SecureCLI - Comprehensive Multi-Language Security Analysis Platform

Enterprise-grade security analysis for modern development teams
Supporting 10+ programming languages with 20+ integrated security tools

Overview

SecureCLI is a comprehensive security analysis platform that provides unified security scanning across multiple programming languages and frameworks. Built for modern development workflows, it integrates seamlessly with CI/CD pipelines and provides actionable security insights.

Key Features

** AI-Powered Analysis**: GPT-4 and local model (DeepSeek) support for context-aware vulnerability detection
** Multi-Language Support**: Python, JavaScript/TypeScript, Java, C/C++, Rust, Ruby, Go, C#/.NET, Solidity, Vyper
** 20+ Security Tools**: Bandit, Semgrep, ESLint, SpotBugs, Gosec, Slither, DevSkim, and more
** Smart Contract Security**: Specialized analysis for Ethereum, Vyper, and EVM-compatible contracts
** Multiple Output Formats**: JSON, Markdown, CSV, SARIF reports with auto-save
** Fast & Scalable**: Parallel processing and intelligent caching
** CI/CD Integration**: GitHub Actions, GitLab CI, Jenkins ready
** Enterprise Features**: CVSS scoring, vulnerability tracking, compliance reporting

Quick Start

Installation

# Clone and install SecureCLI
git clone https://github.com/your-org/SecureCLI.git
cd SecureCLI
pip install -e .  # Install in editable/development mode

# Install security analysis tools
./scripts/install-security-tools.sh  # Linux/WSL
# OR
.\scripts\install-security-tools.ps1  # Windows PowerShell (as admin)

# Configure AI integration (optional but recommended)
export OPENAI_API_KEY="your-api-key"  # For OpenAI GPT-4
# OR configure local model in config

# Verify installation
python scripts/validate-tools.py

Basic Usage

# Interactive REPL mode
securecli

# Traditional scan with security tools
scan quick [path]          # Quick security scan (default: current directory)
scan deep [path]           # Deep security scan with all available tools
scan comprehensive [path]  # Comprehensive scan with extended analysis

# AI-powered security analysis
analyze [path]             # AI line-by-line security audit (auto-saves report)
                          # Supports OpenAI API or local DeepSeek model

# Generate or regenerate reports
report [format]            # Generate reports from last scan/analysis
report markdown            # Markdown format report
report json               # JSON format report
report all                # All available formats

# High-severity findings only
scan deep . --severity-min HIGH

# Check AI integration status
ai status                  # View AI configuration and availability
ai test                    # Test OpenAI API connectivity
ai test-local             # Test local model (DeepSeek) connectivity

AI-Powered Analysis

SecureCLI includes advanced AI-powered analysis capabilities:

# OpenAI API Mode (GPT-4)
export OPENAI_API_KEY="your-api-key"
analyze ./src              # AI analyzes code line-by-line
                          # Reports auto-saved to ./output/

# Local Model Mode (DeepSeek)
set llm.provider local
set local_model.enabled true
analyze ./src              # Uses local DeepSeek model

# View AI status
ai status                  # Check configuration
ai switch openai          # Switch to OpenAI API
ai local enable           # Enable local model

AI Analysis Features:

Context-Aware: Understands code purpose and data flow
Cross-File Analysis: Tracks vulnerabilities across files
Low False Positives: AI filters out non-exploitable issues
Custom Remediation: Tailored fix recommendations
Auto-Save Reports: Markdown and JSON reports saved automatically

Example Output

 SecureCLI Security Analysis Report

 Scanned: ./my-project (42 files)
 Duration: 23.4s
 Tools: bandit, semgrep, gosec, eslint, slither
 AI: GPT-4 (OpenAI API)

📊 Summary:
  🔴 Critical: 2
  🟠 High:     5
  🟡 Medium:   8
  🟢 Low:      3

🔴 Critical Issues:
  SQL Injection in user_auth.py:45
  - AI Confidence: 95%
  - Attack Vector: User input flows to SQL query without sanitization
  - Custom Fix: Use parameterized queries with SQLAlchemy
  
  Hardcoded Secret in config.js:12
  - AI Confidence: 100%
  - Impact: Exposed API key can compromise entire service
  - Custom Fix: Move to environment variables

🟠 High Issues:
  Command Injection in file_handler.py:78
  Reentrancy Vulnerability in Token.sol:134
  ...

