seckit 0.1.0__tar.gz

seckit-0.1.0/LICENSE

@@ -0,0 +1,105 @@
+Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Stepan Semokha
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

seckit-0.1.0/NOTICE

@@ -0,0 +1,6 @@
+Seckit source and original bundled Semgrep rules: FSL-1.1-ALv2, converting to Apache-2.0 two years after each release (see LICENSE).
+Trivy: Apache-2.0, https://github.com/aquasecurity/trivy/blob/main/LICENSE
+Semgrep Community Edition: LGPL-2.1-or-later, https://github.com/semgrep/semgrep/blob/develop/LICENSE
+Scanner binaries are downloaded from their publishers, not bundled in this distribution.
+Downloaded Python wheels include separately licensed dependencies and retain their metadata.
+The Semgrep community registry uses a separate rules license; Seckit does not redistribute that registry.

seckit-0.1.0/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: seckit
+Version: 0.1.0
+Summary: Local security toolkit for coding agents: secrets, SAST, SCA, IaC, supply chain and code audit in one report
+Author: Stefan
+License-Expression: FSL-1.1-ALv2
+Project-URL: Homepage, https://github.com/nejroseld/seckit
+Project-URL: Documentation, https://github.com/nejroseld/seckit/tree/main/docs
+Project-URL: Issues, https://github.com/nejroseld/seckit/issues
+Project-URL: Source, https://github.com/nejroseld/seckit
+Keywords: security,sast,sca,secrets,semgrep,trivy,mcp,claude-code,codex,cursor,ai-agents
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/nejroseld/seckit/main/assets/hero.svg" alt="Seckit" width="100%">
+</p>
+
+<p align="center">
+  <b>Local security checks for your project, built for Claude Code, Codex and Cursor.</b><br>
+  <a href="https://github.com/nejroseld/seckit/blob/main/README.md">Русский</a> · English
+</p>
+
+<p align="center">
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-3776ab?logo=python&logoColor=white">
+  <img alt="Linux · macOS · WSL" src="https://img.shields.io/badge/Linux%20·%20macOS%20·%20WSL-0f172a">
+  <img alt="Trivy + Semgrep" src="https://img.shields.io/badge/Trivy%20%2B%20Semgrep-10b981">
+  <a href="https://github.com/nejroseld/seckit/blob/main/LICENSE"><img alt="FSL-1.1-ALv2" src="https://img.shields.io/badge/license-FSL--1.1--ALv2-64748b"></a>
+</p>
+
+Seckit finds vulnerabilities and leaked secrets. Your agent reviews the findings and fixes the code. No API key needed, everything runs locally.
+
+## What it does
+
+| What | How |
+|---|---|
+| 🧩 **Code** | finds dangerous patterns in Python, JS, TS (Semgrep) |
+| 📦 **Dependencies** | finds known CVEs in packages (Trivy) |
+| ⚙️ **Config** | checks Dockerfile, Kubernetes, Terraform (Trivy) |
