secure-review 1.0.0__tar.gz

secure_review-1.0.0/PKG-INFO

@@ -0,0 +1,3 @@
+Metadata-Version: 2.4
+Name: secure-review
+Version: 1.0.0

secure_review-1.0.0/README.md

@@ -0,0 +1,97 @@
+# AI Secure Review 🛡️
+
+AI Secure Review is a powerful, open-source, multi-agent codebase auditor and security scanner. Using a **LangGraph-driven orchestration engine**, it distributes analysis workloads across specialized AI agents to scan local files for vulnerabilities, logical flaws, manifest dependencies, architectural patterns, and documentation gaps.
+
+It includes an offline SAST engine (via Bandit) and launches a glowing, interactive React dashboard served directly from a built-in FastAPI backend.
+
+---
+
+## 🚀 Key Features
+
+* **Multi-Agent Orchestration**: Distributes codebase audits to specialized, parallel agents:
+  * 🔒 **Security Agent**: Scans for OWASP Top 10 vulnerabilities, hardcoded secrets, and injection flaws.
+  * 🐛 **Bug Agent**: Reviews code for logical errors, memory leaks, unclosed resource handles, and race conditions.
+  * 📦 **Dependency Agent**: Audits project manifest files (like `requirements.txt`, `package.json`) for outdated or insecure libraries.
+  * 🏛️ **Architecture Agent**: Evaluates structural coupling, cohesion, SOLID violations, and design patterns.
+  * 📝 **Documentation Agent**: Inspects docstrings, comments, and verifies repo `README.md` health.
+* **Hybrid Analysis**: Combines lightning-fast offline SAST heuristics with deep LLM-based logical inspections.
+* **Built-in React Dashboard**: Launches a modern, dark-themed UI served locally out of the Python package.
+* **Descriptive Telemetry**: Displays which agent is currently running and exactly which files it is auditing.
+* **Multi-Provider Support**: Compatible with Groq (GroqCloud), OpenAI, Google Gemini, Anthropic (Claude), Ollama (Local), and LM Studio.
+
+---
+
+## 📦 Installation
+
+Install AI Secure Review via pip from your compiled wheel package:
+
+```bash
+pip install secure_review-1.0.0-py3-none-any.whl
+```
+
+### For Developers (Build from Source)
+Clone the repository and compile the package automatically using our build script:
+```bash
+# Clone the repository
+git clone https://github.com/your-username/security-cli.git
+cd security-cli
+
+# Run one-click compilation (requires Python build dependencies & npm)
+.\build.bat
+
+# Install the generated package
+pip install dist\secure_review-1.0.0-py3-none-any.whl
+```
+
+---
+
+## 🛠️ Commands Guide
+
+AI Secure Review installs the global console command `secure-review`.
+
+### 1. Doctor (System Diagnostics)
+Verify your local environment dependencies (Git, Bandit) and confirm that your configured LLM provider has an active internet connection, correct credentials, and sufficient api limits:
+```bash
+secure-review doctor
+```
+
+### 2. Interactive Shell
+Boot the core application:
+```bash
+secure-review
+```
+Executing this command automatically:
+1. Starts the FastAPI backend daemon on port `8000`.
+2. Launches your default web browser pointing to [http://localhost:8000/](http://localhost:8000/).
+3. Enters an **interactive command console** in your terminal.
+
+---
+
+## 💻 Interactive Shell Commands
+
+While inside the CLI shell, you can type `/help` to see all active console hooks:
+
+| Command | Description |
+| :--- | :--- |
+| `/review [path]` | Scan a local codebase folder (default is current folder `.`) |
+| `/dashboard` | Re-open the React web dashboard in your default browser |
+| `/config` | Interactively configure active LLM providers and API keys |
+| `/providers` | Query the current active LLM configurations and check connections |
+| `/doctor` | Run system tools availability checks and connection tests |
+| `/clear` | Clear the console screen |
+| `/help` | Print out shell documentation |
+| `/exit` or `/quit` | Terminate the interactive session and backend daemon |
+
+---
+
+## 💻 Web Dashboard Actions
+When a scan is running, the React dashboard showcases:
+* **Workflow Progression**: Live node graphs syncing with backend LangGraph runs.
+* **Agent Telemetry**: Dynamic details explaining which agent is currently reading which file.
+* **One-Click Rescan**: Retries scans with one click after you update local files or manifest dependencies.
+* **Remediation Recommendation**: Technical explanations and code-fix suggestions displayed inside IDE syntax-themed blocks.
+
+---
+
+## 📄 License
+Distributed under the MIT License. See `LICENSE` for details.

