Metadata-Version: 2.4
Name: vishap-analyzer
Version: 7.2.6
Summary: Vishap - multi-material IT analyst (code, config, spec, logs, data). 6-stage LLM pipeline with SAST/SCA, SARIF 2.1.0, OWASP Top 10, audit trail (SHA-256), provenance, exploitability.
Author-email: "David (dvddv9)" <hndav9@yahoo.com>
License-Expression: AGPL-3.0-or-later
Keywords: vishap,vishap-analyzer,security,sast,sca,sarif,owasp,llm,multi-material,code-review,audit-trail,compliance,pii,deepseek
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests>=2.32.0
Requires-Dist: python-dotenv>=1.0.0
Requires-Dist: fastapi>=0.115.0
Requires-Dist: uvicorn[standard]>=0.30.0
Requires-Dist: pydantic>=2.9.0
Requires-Dist: pydantic-settings>=2.5.0
Requires-Dist: radon>=6.0.0
Requires-Dist: tenacity>=9.2.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: cyclonedx-bom>=7.0.0
Requires-Dist: sqlalchemy[asyncio]>=2.0.30
Requires-Dist: asyncpg>=0.29.0
Requires-Dist: alembic>=1.13.0
Requires-Dist: structlog>=24.0.0
Requires-Dist: prometheus-client>=0.20.0
Requires-Dist: cryptography>=42.0.0
Requires-Dist: zstandard>=0.22.0
Requires-Dist: celery[redis]>=5.3.0
Requires-Dist: redis>=5.0.0
Requires-Dist: PyJWT>=2.9.0
Requires-Dist: stripe>=10.0.0
Requires-Dist: opentelemetry-api>=1.25.0
Requires-Dist: opentelemetry-sdk>=1.25.0
Requires-Dist: opentelemetry-instrumentation-fastapi>=0.46b0
Requires-Dist: opentelemetry-instrumentation-celery>=0.46b0
Requires-Dist: opentelemetry-exporter-otlp>=1.25.0
Requires-Dist: pyyaml>=6.0.0
Requires-Dist: tree-sitter>=0.23.0
Requires-Dist: tree-sitter-javascript>=0.23.0
Requires-Dist: tree-sitter-typescript>=0.23.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0.0; extra == "dev"
Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
Requires-Dist: black>=24.0.0; extra == "dev"
Dynamic: license-file

# 🐉 Vishap

![Vishap Dashboard](docs/screenshots/dashboard.png)

[![CI](https://github.com/dvddv9/vishap/actions/workflows/ci.yml/badge.svg)](https://github.com/dvddv9/vishap/actions/workflows/ci.yml)
[![Docs](https://github.com/dvddv9/vishap/actions/workflows/docs.yml/badge.svg)](https://dvddv9.github.io/vishap/)
[![Version](https://img.shields.io/badge/version-7.2.2-blue)](https://github.com/dvddv9/vishap/releases/tag/v7.2.2)
[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)

> 🐉 **Vishap** — 6-stage LLM pipeline for analyzing engineering materials (code, spec, logs, config, data).

**Vishap** takes a file as input → returns a structured Markdown report with risks, STRIDE threat model, refactoring options and **audit trail** with PII detection and compliance flags.

## 🌐 Live demo

| Service | URL | Stack |
|---------|-----|-------|
| **Frontend** | [vishap-ui.onrender.com](https://vishap-ui.onrender.com) | Next.js 16 · Node 24 |
| **Backend** | [vishap-zwpx.onrender.com](https://vishap-zwpx.onrender.com) | FastAPI · Docker |
| **API docs** | [/docs](https://vishap-zwpx.onrender.com/docs) | Swagger UI |

> ⚠️ Free tier: first request may take 30–50 s (cold start).

## 🎉 What's new in v7.2.6

- **JavaScript / TypeScript support**: `detect_language` (.js/.jsx/.mjs/.cjs/.ts/.tsx), `js_parser.scan_js_patterns` (XSS, SQLi, RCE, path traversal, command injection), LLM hints in `build_prompt`.