✅ Reports auto-saved:
  📄 MARKDOWN: ./output/security-report.md
  📋 JSON: ./output/findings.json

💡 Run 'report all' to generate additional formats (SARIF, CSV)

📋 Supported Languages & Tools

Language	Extensions	Primary Tools	Additional Tools
Python	`.py`	Bandit, Semgrep	Safety, pip-audit
JavaScript/TypeScript	`.js`, `.ts`, `.jsx`, `.tsx`	ESLint Security, Semgrep	npm audit, retire.js
Java	`.java`, `.jsp`	SpotBugs, PMD	Find Security Bugs
C/C++	`.c`, `.cpp`, `.h`, `.hpp`	Clang Static Analyzer	CppCheck
Rust	`.rs`, `.toml`	Clippy, Cargo Audit	RustSec Advisory
Ruby	`.rb`	Brakeman, RuboCop Security	bundler-audit
Go	`.go`	Gosec, Staticcheck	go-critic
C#/.NET	`.cs`, `.razor`	DevSkim, Roslyn Analyzers	Security Code Scan
Solidity	`.sol`	Slither, solc	Pattern-based analysis
Vyper	`.vy`	Vyper compiler	Pattern-based analysis

🔧 Installation Guide

Automated Installation (Recommended)

Linux/WSL

git clone <repository-url>
cd SecureCLI
chmod +x scripts/install-security-tools.sh
./scripts/install-security-tools.sh

Windows PowerShell (Run as Administrator)

git clone <repository-url>
cd SecureCLI
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
.\scripts\install-security-tools.ps1

Manual Installation

Python Dependencies

pip install -r requirements-dev.txt

Language-Specific Tools

# Rust tools
rustup component add clippy
cargo install cargo-audit

# Ruby tools
gem install brakeman rubocop rubocop-security bundler-audit

# Go tools
go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
go install honnef.co/go/tools/cmd/staticcheck@latest

# .NET tools
dotnet tool install --global Microsoft.CST.DevSkim.CLI

# Smart contract tools
npm install -g solc
pip install slither-analyzer vyper

Verification

# Run comprehensive test
python scripts/comprehensive-test.py

# Validate specific tools
python scripts/validate-tools.py

Language-Specific Examples

Python Security Analysis

# Basic Python scan
securecli scan app.py

# Django project scan
securecli scan . --include="*.py" --exclude="venv,migrations"

# Focus on high-severity issues
securecli scan . --language python --severity-min HIGH

Smart Contract Security

# Solidity contract analysis
securecli scan contracts/ --include="*.sol"

# Vyper contract analysis  
securecli scan contracts/ --include="*.vy"

# Comprehensive DeFi audit
securecli scan . --include="*.sol,*.vy" --format json --output defi-audit.json

Web Application Security

# Full-stack JavaScript application
securecli scan . --include="*.js,*.ts,*.jsx,*.tsx"

# Backend API security
securecli scan backend/ --language java,python

# Frontend security scan
securecli scan frontend/ --language javascript --tools eslint,semgrep

Configuration

Environment Variables

# AI Integration
export OPENAI_API_KEY="sk-..."           # OpenAI API key for GPT-4 analysis
export ANTHROPIC_API_KEY="sk-ant-..."   # Anthropic API key (alternative)

# Local Model Configuration (optional)
export USE_LOCAL_MODEL="true"            # Enable local DeepSeek model
export LOCAL_MODEL_ENGINE="ollama"       # Engine: ollama, transformers
export LOCAL_MODEL_NAME="deepseek-coder" # Model name

Configuration File

Create securecli.yml or .securecli.yml:

# SecureCLI Configuration
project:
  name: "My Project"
  version: "1.0.0"

# AI Configuration
llm:
  provider: "openai"          # Options: openai, anthropic, local, auto
  model: "gpt-4"              # Model name
  temperature: 0.1            # AI temperature (0.0-1.0)
  max_tokens: 4000            # Maximum response tokens