secure_review-1.0.0/backend/__init__.py

@@ -0,0 +1 @@
+# backend package

secure_review-1.0.0/backend/app/__init__.py

@@ -0,0 +1 @@
+# AI Secure Review package

secure_review-1.0.0/backend/app/agents/__init__.py

@@ -0,0 +1 @@
+# Agents module

secure_review-1.0.0/backend/app/agents/architecture.py

@@ -0,0 +1,80 @@
+import json
+import uuid
+from typing import List, Dict, Any
+from backend.app.agents.base import get_llm
+from backend.app.utils.repo_scanner import get_file_content
+from backend.app.models.models import Issue
+
+def run_architecture_agent(repo_path: str, files_to_review: List[str]) -> List[Issue]:
+    if not files_to_review:
+        return []
+        
+    llm = get_llm()
+    issues: List[Issue] = []
+    
+    for file_rel in files_to_review:
+        file_content = get_file_content(repo_path, file_rel)
+        if not file_content:
+            continue
+            
+        prompt = f"""You are an expert Software Architect.
+Analyze the following source code file '{file_rel}' for architectural anti-patterns, design pattern violations, violation of separation of concerns, high coupling, low cohesion, or overly large and complex modules.
+
+File Content:
+```
+{file_content}
+```
+
+Return your findings in JSON format inside a markdown JSON code block. If no architectural issues are found, return an empty array [].
+Each finding must fit the following JSON schema:
+[
+  {{
+    "line": 1, // usually 1 for architectural suggestions, or specific line
+    "severity": "MEDIUM", // CRITICAL, HIGH, MEDIUM, LOW
+    "title": "Architectural Issue: [Title]",
+    "description": "Short explanation of the architectural or structural flaw",
+    "explanation": "Detailed explanation of why this architectural choice scales poorly, affects maintainability, or violates standards.",
+    "suggested_fix": "Refactoring plan or structural suggestion.",
+    "confidence": "HIGH" // HIGH, MEDIUM, LOW
+  }}
+]
+
+Make sure to return valid JSON inside a ```json ``` block. Focus on structural cleanups and class/module design.
+JSON Output:
+"""
+        try:
+            response = llm.invoke(prompt)
+            content = response.content
+            
+            # Extract JSON block
+            json_str = ""
+            if "```json" in content:
+                json_str = content.split("```json")[1].split("```")[0].strip()
+            elif "```" in content:
+                json_str = content.split("```")[1].split("```")[0].strip()
+            else:
+                json_str = content.strip()
+                
+            findings = json.loads(json_str)
+            if isinstance(findings, list):
+                for f in findings:
+                    line = f.get("line", 1)
+                    title = f.get("title", "Architecture Finding")
+                    
+                    issue_id = str(uuid.uuid5(uuid.NAMESPACE_DNS, f"architecture-{file_rel}-{line}-{title}"))
+                    issues.append(Issue(
+                        id=issue_id,
+                        file=file_rel,
+                        line=line,
+                        severity=f.get("severity", "MEDIUM").upper(),
+                        category="Architecture",
+                        title=title,
+                        description=f.get("description", ""),
+                        explanation=f.get("explanation", ""),
+                        suggested_fix=f.get("suggested_fix", ""),
+                        confidence=f.get("confidence", "MEDIUM")
+                    ))
+        except Exception as e:
+            print(f"[Architecture Agent] Error analyzing {file_rel}: {e}")
+            
+    return issues

