Skip to content

TorusGuard v2.1.1: Taint Engine, Polyglot AST Walker & 88 Rules Expansion

Choose a tag to compare

View all tags
@githubmofo githubmofo released this 29 Sep 13:53
· 4 commits to main since this release
v2.1.1
7516ff3

TorusGuard v2.1.1: Taint Engine, Polyglot AST Walker & 88 Rules Expansion

Release Version: v2.1.1
Release Date: September 29, 2026
Package Manager: npm install -g torusguard@2.1.1
NPM Package: torusguard@2.1.1
GitHub Packages: @githubmofo/torusguard@2.1.1
Binary Engine: Zero-dependency Go 1.25 Single Binary (cmd/torusguard) with Python polyglot core runtime

Executive Summary

TorusGuard v2.1.1 delivers a major static analysis enhancement, introducing the Taint Analysis Engine, Polyglot Tree-Sitter AST Walker, Cross-File Interprocedural Dataflow, and 7-Signal Calibrated Confidence Scoring. It expands the canonical rule catalog to 88 rules across 22 architectural families by adding deep detection for unvalidated URL redirects (TG-INPUT-007) and insecure object deserialization (TG-INPUT-008).

This release also hardens type safety across finding evaluation scripts, ensuring seamless developer experience and zero type warnings in modern AI IDEs.

Key Highlights & Innovations

┌─────────────────────────────────────────────────────────────────────────────┐
│                          TORUSGUARD v2.1.1 MILESTONES                       │
└─────────────────────────────────────────────────────────────────────────────┘
  1. Taint Analysis Engine      ──► Source-to-sink dataflow tracking across ASTs
  2. Polyglot AST Walker        ──► Tree-sitter powered parser (Python, TS/JS, Go)
  3. Cross-File Interprocedural ──► Cross-module call graph and import resolution
  4. 88 Rules Across 22 Families──► Added TG-INPUT-007 and TG-INPUT-008
  5. 7-Signal Confidence Scorer ──► Empirical evidence-chain calibrated scoring (0–100)
  6. Incremental Scan Cache     ──► SHA-256 mtime hashing for sub-second re-audits
  7. Finding Scorer Type Safety ──► Zero Pylance/Pyright typing warnings
  8. Master 7-Stage Pipeline    ──► torusguard full closed-loop governance command
  9. Tri-Mode Validation Suite  ──► 6 unseen stacks tested with 100% pass across CLI/Chat/MCP

Detailed Feature Breakdown

1. Taint Analysis Engine (core/taint.py, core/taint_rules.py, core/taint_graph.py)

  • Tracks untrusted inputs (sources: request.args, req.query, params, os.environ, body) across intermediate variable assignments to critical security execution sinks (eval, subprocess, db.query, fs.readFile, res.redirect).
  • Recognizes sanitizers (int(), escape(), sanitize(), DOMPurify.sanitize, encodeURIComponent) to eliminate false positives.
  • Constructs directed acyclic taint graphs capturing propagation steps, path depth, and line-level coordinates.

2. Polyglot Tree-Sitter Parser & AST Walker (core/parser.py, core/ast_walker.py, core/symbol_table.py)

  • Standardizes CST and AST node traversal across Python, TypeScript, JavaScript, and Go.
  • Maintains lexical scopes and symbol tables tracking identifiers, function definitions, parameters, and variable assignments.

3. Cross-File Interprocedural Dataflow (core/cross_file_taint.py, core/call_graph.py, core/import_resolver.py)

  • Resolves cross-file imports (relative paths, package paths, index barrel exports).
  • Connects callers and callees into a project-wide call graph, allowing taint flow to propagate across module boundaries.

4. 88 Canonical Rules Across 22 Architectural Families

  • Expanded the TG-INPUT family from 6 to 8 rules:
    • TG-INPUT-007: Unvalidated URL Redirects / Open Redirection (rules/TG-INPUT-007-unvalidated-redirect.md).
    • TG-INPUT-008: Insecure Deserialization / Object Injection (rules/TG-INPUT-008-insecure-deserialization.md).
  • Loaded and validated via core/rules_registry.py and categorized across 22 root-cause clusters in core/clustering.py.

5. 7-Signal Calibrated Confidence Scorer (core/confidence.py, .torusguard/scripts/finding_scorer.py)

  • Calibrates 0–100 confidence bands using 7 weighted empirical signals:
    1. Rule severity baseline (Critical=90, High=75, Medium=50, Low=25, Informational=10)
    2. Taint path confirmation (+15)
    3. Taint depth decay
    4. Sanitizer presence suppression (-35)
    5. Framework context match (+5)
    6. Multi-line evidence quality (+5)
    7. Test/Mock fixture noise suppression (-30) and documentation suppression (-25)
    8. Persistent memory boost/suppression (-30 to +20)

6. Incremental Hash Cache & Parallel Scanning (core/incremental.py, core/parallel.py, core/watcher.py)

  • Persists SHA-256 and modification time hashes at .torusguard/cache/audit_cache.json to skip unchanged files.
  • Distributes directory chunk auditing across CPU cores using a process worker pool.
  • Includes file-system watcher with 300ms debounce for continuous background monitoring.

7. Master 7-Stage Pipeline (torusguard full)

  • Coordinates the complete closed-loop security governance lifecycle:
    • Stage 0: init (Stack discovery & rule profiling)
    • Stage 1: authorize (Cryptographic target scope validation)
    • Stage 2: audit (Polyglot AST & multi-modal vision scan)
    • Stage 3: verify (Finding confidence calibration & line fingerprinting)
    • Stage 7: report (Living ledger synchronization, SARIF v2.1.0 & HTML export)

8. Stream-Isolated MCP Server & Unseen Repositories Validation

  • Redirected stdout to stderr inside RunMCPServer() in cmd/torusguard/mcp.go, ensuring 100% pure JSON-RPC 2.0 stdio compliance.
  • Validated against 6 unseen ecosystems (SvelteKit 2 + Bun, FastAPI pgvector RAG, Cloud-Native DevOps Docker & Git Mine, Multi-Modal Vision OCR on PNG/JPG/WebP, Kotlin Ktor + Exposed, and Laravel 11 + Vue 3) with full automated sandboxed cleanup.

Installation & Upgrade

Global Installation via npm

npm install -g torusguard@2.1.1

Direct Usage via npx

npx torusguard@2.1.1 audit

Build from Source

git clone https://github.com/githubmofo/TorusGuard.git
cd TorusGuard
git checkout v2.1.1
go build -o torusguard ./cmd/torusguard
Assets 2
Loading