# Local Model Configuration
local_model:
  enabled: false              # Set true to use local model
  engine: "ollama"            # Options: ollama, transformers
  model_name: "deepseek-coder"
  base_url: "http://localhost:11434"
  context_length: 4096
  gpu_layers: 35

# Output Configuration
output:
  dir: "./output"             # Output directory for reports
  auto_save: true             # Auto-save reports after analysis

scanning:
  parallel_jobs: 4
  timeout: 300
  exclude_paths:
    - "node_modules/"
    - "venv/"
    - "target/"
    - "*.test.*"

tools:
  bandit:
    enabled: true
    config_file: ".bandit"
  
  semgrep:
    enabled: true
    rules: ["auto", "security", "secrets"]
  
  slither:
    enabled: true
    detectors: ["all"]
    exclude_detectors: ["solc-version"]

  gosec:
    enabled: true
    include_tests: false

reporting:
  format: "json"
  output_file: "security-report.json"
  include_code_snippets: true
  severity_filter: "MEDIUM"
  
  cvss:
    enabled: true
    version: "4.0"
  
  compliance:
    standards: ["OWASP", "CWE", "NIST"]

Tool-Specific Configuration

Bandit (Python)

.bandit:

[bandit]
exclude = /tests/,/venv/
skips = B101,B601

ESLint (JavaScript)

.eslintrc.js:

module.exports = {
  extends: ['@microsoft/eslint-plugin-security'],
  rules: {
    'security/detect-object-injection': 'error',
    'security/detect-non-literal-fs-filename': 'warn'
  }
};

Reporting & Output Formats

Auto-Save Reports

After running AI analysis with the analyze command, reports are automatically saved to the output directory:

analyze ./src

# Output:
#  Analysis report saved:
#    MARKDOWN: ./output/security-report.md
#    JSON: ./output/findings.json

Manual Report Generation

Generate additional report formats using the report command after any scan or analysis:

# After running 'analyze' or 'scan'
report markdown           # Generate markdown report
report json              # Generate JSON report
report sarif             # Generate SARIF format
report csv               # Generate CSV format
report all               # Generate all formats

Report Workflow

# Step 1: Run AI analysis (auto-saves MD + JSON)
analyze ./my-app

# Step 2: (Optional) Generate additional formats
report sarif             # For GitHub Security tab
report csv               # For spreadsheet analysis

# Step 3: (Optional) Regenerate with different settings
report all               # Regenerate all formats

JSON Report

{
  "summary": {
    "scan_id": "scan_20240101_120000",
    "timestamp": "2024-01-01T12:00:00Z",
    "duration": 23.4,
    "files_scanned": 42,
    "tools_used": ["bandit", "semgrep", "gosec"],
    "ai_provider": "OpenAI API",
    "scan_mode": "comprehensive_ai",
    "findings_count": {
      "critical": 2,
      "high": 5,
      "medium": 8,
      "low": 3
    }
  },
  "findings": [
    {
      "id": "FINDING_001",
      "tool": "AI Security Auditor",
      "rule_id": "SQL-INJECTION-001",
      "title": "SQL Injection via User Input",
      "severity": "HIGH",
      "confidence": 95,
      "file_path": "app/utils.py",
      "line_number": 45,
      "column_number": 12,
      "code_snippet": "cursor.execute(f\"SELECT * FROM users WHERE id={user_id}\")",
      "description": "User-controlled input flows directly to SQL query without sanitization",
      "attack_scenario": "Attacker can inject SQL commands via user_id parameter",
      "impact": "Database compromise, data exfiltration, privilege escalation",
      "cwe_id": "CWE-89",
      "cvss_score": 8.1,
      "recommendation": "Use parameterized queries with proper escaping",
      "sample_fix": "cursor.execute(\"SELECT * FROM users WHERE id=?\", (user_id,))"
    }
  ]
}

Markdown Report

# Security Analysis Report

## Summary
- **Scan ID**: scan_20240101_120000
- **AI Provider**: OpenAI API (GPT-4)
- **Scan Mode**: comprehensive_ai
- **Files Scanned**: 42
- **Duration**: 23.4s
- **Critical**: 2 🔴
- **High**: 5 🟠

## Critical Findings

### SQL Injection in app/utils.py
- **Line**: 45
- **Tool**: AI Security Auditor
- **Confidence**: 95%
- **CVSS**: 8.1
- **CWE**: CWE-89