secure_review-1.0.0/backend/app/agents/base.py

@@ -0,0 +1,35 @@
+import os
+from typing import Any
+from langchain_openai import ChatOpenAI
+from langchain_anthropic import ChatAnthropic
+from backend.app.config.config import load_config
+
+def get_llm() -> Any:
+    config = load_config()
+    provider = config.provider.lower()
+    api_key = config.api_key or "no-key-required"
+    
+    if provider == "anthropic":
+        # Anthropic standard Claude models
+        return ChatAnthropic(
+            api_key=api_key,
+            model=config.model,
+            temperature=config.temperature,
+        )
+    else:
+        # ChatOpenAI supports OpenAI, Ollama, LM Studio, and Gemini
+        base_url = config.base_url
+        
+        if provider == "openai" and (not base_url or "localhost" in base_url):
+            base_url = "https://api.openai.com/v1"
+        elif provider == "groq" and (not base_url or "localhost" in base_url):
+            base_url = "https://api.groq.com/openai/v1"
+        elif provider == "gemini" and (not base_url or "localhost" in base_url):
+            base_url = "https://generativelanguage.googleapis.com/v1beta/openai/"
+            
+        return ChatOpenAI(
+            api_key=api_key,
+            base_url=base_url,
+            model=config.model,
+            temperature=config.temperature,
+        )

secure_review-1.0.0/backend/app/agents/bug.py

@@ -0,0 +1,80 @@
+import json
+import uuid
+from typing import List, Dict, Any
+from backend.app.agents.base import get_llm
+from backend.app.utils.repo_scanner import get_file_content
+from backend.app.models.models import Issue
+
+def run_bug_agent(repo_path: str, files_to_review: List[str]) -> List[Issue]:
+    if not files_to_review:
+        return []
+        
+    llm = get_llm()
+    issues: List[Issue] = []
+    
+    for file_rel in files_to_review:
+        file_content = get_file_content(repo_path, file_rel)
+        if not file_content:
+            continue
+            
+        prompt = f"""You are an expert Senior Code Quality Engineer.
+Analyze the following source code file '{file_rel}' for bugs, logic issues, dead code, resource leaks (e.g. unclosed files, DB connections), exception handling anti-patterns (e.g. bare excepts, swallowed errors), race conditions, and performance bottlenecks.
+
+File Content:
+```
+{file_content}
+```
+
+Return your findings in JSON format inside a markdown JSON code block. If no quality/logic issues are found, return an empty array [].
+Each finding must fit the following JSON schema:
+[
+  {{
+    "line": 42,
+    "severity": "HIGH", // CRITICAL, HIGH, MEDIUM, LOW
+    "title": "Bug/Quality Issue: [Title]",
+    "description": "Short explanation of the bug or code quality violation",
+    "explanation": "Detailed explanation of why this code is problematic and what runtime issues it could cause.",
+    "suggested_fix": "Refactored code snippet or exact steps to fix the issue.",
+    "confidence": "HIGH" // HIGH, MEDIUM, LOW
+  }}
+]
+
+Make sure to return valid JSON inside a ```json ``` block. Focus on code that is active, confusing, or logically incorrect.
+JSON Output:
+"""
+        try:
+            response = llm.invoke(prompt)
+            content = response.content
+            
+            # Extract JSON block
+            json_str = ""
+            if "```json" in content:
+                json_str = content.split("```json")[1].split("```")[0].strip()
+            elif "```" in content:
+                json_str = content.split("```")[1].split("```")[0].strip()
+            else:
+                json_str = content.strip()
+                
+            findings = json.loads(json_str)
+            if isinstance(findings, list):
+                for f in findings:
+                    line = f.get("line", 1)
+                    title = f.get("title", "Code Quality Finding")
+                    
+                    issue_id = str(uuid.uuid5(uuid.NAMESPACE_DNS, f"bug-{file_rel}-{line}-{title}"))
+                    issues.append(Issue(
+                        id=issue_id,
+                        file=file_rel,
+                        line=line,
+                        severity=f.get("severity", "MEDIUM").upper(),
+                        category="Bug",
+                        title=title,
+                        description=f.get("description", ""),
+                        explanation=f.get("explanation", ""),
+                        suggested_fix=f.get("suggested_fix", ""),
+                        confidence=f.get("confidence", "MEDIUM")
+                    ))
+        except Exception as e:
+            print(f"[Bug Agent] Error analyzing {file_rel}: {e}")
+            
+    return issues

