# TRACE (trace-sec)

> TRACE is an open-source security scanner (npm: trace-sec, CLI: trace) that audits a backend repository in under a
> second on local CPU with zero tokens: multi-framework AST adapters build an in-memory Attack-Path Model, hypotheses
> are tested with live OWASP testpacks, and SecureBERT 2.0 + AST dataflow + probe evidence fuse into calibrated
> confidence. Findings (TR-BOLA, TR-BFLA, TR-AUTH, TR-SSRF, TR-INJ, TR-MASS, TR-TRAV, TR-SSTI, TR-CORS) are served to
> AI coding agents over MCP, and a verification oracle replays exploits to prove fixes. Lite install runs on 4 GB
> with no torch; full install adds neural scoring. Apache-2.0.

Minimal use:

```bash
npx trace-sec audit .
trace scan ./backend --target http://localhost:8000
trace explain TR-BOLA-001
trace verify TR-BOLA-001
```

MCP: `claude mcp add trace -- npx -y trace-sec mcp` — tools `trace_scan`, `trace_findings`, `trace_explain`,
`trace_attack_path`, `trace_verify`, `trace_harness_task`, `trace_eval_patch`.

## Docs

- [Home](https://VK-Amogh.github.io/TRACE/): 60-second intro
- [Installation](https://VK-Amogh.github.io/TRACE/installation/): lite vs full, per-OS setup
- [Quick start](https://VK-Amogh.github.io/TRACE/quickstart/): first audit
- [Cheat sheet](https://VK-Amogh.github.io/TRACE/cheatsheet/): every common task on one page
- [Lite or Full](https://VK-Amogh.github.io/TRACE/lite-or-full/): which install to choose
- [CLI reference](https://VK-Amogh.github.io/TRACE/cli/): every command
- [MCP setup](https://VK-Amogh.github.io/TRACE/mcp/): Claude Code, Cursor, Antigravity
- [Security harness skill](https://VK-Amogh.github.io/TRACE/harness/): agent fix runbook
- [API reference](https://VK-Amogh.github.io/TRACE/api/)
- [Troubleshooting](https://VK-Amogh.github.io/TRACE/troubleshooting/) and [FAQ](https://VK-Amogh.github.io/TRACE/faq/)

## Optional

- [Source code](https://github.com/VK-Amogh/TRACE), [NPM](https://www.npmjs.com/package/trace-sec),
  [agent guide](https://github.com/VK-Amogh/TRACE/blob/main/AGENTS.md)