#### Vulnerable Code
```python
cursor.execute(f"SELECT * FROM users WHERE id={user_id}")  # ❌ Vulnerable

Attack Scenario

Attacker can inject SQL commands via the user_id parameter, leading to:

Unauthorized data access
Database manipulation
Potential privilege escalation

Recommended Fix

cursor.execute("SELECT * FROM users WHERE id=?", (user_id,))  # ✅ Secure

Use parameterized queries to prevent SQL injection attacks.


### CSV Export
```csv
ID,Tool,Rule,Severity,File,Line,Description,CWE,CVSS
FINDING_001,bandit,B602,HIGH,app/utils.py,45,Command injection,CWE-78,8.1
FINDING_002,semgrep,javascript.express.security.audit.express-session-secret.express-session-secret,MEDIUM,server.js,23,Hardcoded session secret,CWE-798,6.5

CI/CD Integration

GitHub Actions

name: Security Analysis
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install SecureCLI
        run: |
          pip install -e .
          ./scripts/install-security-tools.sh
      
      - name: Security Scan
        run: |
          securecli scan . --format json --output security-report.json
          
      - name: Upload Results
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-report.json
          
      - name: Comment PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v6
        with:
          script: |
            // Add security results to PR comment

GitLab CI

security_scan:
  stage: test
  image: python:3.11
  before_script:
    - pip install -e .
    - ./scripts/install-security-tools.sh
  script:
    - securecli scan . --format json --output security-report.json
  artifacts:
    reports:
      junit: security-report.json
    paths:
      - security-report.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Jenkins Pipeline

pipeline {
    agent any
    
    stages {
        stage('Security Analysis') {
            steps {
                sh 'pip install -e .'
                sh './scripts/install-security-tools.sh'
                sh 'securecli scan . --format json --output security-report.json'
                
                publishHTML([
                    allowMissing: false,
                    alwaysLinkToLastBuild: true,
                    keepAll: true,
                    reportDir: '.',
                    reportFiles: 'security-report.json',
                    reportName: 'Security Report'
                ])
            }
        }
    }
}

Testing & Validation

Comprehensive Test Suite

# Run full test suite
python scripts/comprehensive-test.py

# Test specific languages
securecli scan tests/samples/ --language python,javascript

# Performance benchmarking
securecli scan large-project/ --benchmark --parallel 8

📚 Documentation

Installation Guide - Comprehensive setup instructions
Usage Guide - Detailed usage examples and best practices
AI Configuration - AI integration setup (OpenAI, local models)
Smart Contract Security - Blockchain security analysis
Architecture - System design and architecture

Security Features

AI-Powered Vulnerability Detection

Context-Aware Analysis: Understands code purpose and business logic
Cross-File Tracking: Identifies vulnerabilities spanning multiple files
Data Flow Analysis: Traces user input through the application
Low False Positives: AI filters non-exploitable patterns (70%+ confidence)
Custom Remediation: Context-specific fix recommendations
Attack Scenarios: Realistic exploitation examples
Dual Mode: OpenAI GPT-4 or local DeepSeek model

Traditional Vulnerability Detection

Code Injection: SQL, Command, Code injection detection
Cryptographic Issues: Weak algorithms, hardcoded secrets
Authentication Flaws: Access control bypasses, session issues
Smart Contract Vulnerabilities: Reentrancy, integer overflow, access control
Dependency Vulnerabilities: Known CVEs in dependencies
Configuration Issues: Insecure defaults, misconfigurations

Compliance Standards

OWASP Top 10: Web application security risks
CWE: Common Weakness Enumeration mapping
NIST: Cybersecurity framework alignment
SANS: Security best practices
GDPR: Data protection compliance checks

Enterprise Features

Role-Based Access: Team and organizational access controls
Custom Rules: Organization-specific security policies
Audit Trails: Complete security scanning history
Integration APIs: REST APIs for enterprise integration
Compliance Reporting: Automated compliance documentation

Contributing

We welcome contributions from the security community! Ways to contribute:

