Metadata-Version: 2.4
Name: gsc-security
Version: 1.4.1
Summary: Git Security Checker — AI-powered SAST with 47 detectors, auto-PoC, and self-learning
Author-email: Alexey Polyakov <poliakarmai@github.com>
License: Apache-2.0
Project-URL: Homepage, https://github.com/poliakarmai/gsc
Project-URL: Repository, https://github.com/poliakarmai/gsc.git
Project-URL: Issues, https://github.com/poliakarmai/gsc/issues
Project-URL: Hall-of-Fame, https://github.com/poliakarmai/gsc/blob/master/HALL_OF_FAME.md
Keywords: security,audit,static-analysis,sast,sast-tool,vulnerability-scanner,appsec,devsecops
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: PyYAML>=6.0
Requires-Dist: requests>=2.31
Requires-Dist: cvss>=3.0
Requires-Dist: tomli>=2.0; python_version < "3.11"
Provides-Extra: cli
Requires-Dist: httpx>=0.28; extra == "cli"
Requires-Dist: uvicorn>=0.34; extra == "cli"
Requires-Dist: reportlab>=4.0; extra == "cli"
Provides-Extra: cloud
Requires-Dist: fastapi>=0.141; extra == "cloud"
Requires-Dist: uvicorn[standard]>=0.34; extra == "cloud"
Requires-Dist: pydantic>=2.13; extra == "cloud"
Requires-Dist: httpx>=0.28; extra == "cloud"
Requires-Dist: PyJWT>=2.10; extra == "cloud"
Requires-Dist: stripe>=12.0; extra == "cloud"
Requires-Dist: psycopg[binary]>=3.1; extra == "cloud"
Provides-Extra: collector
Requires-Dist: Scrapy>=2.11; extra == "collector"
Provides-Extra: otel
Requires-Dist: opentelemetry-api>=1.20; extra == "otel"
Requires-Dist: opentelemetry-sdk>=1.20; extra == "otel"
Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.20; extra == "otel"
Provides-Extra: mcp
Requires-Dist: fastmcp==3.4.7; extra == "mcp"
Provides-Extra: js
Requires-Dist: tree-sitter>=0.21; extra == "js"
Requires-Dist: tree-sitter-javascript>=0.21; extra == "js"
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: pytest-cov>=5; extra == "dev"
Requires-Dist: fakeredis>=2.23; extra == "dev"
Requires-Dist: fastmcp==3.4.7; extra == "dev"
Provides-Extra: all
Requires-Dist: gsc-security[cli,cloud,collector,dev,js,mcp,otel]; extra == "all"
Dynamic: license-file

<div align="center">

# 🛡️ GSC — Git Security Checker

<!-- GSC-META-START -->
**Version:** v1.4.1 · **Detectors:** 69 (65 registry + 4 engines), **Schema:** v34, **Modules:** 267 — 69 детекторов всего

69 детекторов — точное число из gsc_meta.py
<!-- GSC-META-END -->

### Find it. Prove it. Fix it. Verify it.

GSC is a self-learning AppSec platform that doesn't stop at detection — it
**proves** vulnerabilities with generated exploits, **fixes** them with verified
patches, and **heals** your codebase with automated pull requests.

[![Tests](https://img.shields.io/badge/tests-pytest-brightgreen)]()
[![Python](https://img.shields.io/badge/python-3.10%2B-blue)]()
[![License](https://img.shields.io/badge/license-BUSL--1.1-orange)](LICENSE)

[Getting Started](#-getting-started) · [Capabilities](#-capabilities) ·
[GitHub Action](#-github-action) · [Documentation](docs/README.md)

</div>

---

## Why GSC?

Most static-analysis tools show you a snapshot of *right now* — a list of
findings you then triage, verify and fix by hand. GSC closes the loop:

**detect → prove → fix → verify → heal → learn**

- **Prove** — generates a working exploit so a finding is evidence, not a guess.
- **Fix** — produces a minimal patch instead of another ticket.
- **Verify** — re-runs the exploit against the patch in a sandbox; only a fix
  that defeats its own exploit counts as verified.
- **Heal** — opens a pull request with that verified fix.
- **Learn** — tunes itself from your TP/FP feedback to cut false positives over time.

GSC is **Vulnerability Management**, not just a scanner: it ranks findings by
exploitability (EPSS + CISA KEV + ExploitDB, not raw CVSS), suppresses false
positives deterministically (CSP/CDN-aware filters), and cross-references the
Russian FSTEC BDU — closing the loop most scanners leave open.