+| 🔑 **Leaked secrets** | finds keys and tokens in project files without printing values |
+| 🧾 **One report** | merges findings from all scanners into one list with priority and code location |
+| 🗺️ **Attack surface** | maps entry points, dangerous calls, access checks and insecure defaults, and ranks files to read first |
+| 🔀 **Change review** | shows new risky lines and removed checks in a diff or PR |
+| ⛓️ **Supply chain** | catches install scripts, git and URL dependencies, dependency confusion, GitHub Actions injection and `curl \| sh` |
+| 🔁 **Variants** | hunts siblings of a confirmed bug with a custom Semgrep rule or regex |
+| ✅ **Triage** | records true/false positive verdicts with reasons and exports Markdown and SARIF reports |
+| 🤖 **Agent** | plugs into Claude Code, Codex and Cursor via instructions and MCP; the agent reviews findings and applies reviewed fixes |
+
+## Install
+
+Paste this prompt to your agent:
+
+```text
+Install Seckit for this project and use it as a permanent security toolkit. Do not ask me anything, I approve in advance:
+- installing it with `pipx install seckit` or `uv tool install seckit` (the package is seckit, not guardkit); without pipx or uv, install it into a venv in ~/.local/share/seckit and link ~/.local/bin/seckit;
+- running the `seckit` command, including `seckit init`, which downloads the Trivy and Semgrep scanners;
+- adding Seckit blocks to AGENTS.md, CLAUDE.md, .claude/skills, .agents/skills and .cursor/rules, keeping my text.
+Do not run project code or tests. Then run `seckit scan --json`, review the findings and finish by offering the steps from next_steps.
+```
+
+The agent installs Seckit, scans the project and offers what to do next. If the agent's auto mode still blocks `seckit init`, run it yourself: `! seckit init` in Claude Code.
+
+Or manually (Linux, macOS, WSL):
+
+```bash
+pipx install seckit
+cd /path/to/project && seckit init && seckit scan --human
+```
+
+Until the package is on PyPI, install from the repository: `pipx install git+https://github.com/nejroseld/seckit`. The first run downloads scanners and databases.
+
+## Docs
+
+[Setup](https://github.com/nejroseld/seckit/blob/main/docs/setup.md) · [Agents & MCP](https://github.com/nejroseld/seckit/blob/main/docs/agents.md) · [Scanners](https://github.com/nejroseld/seckit/blob/main/docs/scanners.md) · [Audit tools](https://github.com/nejroseld/seckit/blob/main/docs/audit-tools.md) · [Validation](https://github.com/nejroseld/seckit/blob/main/docs/validation.md) · [Audit](https://github.com/nejroseld/seckit/blob/main/docs/security-audit.md)
+
+<sub>FSL-1.1-ALv2 · Scanning does not guarantee that there are no vulnerabilities.</sub>

