Audit AI code for security risks before you commit, push, merge, or deploy.
What AI AppSec Does
Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Deterministic findings with coverage and evidence receipts.
2026-11-13
ดาว
—
เครื่องมือ
—
อัปไทม์
—
AI AppSec produces deterministic, reproducible static security evidence for
AI-agent and AI-application source code. It uses Semgrep 1.173.0 as its
execution engine with a bundled Public Core rulepack (122 detectors, 79
security checks).
Key properties:
Static analysis only — does not execute target code
No network required for normal scans (Semgrep setup may require network)
No HAIEC account or API key required
Deterministic evidence — Scan Receipts with SHA-256 digests
Fail-closed digests — rulepack/manifest verified at runtime
Proof-of-fix — rescan comparison with check-evaluation safety
Quick Start
# Install
npm install -g ai-appsec
# Check Semgrep status
ai-appsec doctor
# Install Semgrep engine (requires network)
ai-appsec setup
# Start MCP server (stdio transport)
ai-appsec
Security Concern Families summarize semantically compatible finding instances
for decision-quality presentation. A concern family is a deterministic grouping
view — it is NOT necessarily one vulnerability, one material issue, or one root
cause. Underlying finding instances remain auditable.
Concern family count is not a vulnerability count. Top 20 / Top 50 are
presentation limits, not evidence limits.
COMPLETE / PARTIAL / ERROR
COMPLETE: All supported files in scope were successfully analyzed.
PARTIAL: Some supported files could not be analyzed (e.g., parser failures).
PARTIAL scans cannot prove absence of findings. Missing evidence is never
interpreted as PASS.
ERROR: The scan could not complete due to an engine error.
Coverage
AI AppSec provides explicit coverage accounting:
DISCOVERED: all files found beneath the target
INTENTIONALLY_EXCLUDED: files excluded by scope policy
Rescan a target after a fix to compare receipts. The proof-of-fix comparison
is safe: it verifies that a specific security check's findings were resolved
without requiring the entire scan to be identical.
Offline / Local Operation
Normal scanning operates fully offline after prerequisites are installed:
No HAIEC cloud access required
No account or API key required
No rule download during scanning
No telemetry emitted (Semgrep invoked with --metrics off)
Semgrep setup (ai-appsec setup) may require network access to install the
engine. Once installed, all scanning is local.
Semgrep Prerequisite
scan_ai_security requires Semgrep 1.173.0 (exact version match).
# Check Semgrep status
ai-appsec doctor
# Install managed Semgrep (requires network)
ai-appsec setup
Semgrep is NOT bundled with this package. It is an external engine installed
separately. See THIRD_PARTY_NOTICES.md for details.
Limitations
Only scan_ai_security is implemented in v0.1
Static analysis only — no runtime behavioral evidence
These will remain independent products/engines. See the HAIEC architecture
principle: one workflow, four independent checks.
HAIEC
AI AppSec is powered by HAIEC. HAIEC is the broader assurance platform that
may combine ai-appsec evidence with runtime, inventory, regulatory, and
external evidence for broader compliance and assurance in the future.
Founder-led development with HAIEC acting as the release gatekeeper for
provenance, licensing, and publication.
Related Projects
LLMVerify — LLM content
verification (independent product, separate repository)
Tenant Isolation —
Cross-tenant boundary checks (independent product, separate repository)
Built by Subodh Kc — a HAIEC (Human AI Evidence Company) product.
Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Deterministic findings with coverage and evidence receipts.
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
Ai Appsec ต้องใช้ API key ไหม?
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Ai Appsec ใช้ทรานสปอร์ตแบบใด?
Ai Appsec ทำงานแบบโลคัลผ่าน stdio
Ai Appsec ถูกตรวจสอบล่าสุดเมื่อใด?
ตรวจสอบล่าสุดเมื่อ 2026-11-13 Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Deterministic findings with coverage and evidence receipts.