### Audit evidence (#1–#8)
- **#1 `context_thread`** — wires metrics / cwe / evidence → activates #3 / #5 / #6
- **#2 `compute_critique_verdict`** — `NEEDS_VERIFICATION` / `REQUIRES_REVIEW` / `SAFE`; critical `risk_nodes` / `security` → `REQUIRES_REVIEW`
- **#3 `fidelity_index`** — 0.0–1.0; bias passed when in `[0.3, 0.95]`
- **#4 `negative_evidence`** — checked-but-not-found CWEs with reason
- **#5 `reproducer`** — runnable `python -c` + verified via `sys.executable`
- **#6 `bias_check`** — critical_ratio, FI-range, RCE-without-critical
- **#7 `CWE_MAPPING`** — 15 keys
- **#8 `report_date` / `valid_until`** — ISO + 90 days

### UI (`ui-next/`)
- **LLMSettings**: provider = `custom` | `harness` (DeepSeek via custom)
- **Report v7.2 block**: Fidelity / Bias check / Reproducer / Negative evidence / Report date / valid_until
- **CORS fix**: `app.add_middleware(CORSMiddleware, ...)` — Settings form works in browser
- **mojibake fix**: em-dash `—`, ellipsis `…`, emoji 🐉

### Backend
- **`async_chat`** — respects `VISHAP_LLM_PROVIDER=custom` (was harness-only)
- **Docker**: bind `0.0.0.0` — `-p 5001:5001` smoke-test passes
- **CI**: ruff F401 cleanup; `ensure_harness` probe fallback; `services.postgres` fix
- **Version sync**: 7.2.2 (`pyproject.toml`, `version.py`, `package.json`, `main.py`, `layout.tsx`)

## 🛠️ Features

- **6-stage pipeline:** Ingestion → Taint Analysis → Dataflow → Risk Assessment → Verdict → Report.
- **Multi-language:** Python, Java, C, **JavaScript / TypeScript** (AST + taint patterns).
- **Multi-provider LLM:** DeepSeek (custom), DSH Harness, or any OpenAI-compatible endpoint (Groq, OpenAI, Mistral, OpenRouter, Together).
- **Async API:** FastAPI + Celery workers (optional in-process fallback).
- **Security:** HMAC-SHA256 for API keys (with pepper), Fernet for secrets.
- **Observability:** Structlog (JSON), Prometheus `/metrics`, OpenTelemetry traces.
- **CI/CD:** GitHub Actions (tests, lint, docs deploy).
- **Desktop:** Tauri app for Windows.

## 📦 Quick Start

### Backend (Docker)
```bash
docker build -t vishap .
docker run --rm -p 5001:5001 \
  -e VISHAP_DEV=true \
  -e VISHAP_LLM_PROVIDER=custom \
  -e CUSTOM_LLM_URL=https://api.deepseek.com/v1 \
  -e CUSTOM_LLM_MODEL=deepseek-chat \
  -e CUSTOM_LLM_KEY=sk-... \
  vishap

## 🧠 Claude Desktop extension

Install **Vishap Security Analysis** in Claude Desktop (Windows/macOS):

1. Download [`claude-plugin/claude-plugin.mcpb`](claude-plugin/claude-plugin.mcpb).
2. Claude → **Settings** → **Extensions** → **Install extension** → select `.mcpb`.
3. **Configure**:
   - `LLM Base URL` — `https://api.deepseek.com/v1` (or OpenAI / Groq / Ollama / any OpenAI-compatible)
   - `LLM API Key` — your key (empty for local Ollama)
   - `LLM Model` — `deepseek-chat` / `gpt-4o-mini` / `llama3.1` / ...
4. **Enable** → ask Claude: *"Analyze this code for SQL injection: ..."*

Source: [`claude-plugin/`](claude-plugin/) · `.mcpb` built with `mcpb pack`.

