitted. If You institute patent litigation
+      against any entity (including a cross-claim or counterclaim in a
+      lawsuit) alleging that the Work or any Contribution embodied within
+      the Work constitutes direct or contributory patent infringement,
+      then any and all patent licenses granted to You under this License
+      for that Work shall terminate as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, You must include a readable copy of the
+          attribution notices contained within such NOTICE file, in
+          at least one of the following places: within a NOTICE text
+          file distributed as part of the Derivative Works; within
+          the Source form or documentation, if provided along with the
+          Derivative Works; or, within a display generated by the
+          Derivative Works, if and wherever such third-party notices
+          normally appear. The contents of the NOTICE file are for
+          informational purposes only and do not modify the License.
+          You may add Your own attribution notices within Derivative
+          Works that You distribute, alongside or in addition to the
+          NOTICE text from the Work, provided that such additional
+          attribution notices cannot be construed as modifying the License.
+
+      You may add Your own license statement for Your modifications and
+      may provide additional grant of rights to use, copy, modify, merge,
+      publish, distribute, sublicense, and/or sell copies of Your
+      Derivative Works, and to permit persons to whom the Derivative Works
+      is furnished to do so.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or reproducing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or exemplary damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or all other
+      commercial damages or losses), even if such Contributor has been
+      advised of the possibility of such damages.
+
+   9. Accepting Warranty or Liability. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a fee
+      for, acceptance of support, warranty, indemnity, or other liability
+      obligations and/or rights consistent with this License. However, in
+      accepting such obligations, You may offer only obligations consistent
+      with this License and not in direct conflict with this License, and
+      only if You agree to defend, indemnify, and hold each Contributor
+      harmless for any liability incurred by, or claims asserted against,
+      such Contributor by reason of your accepting any such warranty or
+      additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Quin Agent Scanner Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.