aegis-ai-core

Aegis AI Core

Local-first static application security testing for Python, JavaScript, TypeScript, PHP, Java, Go, and basic C/C++ scanning. Aegis combines language parsers, security rules, taint tracking, suppression workflows, and CI-ready reports behind one production analysis path.

Requirements

• Python 3.10, 3.11, or 3.12
• Python 3.13 is not supported by the pinned Tree-sitter dependency stack

Install

pip install aegis-ai-core

For repository development:

pip install -e ".[dev]"

Scan a project

aegis /path/to/project --format json
aegis /path/to/project --format html --output aegis-report.html
aegis /path/to/project --format sarif --output aegis-results.sarif

The equivalent module command is:

python -m src.scanner.cli /path/to/project --format json

Supported report formats are JSON, HTML, Markdown, and SARIF. Project scans can also use baselines, incremental mode, custom YAML rules, and optional AI-assisted remediation.

Language support

Unsupported languages return no findings rather than falling back to a generic cross-language regex scanner.

Custom YAML rules

aegis rules init --language python --type sqli
aegis rules test .aegis/rules
aegis /path/to/project --rules-dir /path/to/project/.aegis/rules

See the rule authoring guide for schema, embedded TP/TN tests, loading boundaries, and contribution rules.

Optional AI providers

The scanner works without an AI provider. Install the optional OpenAI-compatible client only when generated remediation is needed:

pip install "aegis-ai-core[ai]"

Supported provider modes include DeepSeek, OpenAI, Ollama, and custom OpenAI-compatible endpoints. Source code is sent to a remote provider only after an explicit AI remediation action; local scans do not require a provider.

Reproducible quality signals

The 2026-07-12 clean-worktree baselines report:

Reports record scanner/target revisions, ground-truth hashes, TP/FP/FN/TN, duration, and peak RSS. These numbers are not generalized claims for every framework or vulnerability category. See the detection quality guide and versioned reports in scripts/reports/ for the exact scope.

Compatibility and security

• Aegis 1.5 migration guide
• Maintenance policy
• Security policy
• Changelog

License

MIT