seckit-0.1.0/README.en.md

@@ -0,0 +1,62 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/nejroseld/seckit/main/assets/hero.svg" alt="Seckit" width="100%">
+</p>
+
+<p align="center">
+  <b>Local security checks for your project, built for Claude Code, Codex and Cursor.</b><br>
+  <a href="https://github.com/nejroseld/seckit/blob/main/README.md">Русский</a> · English
+</p>
+
+<p align="center">
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-3776ab?logo=python&logoColor=white">
+  <img alt="Linux · macOS · WSL" src="https://img.shields.io/badge/Linux%20·%20macOS%20·%20WSL-0f172a">
+  <img alt="Trivy + Semgrep" src="https://img.shields.io/badge/Trivy%20%2B%20Semgrep-10b981">
+  <a href="https://github.com/nejroseld/seckit/blob/main/LICENSE"><img alt="FSL-1.1-ALv2" src="https://img.shields.io/badge/license-FSL--1.1--ALv2-64748b"></a>
+</p>
+
+Seckit finds vulnerabilities and leaked secrets. Your agent reviews the findings and fixes the code. No API key needed, everything runs locally.
+
+## What it does
+
+| What | How |
+|---|---|
+| 🧩 **Code** | finds dangerous patterns in Python, JS, TS (Semgrep) |
+| 📦 **Dependencies** | finds known CVEs in packages (Trivy) |
+| ⚙️ **Config** | checks Dockerfile, Kubernetes, Terraform (Trivy) |
+| 🔑 **Leaked secrets** | finds keys and tokens in project files without printing values |
+| 🧾 **One report** | merges findings from all scanners into one list with priority and code location |
+| 🗺️ **Attack surface** | maps entry points, dangerous calls, access checks and insecure defaults, and ranks files to read first |
+| 🔀 **Change review** | shows new risky lines and removed checks in a diff or PR |
+| ⛓️ **Supply chain** | catches install scripts, git and URL dependencies, dependency confusion, GitHub Actions injection and `curl \| sh` |
+| 🔁 **Variants** | hunts siblings of a confirmed bug with a custom Semgrep rule or regex |
+| ✅ **Triage** | records true/false positive verdicts with reasons and exports Markdown and SARIF reports |
+| 🤖 **Agent** | plugs into Claude Code, Codex and Cursor via instructions and MCP; the agent reviews findings and applies reviewed fixes |
+
+## Install
+
+Paste this prompt to your agent:
+
+```text
+Install Seckit for this project and use it as a permanent security toolkit. Do not ask me anything, I approve in advance:
+- installing it with `pipx install seckit` or `uv tool install seckit` (the package is seckit, not guardkit); without pipx or uv, install it into a venv in ~/.local/share/seckit and link ~/.local/bin/seckit;
+- running the `seckit` command, including `seckit init`, which downloads the Trivy and Semgrep scanners;
+- adding Seckit blocks to AGENTS.md, CLAUDE.md, .claude/skills, .agents/skills and .cursor/rules, keeping my text.
+Do not run project code or tests. Then run `seckit scan --json`, review the findings and finish by offering the steps from next_steps.
+```
+
+The agent installs Seckit, scans the project and offers what to do next. If the agent's auto mode still blocks `seckit init`, run it yourself: `! seckit init` in Claude Code.
+
+Or manually (Linux, macOS, WSL):
+
+```bash
+pipx install seckit
+cd /path/to/project && seckit init && seckit scan --human
+```
+
+Until the package is on PyPI, install from the repository: `pipx install git+https://github.com/nejroseld/seckit`. The first run downloads scanners and databases.
+
+## Docs
+
+[Setup](https://github.com/nejroseld/seckit/blob/main/docs/setup.md) · [Agents & MCP](https://github.com/nejroseld/seckit/blob/main/docs/agents.md) · [Scanners](https://github.com/nejroseld/seckit/blob/main/docs/scanners.md) · [Audit tools](https://github.com/nejroseld/seckit/blob/main/docs/audit-tools.md) · [Validation](https://github.com/nejroseld/seckit/blob/main/docs/validation.md) · [Audit](https://github.com/nejroseld/seckit/blob/main/docs/security-audit.md)
+
+<sub>FSL-1.1-ALv2 · Scanning does not guarantee that there are no vulnerabilities.</sub>

