Metadata-Version: 2.5
Name: rce-path
Version: 0.1.0
Summary: Local-first, evidence-backed Python execution-path investigation
Author: Sai Teja Erukude
License-Expression: MIT
License-File: LICENSE
Keywords: audit,dataflow,rce,security,static-analysis
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: pydantic<3,>=2.7
Provides-Extra: ai
Requires-Dist: ollama<1,>=0.4.7; extra == 'ai'
Requires-Dist: openai<3,>=1.68; extra == 'ai'
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: mypy>=1.15; extra == 'dev'
Requires-Dist: pytest<10,>=8; extra == 'dev'
Requires-Dist: ruff>=0.11; extra == 'dev'
Requires-Dist: twine>=6; extra == 'dev'
Provides-Extra: ollama
Requires-Dist: ollama<1,>=0.4.7; extra == 'ollama'
Provides-Extra: openai
Requires-Dist: openai<3,>=1.68; extra == 'openai'
Description-Content-Type: text/markdown

# rce-path

Trace potentially untrusted Python inputs to execution sinks, with source
locations and static flow evidence. Scans local code without executing it.

## Install

```bash
python -m pip install .
# Optional AI backends: ".[openai]" or ".[ollama]"
```

After publishing: `pip install rce-path`.

## Quick start

```bash
rce-path scan ./checkout --format json --output findings.json
rce-path scan ./checkout --format markdown --output report.md
```

```python
from rce_path import scan

report = scan("./checkout")
print(report.summary)
```

## Features

- Detects `eval`, `exec`, OS shell calls, and subprocess shell execution.
- Tracks parameters, Flask request data, and local inputs through assignments,
  branches, and bounded loops.
- Exports evidence, assumptions, coverage diagnostics, and stable fingerprints.
- Supports optional OpenAI and Ollama reviews.

Static findings require human review. Remote AI code transmission requires
`--allow-remote-code`. Exit codes: **0** completed, **1** findings policy failed,
**2** incomplete scan or operational error.

[Usage & limitations](docs/usage.md) · [Configuration](examples/rce-path.toml) ·
[AI providers](docs/providers.md) · [Contributing](CONTRIBUTING.md) ·
[Publishing](docs/releasing.md)

Author: Sai Teja Erukude.
