Metadata-Version: 2.4
Name: aegis-ai-core
Version: 1.5.0
Summary: Local-first SAST engine with AST analysis, taint tracking, and AI-powered fix suggestions
Author: Aegis AI Team
License-Expression: MIT
Project-URL: Homepage, https://github.com/HWZ-499/aegis-ai
Project-URL: Repository, https://github.com/HWZ-499/aegis-ai
Project-URL: Issues, https://github.com/HWZ-499/aegis-ai/issues
Project-URL: Documentation, https://github.com/HWZ-499/aegis-ai/tree/main/docs
Project-URL: Changelog, https://github.com/HWZ-499/aegis-ai/blob/main/aegis-ai-core/CHANGELOG.md
Keywords: security,sast,static-analysis,vulnerability,ast
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: <3.13,>=3.10
Description-Content-Type: text/markdown
Requires-Dist: pydantic>=2.0.0
Requires-Dist: pydantic-settings>=2.0.0
Requires-Dist: python-dotenv>=1.0.0
Requires-Dist: tree-sitter==0.21.3
Requires-Dist: tree-sitter-languages>=1.0.0
Requires-Dist: pygls>=2.0.0
Requires-Dist: lsprotocol>=2025.0.0
Requires-Dist: pyyaml>=6.0.0
Provides-Extra: ai
Requires-Dist: openai>=1.0.0; extra == "ai"
Provides-Extra: rag
Requires-Dist: chromadb>=0.4.0; extra == "rag"
Requires-Dist: sentence-transformers>=2.2.0; extra == "rag"
Requires-Dist: scikit-learn>=1.0.0; extra == "rag"
Provides-Extra: logging
Requires-Dist: python-json-logger>=2.0.0; extra == "logging"
Provides-Extra: retry
Requires-Dist: tenacity>=8.2.0; extra == "retry"
Provides-Extra: all
Requires-Dist: aegis-ai-core[ai,logging,rag,retry]; extra == "all"
Provides-Extra: dev
Requires-Dist: pytest>=7.4.0; extra == "dev"
Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
Requires-Dist: pytest-benchmark>=4.0.0; extra == "dev"
Requires-Dist: tomli>=2.0.1; python_version < "3.11" and extra == "dev"
Requires-Dist: psutil>=5.9.0; extra == "dev"
Requires-Dist: ruff==0.15.21; extra == "dev"
Requires-Dist: mypy>=1.8.0; extra == "dev"
Requires-Dist: pre-commit>=3.6.0; extra == "dev"
Requires-Dist: types-PyYAML>=6.0.0; extra == "dev"

# Aegis AI Core

Local-first static application security testing for Python, JavaScript,
TypeScript, PHP, Java, Go, and basic C/C++ scanning. Aegis combines language
parsers, security rules, taint tracking, suppression workflows, and CI-ready
reports behind one production analysis path.

## Requirements

- Python 3.10, 3.11, or 3.12
- Python 3.13 is not supported by the pinned Tree-sitter dependency stack

## Install

```console
pip install aegis-ai-core
```

For repository development:

```console
pip install -e ".[dev]"
```

## Scan a project

```console
aegis /path/to/project --format json
aegis /path/to/project --format html --output aegis-report.html
aegis /path/to/project --format sarif --output aegis-results.sarif
```

The equivalent module command is:

```console
python -m src.scanner.cli /path/to/project --format json
```

Supported report formats are JSON, HTML, Markdown, and SARIF. Project scans can
also use baselines, incremental mode, custom YAML rules, and optional AI-assisted
remediation.

## Language support

| Level | Languages | Analysis path |
|---|---|---|
| Full | Python, JavaScript/TypeScript, PHP, Java, Go | Language parser plus maintained AST/taint/DSL rules |
| Basic | C/C++ | Lightweight contextual rules for memory, string, pointer, and concurrency risks |

Unsupported languages return no findings rather than falling back to a generic
cross-language regex scanner.

## Custom YAML rules

```console
aegis rules init --language python --type sqli
aegis rules test .aegis/rules
aegis /path/to/project --rules-dir /path/to/project/.aegis/rules
```

See the [rule authoring guide](https://github.com/HWZ-499/aegis-ai/blob/main/docs/technical/DSL_RULE_AUTHORING.md)
for schema, embedded TP/TN tests, loading boundaries, and contribution rules.

## Optional AI providers

The scanner works without an AI provider. Install the optional OpenAI-compatible
client only when generated remediation is needed:

```console
pip install "aegis-ai-core[ai]"
```

Supported provider modes include DeepSeek, OpenAI, Ollama, and custom
OpenAI-compatible endpoints. Source code is sent to a remote provider only after
an explicit AI remediation action; local scans do not require a provider.

## Reproducible quality signals

The 2026-07-12 clean-worktree baselines report:

| Target | Recall | Precision | F1 |
|---|---:|---:|---:|
| DVWA | 100.0% | 44.2% | 0.61 |
| NodeGoat | 100.0% | 85.7% | 0.92 |

Reports record scanner/target revisions, ground-truth hashes, TP/FP/FN/TN,
duration, and peak RSS. These numbers are not generalized claims for every
framework or vulnerability category. See the
[detection quality guide](https://github.com/HWZ-499/aegis-ai/blob/main/docs/technical/DETECTION_QUALITY.md)
and versioned reports in `scripts/reports/` for the exact scope.

## Compatibility and security

- [Aegis 1.5 migration guide](https://github.com/HWZ-499/aegis-ai/blob/main/docs/technical/V1_5_MIGRATION.md)
- [Maintenance policy](https://github.com/HWZ-499/aegis-ai/blob/main/docs/MAINTENANCE.md)
- [Security policy](https://github.com/HWZ-499/aegis-ai/blob/main/SECURITY.md)
- [Changelog](https://github.com/HWZ-499/aegis-ai/blob/main/aegis-ai-core/CHANGELOG.md)

## License

MIT