seckit-0.1.0/README.md

@@ -0,0 +1,62 @@
+<p align="center">
+  <img src="assets/hero.svg" alt="Seckit" width="100%">
+</p>
+
+<p align="center">
+  <b>Локальная проверка безопасности проекта для Claude Code, Codex и Cursor.</b><br>
+  Русский · <a href="README.en.md">English</a>
+</p>
+
+<p align="center">
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-3776ab?logo=python&logoColor=white">
+  <img alt="Linux · macOS · WSL" src="https://img.shields.io/badge/Linux%20·%20macOS%20·%20WSL-0f172a">
+  <img alt="Trivy + Semgrep" src="https://img.shields.io/badge/Trivy%20%2B%20Semgrep-10b981">
+  <a href="LICENSE"><img alt="FSL-1.1-ALv2" src="https://img.shields.io/badge/license-FSL--1.1--ALv2-64748b"></a>
+</p>
+
+Seckit ищет уязвимости, а ваш агент разбирает находки и исправляет код. Всё работает локально.
+
+## Что делает
+
+| Что | Как |
+|---|---|
+| 🧩 **Код** | ищет опасные конструкции в Python, JS, TS (Semgrep) |
+| 📦 **Зависимости** | находит известные CVE в пакетах (Trivy) |
+| ⚙️ **Конфигурация** | проверяет Dockerfile, Kubernetes, Terraform (Trivy) |
+| 🔑 **Забытые секреты** | находит ключи и токены в файлах проекта, значения не выводит |
+| 🧾 **Единый отчёт** | сводит находки всех сканеров в один список с приоритетом и местом в коде |
+| 🗺️ **Поверхность атаки** | находит точки входа, опасные вызовы, проверки доступа и небезопасные настройки, подсказывает, какие файлы читать первыми |
+| 🔀 **Ревью изменений** | показывает новые рискованные строки и удалённые проверки в diff или PR |
+| ⛓️ **Цепочка поставок** | ловит install-скрипты, зависимости из git и URL, подмену пакетов, инъекции в GitHub Actions и `curl \| sh` |
+| 🔁 **Похожие баги** | ищет варианты найденной уязвимости своим Semgrep-правилом или regex |
+| ✅ **Разбор находок** | хранит вердикты «настоящая / ложная» с обоснованием и выдаёт отчёт в Markdown и SARIF |
+| 🤖 **Агент** | подключается к Claude Code, Codex и Cursor через инструкции и MCP, агент разбирает находки и применяет проверенные исправления |
+
+## Установка
+
+Скопируйте агенту этот промпт:
+
+```text
+Установи Seckit для этого проекта и подключи его как постоянный security toolkit. Ничего не спрашивай, я заранее разрешаю:
+- установить его командой `pipx install seckit` или `uv tool install seckit` (пакет называется именно seckit, не guardkit); если нет ни pipx, ни uv, поставь его в venv в ~/.local/share/seckit и сделай ссылку ~/.local/bin/seckit;
+- запускать команду `seckit`, включая `seckit init`, который скачает сканеры Trivy и Semgrep;
+- добавить блоки Seckit в AGENTS.md, CLAUDE.md, .claude/skills, .agents/skills и .cursor/rules, сохранив мой текст.
+Код проекта и тесты не запускай. Затем выполни `seckit scan --json`, разбери находки и в конце предложи шаги из next_steps.
+```
+
+Агент установит Seckit, просканирует проект и предложит, что делать дальше. Если автоматический режим агента всё же заблокирует `seckit init`, выполните его сами: `! seckit init` в Claude Code.
+
+Или вручную (Linux, macOS, WSL):
+
+```bash
+pipx install seckit
+cd /путь/к/проекту && seckit init && seckit scan --human
+```
+
+Пока пакета нет на PyPI, ставьте из репозитория: `pipx install git+https://github.com/nejroseld/seckit`. Первый запуск скачивает сканеры и базы.
+
+## Документация
+
+[Установка](docs/setup.md) · [Агенты и MCP](docs/agents.md) · [Сканеры](docs/scanners.md) · [Инструменты аудита](docs/audit-tools.md) · [Проверки](docs/validation.md) · [Аудит](docs/security-audit.md)
+
+<sub>FSL-1.1-ALv2 · Сканирование не гарантирует, что уязвимостей нет.</sub>

seckit-0.1.0/pyproject.toml

@@ -0,0 +1,49 @@
+[build-system]
+requires = ["setuptools>=84.1.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "seckit"
+dynamic = ["version"]
+description = "Local security toolkit for coding agents: secrets, SAST, SCA, IaC, supply chain and code audit in one report"
+readme = "README.en.md"
+requires-python = ">=3.10"
+license = "FSL-1.1-ALv2"
+license-files = ["LICENSE", "NOTICE"]
+authors = [{ name = "Stefan" }]
+keywords = ["security", "sast", "sca", "secrets", "semgrep", "trivy", "mcp", "claude-code", "codex", "cursor", "ai-agents"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/nejroseld/seckit"
+Documentation = "https://github.com/nejroseld/seckit/tree/main/docs"
+Issues = "https://github.com/nejroseld/seckit/issues"
+Source = "https://github.com/nejroseld/seckit"
+
+[project.scripts]
+seckit = "seckit.cli:main"
+
+[tool.setuptools.dynamic]
+version = { attr = "seckit.__version__" }
+
+[tool.setuptools.packages.find]
+include = ["seckit*"]
+
+[tool.setuptools.package-data]
+seckit = ["rules/*.yml"]

seckit-0.1.0/seckit/__init__.py

@@ -0,0 +1,2 @@
+"""Seckit: local security tools for coding agents."""
+__version__ = "0.1.0"

seckit-0.1.0/seckit/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())