secure_review-1.0.0/backend/app/agents/dependency.py

@@ -0,0 +1,80 @@
+import json
+import uuid
+from typing import List, Dict, Any
+from backend.app.agents.base import get_llm
+from backend.app.utils.repo_scanner import get_file_content
+from backend.app.models.models import Issue
+
+def run_dependency_agent(repo_path: str, files_to_review: List[str]) -> List[Issue]:
+    if not files_to_review:
+        return []
+        
+    llm = get_llm()
+    issues: List[Issue] = []
+    
+    for file_rel in files_to_review:
+        file_content = get_file_content(repo_path, file_rel)
+        if not file_content:
+            continue
+            
+        prompt = f"""You are an expert Dependency Security Engineer.
+Analyze the following dependency manifest '{file_rel}' for security vulnerabilities (outdated packages, packages with known vulnerabilities/CVEs, malicious/typosquatted packages, deprecated packages).
+
+File Content:
+```
+{file_content}
+```
+
+Return your findings in JSON format inside a markdown JSON code block. If no vulnerable dependencies are found, return an empty array [].
+Each finding must fit the following JSON schema:
+[
+  {{
+    "line": 12, // approximate line of the package in the file, or 1 if not clear
+    "severity": "HIGH", // CRITICAL, HIGH, MEDIUM, LOW
+    "title": "Vulnerable library: [package-name]",
+    "description": "Short explanation of the CVE/vulnerability or deprecation in this package",
+    "explanation": "Detailed explanation of why this library version is insecure, the CVE number if known, and the impact.",
+    "suggested_fix": "Command to upgrade the package or target version (e.g. 'Upgrade package-name to v1.2.3')",
+    "confidence": "HIGH" // HIGH, MEDIUM, LOW
+  }}
+]
+
+Make sure to return valid JSON inside a ```json ``` block. Focus on known public CVEs for packages (e.g. log4j, lodash, flask, django, axios, request).
+JSON Output:
+"""
+        try:
+            response = llm.invoke(prompt)
+            content = response.content
+            
+            # Extract JSON block
+            json_str = ""
+            if "```json" in content:
+                json_str = content.split("```json")[1].split("```")[0].strip()
+            elif "```" in content:
+                json_str = content.split("```")[1].split("```")[0].strip()
+            else:
+                json_str = content.strip()
+                
+            findings = json.loads(json_str)
+            if isinstance(findings, list):
+                for f in findings:
+                    line = f.get("line", 1)
+                    title = f.get("title", "Vulnerable Dependency")
+                    
+                    issue_id = str(uuid.uuid5(uuid.NAMESPACE_DNS, f"dependency-{file_rel}-{line}-{title}"))
+                    issues.append(Issue(
+                        id=issue_id,
+                        file=file_rel,
+                        line=line,
+                        severity=f.get("severity", "MEDIUM").upper(),
+                        category="Dependency",
+                        title=title,
+                        description=f.get("description", ""),
+                        explanation=f.get("explanation", ""),
+                        suggested_fix=f.get("suggested_fix", ""),
+                        confidence=f.get("confidence", "MEDIUM")
+                    ))
+        except Exception as e:
+            print(f"[Dependency Agent] Error analyzing {file_rel}: {e}")
+            
+    return issues