---

## 🚀 Getting Started

```bash
git clone https://github.com/poliakarmai/gsc.git && cd gsc
pip install -e .
```

```bash
# Scan a repository
gsc external-scan https://github.com/user/repo --profile audit

# CI gate: scan a PR diff, block merge on new CRITICAL/HIGH
gsc external-scan ./repo --profile pr-gate \
    --mode diff --base main --head HEAD --fail-on-blocking

# Scan + generate verified fixes
gsc external-scan ./repo --profile audit --with-poc --with-chains
```

Profiles: `developer-review` · `pr-gate` · `audit` · `candidate-review`

---

## ✨ Capabilities

### Detection
- **SAST** — 69 detectors across Python, JS/TS, Go, Java, Rust and more, backed
  by adversarial AI judging (Red/Blue/Judge debate + grounded RAG) — **267 modules**.
- **SCA** — dependency vulnerabilities via OSV.dev, with precise lock-file
  resolution (`package-lock.json`, `yarn.lock`, `go.sum`).
- **Secrets** — fingerprinting with cross-repo correlation and rotation
  detection (stores hashes only, never values).
- **Honeytokens** — canary secrets (`GSC_HONEYTOKEN_*`) that emit a CRITICAL
  finding when they leak into any scanned repository.
- **IaC** — Terraform, Kubernetes and Dockerfile misconfigurations.
- **Supply chain** — SBOM (CycloneDX / SPDX), VEX, and signature verification.
- **Compliance** — CWE / OWASP / PCI DSS mapping for every finding.
- **Exploitability ranking** — EPSS + CISA KEV + ExploitDB, not raw CVSS.

### Verification & Remediation
- **LLM-augmented verification** — the same multi-agent approach independently shown to raise SAST F1 from 78.4% to 90.9% and cut false positives 88.6% (QASecClaw, OWASP Benchmark v1.2).
- **Proof-of-Fix** — generate an exploit, patch the code, re-run the exploit in
  an isolated sandbox. A fix that defeats its own exploit is the definition of
  "verified".
- **Safe-exploitation gate** — PoC generation is programmatically blocked from
  emitting destructive commands (`rm -rf`, `DROP TABLE`, fork-bombs) before a
  finding is ever published.
- **Self-Healing CI** — automatically open pull requests with verified fixes.
- **DAST + Recon** — dynamic scan of live sites (nuclei), passive recon
  (subdomains / DNS / tech-stack), and SAST↔DAST correlation. See
  [docs/DAST_RECON.md](docs/DAST_RECON.md).

### Intelligence
- **Adversarial AI judging** — Red/Blue advocates debate TP vs FP, a grounded
  judge (MiniMax IE) rules; RAG-grounded CVE/CWE references kill hallucination.
- **Security Archaeology** — who introduced a vulnerability, when, and how long
  it lived before it was found.
- **Predictive Forecasting** — risk heatmaps of where the *next* vulnerability
  is likely to appear.
- **NL Policy** — write security rules in plain language, compiled to
  deterministic patterns.
- **Exploit chains** — compose individual findings into real attack paths.
- **Threat intel** — export findings as STIX 2.1 / TAXII 2.1 (MISP, OpenCTI), and reconcile code against IoC feeds (`gsc ioc import` / `gsc ioc check`).
- **Federated learning** — DP-noised TP/FP signals shared across tenants to tune detectors globally.
- **Ground-truth trainer** — deterministic, zero-LLM revalidation over the calibration network.
- **Threat modeling** — MAESTRO (CSA) 7-level threat model for agentic systems,
  plus auto-generated architectural threat models.
- **Drift detection** — n-gram consensus flags unstable multi-model verdicts.
- **Red-team** — 15 adversarial prompt-injection payloads (obfuscation /
  jailbreak / indirect) to stress-test injection detectors.
- **Agent eval metrics** — tool-selection (recall/precision/accuracy), retrieval
  (accuracy@k / MRR / NDCG), catastrophic-forgetting and consistency/coherence
  metrics (Albada ch.9).

### Integrations
- **GitHub** — Action, PR comments, checks, SARIF, `/gsc` slash commands.
- **GitLab** — post scan results as merge-request notes (self-hosted friendly).
- **VSCode** — inline diagnostics and CodeLens.
- **MCP server** — let your AI agent scan, prove and fix code inside its own
  context (`gsc mcp`, read-only tools; see [docs/MCP.md](docs/MCP.md) and
  `examples/mcp-demo/`). Install from source: `pip install -e '.[mcp]'`.

---

## 🏗️ Architecture

Three packages over a SQLite store:

- `gsc_core/` — detection engine
- `gsc_cli/` — CLI and scanners
- `gsc_cloud/` — SaaS API (multi-tenant, SSO, workers)

Scan modes: `quick` (CI, regex-only) · `standard` (daily, LLM) · `deep` (full
audit with exploit chains).

---

## 🚀 GitHub Action

```yaml
- uses: poliakarmai/gsc@v1
  with:
    deep_scan: true
    with_poc: true
```

The engine ships as a closed-source Docker image
(`ghcr.io/poliakarmai/gsc-scanner:v1`); the public repo carries only `action.yml`.
Scans every PR and push, posts findings as a PR comment, shows a security score
badge, and can block merge on CRITICAL findings. See
[`.github/workflows/gsc-audit-template.yml`](.github/workflows/gsc-audit-template.yml).

---

## 📚 Documentation

Install, detectors, architecture, enterprise and roadmap — see the
[documentation index](docs/README.md).

---

## 📄 License

**Business Source License 1.1 (BUSL-1.1)** — source-available, not open source.

- **Internal production use** (scanning your own repositories) is always permitted.
- Operating a competing hosted/managed SAST service requires a **Commercial License**.
- Converts to Apache 2.0 on the Change Date.

See [LICENSE](LICENSE) and [COMMERCIAL.md](COMMERCIAL.md).

---

<div align="center">

**GSC doesn't just find vulnerabilities. It proves them, fixes them, and learns from them.**

</div>