** Bug Reports**: Report issues and bugs
** Feature Requests**: Suggest new features and improvements
** Tool Integration**: Add support for new security tools
** Language Support**: Add new programming language analyzers
** Documentation**: Improve documentation and examples
** Testing**: Add test cases and validation scenarios

Development Setup

# Clone repository
git clone <repository-url>
cd SecureCLI

# Setup development environment
python -m venv venv
source venv/bin/activate  # Linux/macOS
# venv\Scripts\activate    # Windows

# Install development dependencies
pip install -r requirements-dev.txt
pip install -e .

# Run tests
pytest tests/
python scripts/validate-tools.py

Performance & Scalability

Performance Optimization

Parallel Processing: Multi-threaded scanning
Intelligent Caching: Results caching for faster re-scans
Incremental Analysis: Scan only changed files
Memory Management: Efficient memory usage for large codebases
Network Optimization: Optimized tool downloads and updates

Scalability Features

Distributed Scanning: Scale across multiple machines
Container Support: Docker and Kubernetes deployment
Cloud Integration: AWS, Azure, GCP support
Database Storage: PostgreSQL, MySQL result storage
Message Queues: Redis, RabbitMQ for job processing

Benchmarks

Large Enterprise Codebase (100k+ files):
- Scan Time: ~45 minutes
- Memory Usage: ~2GB peak
- CPU Cores: 8 (parallel processing)
- Findings: ~1,200 security issues identified

Integrations

AI Providers

OpenAI: GPT-4, GPT-3.5 Turbo for cloud-based analysis
Anthropic: Claude for alternative AI analysis
Local Models: DeepSeek Coder, CodeLlama via Ollama or Transformers
Custom Endpoints: Support for custom OpenAI-compatible APIs

IDEs & Editors

VS Code: SecureCLI extension for real-time analysis
IntelliJ IDEA: Plugin for JetBrains IDEs
Vim/Neovim: Command-line integration
Sublime Text: Package for syntax highlighting

Security Platforms

SIEM Integration: Splunk, Elastic, IBM QRadar
Vulnerability Management: Qualys, Rapid7, Tenable
Code Quality: SonarQube, CodeClimate integration
Bug Tracking: Jira, GitHub Issues, Azure DevOps

Development Tools

Git Hooks: Pre-commit and pre-push validation
Package Managers: npm, pip, cargo, maven integration
Build Tools: Gradle, Maven, webpack, rollup
Testing Frameworks: Jest, pytest, JUnit, RSpec

Support & Community

Getting Help

** Documentation**: Comprehensive guides and examples
** Issues**: GitHub Issues for bug reports and feature requests
** Discussions**: Community discussions and Q&A
** Email**: Direct support for enterprise customers

Community Resources

** Tutorials**: Step-by-step security analysis guides
** Blog Posts**: Security insights and best practices
** Videos**: Demonstration videos and tutorials
** Case Studies**: Real-world security analysis examples

Professional Services

** Enterprise Support**: 24/7 support for enterprise customers
** Custom Training**: Security analysis training programs
** Custom Development**: Tailored security solutions
** Security Consulting**: Expert security assessment services

License

SecureCLI is released under the MIT License. See LICENSE file for details.

🙏 Acknowledgments

SecureCLI integrates with many excellent open-source security tools:

Bandit - Python security linter
Semgrep - Static analysis engine
Slither - Solidity static analyzer
Gosec - Go security analyzer
ESLint Security - JavaScript security rules
SpotBugs - Java static analyzer
Brakeman - Ruby on Rails security scanner

Special thanks to all future contributors and the security research community for making secure software development accessible to everyone. Reach out to me via email 5m477code@gmail.com or via X https://x.com/5m477

Secure your code. Protect your users. Build with confidence.

Name		Name	Last commit message	Last commit date
deploy/kubernetes		deploy/kubernetes
docker		docker
docs		docs
scripts		scripts
src/securecli		src/securecli
tests		tests
.env.example		.env.example
.gitignore		.gitignore
Dockerfile		Dockerfile
LICENSE		LICENSE
README.md		README.md
config.default.yml		config.default.yml
docker-compose.yml		docker-compose.yml
pyproject.toml		pyproject.toml
requirements-dev.txt		requirements-dev.txt

Latest commit

History

Folders and files

Repository files navigation