secure_review-1.0.0/backend/app/agents/documentation.py

@@ -0,0 +1,118 @@
+import json
+import uuid
+from typing import List, Dict, Any
+from backend.app.agents.base import get_llm
+from backend.app.utils.repo_scanner import get_file_content
+from backend.app.models.models import Issue
+
+def run_documentation_agent(repo_path: str, files_to_review: List[str]) -> List[Issue]:
+    issues: List[Issue] = []
+    
+    # Check if a README.md exists in the root or subfolders
+    import os
+    readme_exists = False
+    for root, dirs, files in os.walk(repo_path):
+        # Prevent searching inside ignored directories
+        dirs[:] = [d for d in dirs if d not in (".git", "venv", "node_modules", ".pytest_cache", "__pycache__")]
+        if any(f.lower() == "readme.md" for f in files):
+            readme_exists = True
+            break
+            
+    if not readme_exists:
+        issue_id = str(uuid.uuid5(uuid.NAMESPACE_DNS, f"documentation-missing-readme-{repo_path}"))
+        issues.append(Issue(
+            id=issue_id,
+            file="README.md",
+            line=1,
+            severity="HIGH",
+            category="Documentation",
+            title="Missing Repository Documentation (README.md)",
+            description="The repository does not contain a README.md file in the root or directories.",
+            explanation="A README.md file is critical for onboarding developers, detailing project setup guidelines, specifying dependencies, and explaining utility usages. Lacking it makes code maintenance difficult.",
+            suggested_fix="Create a README.md file in the root directory outlining the project name, description, setup commands, and architecture overview.",
+            confidence="HIGH"
+        ))
+
+    if not files_to_review:
+        if readme_exists:
+            # Find the actual path of the README.md
+            for root, dirs, files in os.walk(repo_path):
+                dirs[:] = [d for d in dirs if d not in (".git", "venv", "node_modules", ".pytest_cache", "__pycache__")]
+                for f in files:
+                    if f.lower() == "readme.md":
+                        rel_path = os.path.relpath(os.path.join(root, f), repo_path).replace('\\', '/')
+                        files_to_review = [rel_path]
+                        break
+                if files_to_review:
+                    break
+        else:
+            return issues
+            
+    llm = get_llm()
+    
+    for file_rel in files_to_review:
+        file_content = get_file_content(repo_path, file_rel)
+        if not file_content:
+            continue
+            
+        prompt = f"""You are an expert technical writer and code auditor.
+Analyze the following document or code file '{file_rel}' for documentation completeness, clarity, accuracy, missing setup guides, missing docstrings, or obsolete comments.
+
+File Content:
+```
+{file_content}
+```
+
+Return your findings in JSON format inside a markdown JSON code block. If no documentation issues are found, return an empty array [].
+Each finding must fit the following JSON schema:
+[
+  {{
+    "line": 1,
+    "severity": "LOW", // CRITICAL, HIGH, MEDIUM, LOW
+    "title": "Documentation Issue: [Title]",
+    "description": "Short explanation of the missing or incomplete documentation item",
+    "explanation": "Detailed explanation of why having this documentation matters for developers, users, or contributors.",
+    "suggested_fix": "Write down the recommended text or docstring to add, or outline a README structure.",
+    "confidence": "HIGH" // HIGH, MEDIUM, LOW
+  }}
+]
+
+Make sure to return valid JSON inside a ```json ``` block. Focus on usability and developer onboarding.
+JSON Output:
+"""
+        try:
+            response = llm.invoke(prompt)
+            content = response.content
+            
+            # Extract JSON block
+            json_str = ""
+            if "```json" in content:
+                json_str = content.split("```json")[1].split("```")[0].strip()
+            elif "```" in content:
+                json_str = content.split("```")[1].split("```")[0].strip()
+            else:
+                json_str = content.strip()
+                
+            findings = json.loads(json_str)
+            if isinstance(findings, list):
+                for f in findings:
+                    line = f.get("line", 1)
+                    title = f.get("title", "Documentation Finding")
+                    
+                    issue_id = str(uuid.uuid5(uuid.NAMESPACE_DNS, f"documentation-{file_rel}-{line}-{title}"))
+                    issues.append(Issue(
+                        id=issue_id,
+                        file=file_rel,
+                        line=line,
+                        severity=f.get("severity", "LOW").upper(),
+                        category="Documentation",
+                        title=title,
+                        description=f.get("description", ""),
+                        explanation=f.get("explanation", ""),
+                        suggested_fix=f.get("suggested_fix", ""),
+                        confidence=f.get("confidence", "MEDIUM")
+                    ))
+        except Exception as e:
+            print(f"[Documentation Agent] Error analyzing {file_rel}: {e}")
+            
+    return issues

