Frame 1.0.0

The first stable release of Frame: a security agent that finds vulnerabilities by following attacker data through your code, proves each path with a solver, and optionally uses an LLM to add recall, exploit and fix.

Install

On PyPI as frame-security; the import name and the frame command are unchanged.

pip install "frame-security[scan]"
frame scan src/

Highlights

• Five languages: Python, JavaScript/TypeScript, Java, C# and C/C++.
• Cross-file taint by default: request data that enters a handler and reaches a query in another file is one finding, with the call chain in data_flow.
• 70+ framework packs (Flask, Django, FastAPI, Express, NestJS, Spring, ASP.NET Core and more), each proven by a vulnerable app and its safe twin. Teach Frame your own stack with one TOML file.
• Guardrails for CI and coding agents: --changed and --files scan only what a change can affect, baselines report only new findings, and frame verify confirms a fix removed the bug.
• GitHub Action (uses: lambdasec/frame@v1.0.0) with SARIF upload to code scanning, and a pre-commit hook (id: frame).
• AI layer on any OpenAI-compatible model, hosted or local: detect, triage, frame exploit against a live authorized target, and frame fix with a re-scan to confirm.
• Separation logic engine on Z3: entailment, frame inference, bi-abduction and countermodels, from the CLI (frame solve) or Python. It also decides C/C++ memory safety in the scanner.

Results

Benchmark	Frame	Comparison
XBOW / ZeroPath AI-SAST (39 apps)	detect 78.8%, FP 26.3%	ZeroPath 80% / 25%, Semgrep 54% / 45%
OWASP Benchmark, Python / Java / C#	80.9 / 81.5 / 80.3	Semgrep 4.5 / 15.7 / 14.2
Cross-file flows, 4 real apps	10/10, 0 false alarms	CodeQL 7/10, Semgrep 7/10
Endor Labs corpus (193 vulns)	recall 0.67, precision 0.51	Semgrep 0.52 / 0.40
CVE-Bench (10 live CVEs)	detect 5, exploit 4, fix 4

Methods and every suite: benchmarks/README.md.

Docs

Usage · Coverage · AI layer · Separation logic engine