secure_review-1.0.0/backend/app/agents/planner.py

@@ -0,0 +1,66 @@
+from typing import Dict, Any, List
+from pathlib import Path
+
+# Deterministic routing based on file types
+def run_planner(scan_result: Dict[str, Any]) -> Dict[str, List[str]]:
+    files = scan_result.get("files", [])
+    
+    # Filter files into categories
+    security_candidates = []
+    bug_candidates = []
+    arch_candidates = []
+    dep_candidates = []
+    doc_candidates = []
+
+    # Important file markers to prioritize
+    priority_keywords = {"main", "app", "server", "index", "route", "controller", "db", "auth", "config", "util"}
+
+    for f in files:
+        f_lower = f.lower()
+        path = Path(f)
+        ext = path.suffix.lower()
+
+        # Dependencies
+        if path.name.lower() in ("package.json", "requirements.txt", "go.mod", "cargo.toml", "pipfile", "pyproject.toml"):
+            dep_candidates.append(f)
+            
+        # Documentation
+        elif ext in (".md", ".txt", ".rst") or "docs/" in f_lower or "doc/" in f_lower:
+            doc_candidates.append(f)
+            
+        # Code files
+        elif ext in (".py", ".js", ".ts", ".tsx", ".jsx", ".go", ".rs", ".java", ".cs", ".php", ".rb", ".sh"):
+            # Check if it has priority keywords or is relatively small/medium
+            is_priority = any(k in path.stem.lower() for k in priority_keywords)
+            
+            # Security targets authentication, db, routes, or priority files
+            if is_priority or any(x in f_lower for x in ("auth", "db", "sql", "api", "route", "controller")):
+                security_candidates.append(f)
+            else:
+                # Add up to 5 general code files to keep it fast
+                if len(security_candidates) < 10:
+                    security_candidates.append(f)
+
+            # Bug / quality targets general code files
+            if is_priority or len(bug_candidates) < 10:
+                bug_candidates.append(f)
+
+            # Architecture looks at main structures, imports, and config files
+            if is_priority or len(arch_candidates) < 8:
+                arch_candidates.append(f)
+
+    # Fallbacks if list is empty but files exist
+    if not security_candidates and files:
+        security_candidates = [f for f in files if Path(f).suffix.lower() in (".py", ".js", ".ts", ".tsx")][:5]
+    if not bug_candidates and files:
+        bug_candidates = [f for f in files if Path(f).suffix.lower() in (".py", ".js", ".ts", ".tsx")][:5]
+    if not arch_candidates and files:
+        arch_candidates = [f for f in files if Path(f).suffix.lower() in (".py", ".js", ".ts", ".tsx")][:5]
+
+    return {
+        "security": security_candidates,
+        "dependency": dep_candidates,
+        "bug": bug_candidates,
+        "architecture": arch_candidates,
+        "documentation": doc_candidates
+    }