## https://sploitus.com/exploit?id=EF03333D-9848-5A5E-8A21-985F2C8650C6
# claudit – AI-based code security auditing tool
claudit is an AI security auditing tool designed for Python codebases. It first uses **tree-sitter** to index the repository, identify dangerous sinks (dangerous functions) and input sources (attack surfaces), then uses **semgrep** for deterministic static pre-scans. Afterward, it employs **Claude** for semantic-level vulnerability analysis, and finally uses **counteractive verification** (POC reference libraries + OCR screenshots) to reduce false positives. The results include details about files, lines of code, CWE types, severity levels, and verification conclusions. It supports CLI, web dashboard review, and SARIF delivery.
## Features
- **Five-stage pipeline**: Indexing → semgrep pre-scans → AI auditing → Counteractive verification → Manual review
- **Combination of determinism and semantics**: semgrep rules capture deterministic issues with zero tokens; AI focuses on capturing business logic and cross-function vulnerabilities that static tools miss
- **Counteractive verification**: The agent actively refutes each identified issue; only issues where “sink is dangerous, inputs are controllable, and there’s no mitigation” are confirmed
- **POC reference library**: The local [Threekiii/Awesome-POC](https://github.com/Threekiii/Awesome-POC) library (1103 real vulnerabilities, 834MB size, needs to be downloaded locally) is searched by title. During verification, MD content is read for confirmation; OCR screenshots provide additional support
- **Web dashboard**: Select targets (files or entire folders), perform scans (SSE real-time progress), filter statistics, batch three-state reviews, one-click repairs (AI-generated patches → preview diff → apply and automatically back up), set-up web settings API parameters; shares the same database with the CLI
- **Splitting analysis and token control**: AI processing is done in batches (sinks marked as “analyzed”, remaining scans continue automatically); long function slices are truncated to a window centered around sinks; if the token budget exceeds 500,000, the process stops automatically with a prompt for continued scanning; optional exclusion directories for scans
- **SARIF 2.1.0 export**: Compatible with GitHub code scanning / VS Code
- Throughout the process, the audited code and POC content are treated as **untrusted data** (prompt injection defense)
## Environment
```bash
# 1. Conditionally create a conda environment
conda create -n claudit python=3.11 -y
conda activate claudit
# 2. Install dependencies (semgrep is optional; dev includes pytest)
pip install -e.[dev,semgrep]
# 3. Configure API key (put the.env file in the project root directory so it can be accessed from any directory)
cp.env.example.env # Replace ANTHROPIC_API_KEY here
```
Optional: CLAUDIT_POC_DIR (POC library path), CLAUDIT_OCR_PYTHON (with easyocr interpreter, default is base conda), CLAUDIT_MODEL, CLAUDIT_LIMIT, CLAUDIT_VERIFY_LIMIT, CLAUDIT_EXCLUDE. > 📦 **POC reference libraries are not stored in the repository** (834MB local data, including 3000+ screenshots). To use the verification feature, download it manually:
>
> ```bash
> git clone --depth 1 https://github.com/Threekiii/Awesome-POC.git
> # The tool will look for Awesome-POC-2.0 or Awesome-POC in the project root directory by default
> # You can also place the cloned directory anywhere else, and set CLAUDIT_POC_DIR to point to it
> ```
>
> If this is missing, the verification will be downgraded to without POC references (OCR screenshots will still be used during stage two), **other features remain unaffected**. ## Quick start
```bash
# Includes a deliberately vulnerable Flask fixture. See the full effect within 5 seconds
claudit audit tests/fixtures/vuln_app --limit 5 --verify
claudit findings --target tests/fixtures/vuln_app
claudit dashboard --target tests/fixtures/vuln_app # Web review
```
## Usage Guide
```bash
# Full static scan (without AI, zero tokens): tree-sitter indexing + semgrep deterministic pre-scans
claudit audit --no-ai
# Complete audit: Indexing + semgrep pre-scans + AI analysis + automatic counteractive verification
claudit audit --limit 10 --verify # `--no-semgrep` can skip pre-scans
# Run verification separately (POC reference at stage one → uncertain OCR at stage two)
claudit verify --target --limit 10
# POC reference library
claudit poc-index # Rebuild MD index
claudit poc-search "SQL injection" --top 5 # Search for vulnerabilities by title
claudit poc-ocr # Manually OCR screenshots (reuse easyocr)
# View / Details / Manual review markers
claudit findings --target # Includes Source column (ai/semgrep)
claudit show --target
claudit mark --status confirmed|fp --target
# Web dashboard: Select targets → Scan (SSE progress) → Review → One-click repair → Settings
claudit dashboard [--target ] --port 8000
# Or directly double-click the startup.bat file in the project root directory to access the dashboard without parameters
# Export SARIF 2.1.0 (compatible with GitHub code scanning / VS Code)
```
`claudit export --target --out findings.sarif [--status confirmed]`
The audit results are stored in `/.claudit/audit.db` (SQLite). The CLI and dashboard share this database. > ⚠️ The dashboard is defaulted to only be bound to `127.0.0.1`. The findings include source code and sensitive information; they should not be exposed through `--host`. ## Audit Pipeline
① Indexing (M1): Tree-sitter parsing → Function/Call Graph/source(user input)/sink(dangerous functions)
② Pre-scan (M2): Semgrep rules → Deterministic findings (source=semgrep, zero tokens)
③ AI Audit (M3): Sliceing “sink + reachable contamination paths” → Claude-structured output (CWE/severity/evidence/reparations)
④ Counter-verification (M4): The interrogator agent refutes each finding
├ Matches POC titles → Read the MD content for corroboration
├ Confirmed/Refuted
└ Uncertain → OCR-related POC screenshots → Re-validation (stage=ocr)
⑤ Review (M6): CLI marking/WEB dashboard batch triple review
⑥ Delivery (M7): SARIF 2.1.0 export
## Project Structure
```
Z:\py\CodeAuditing\
├── claudit/
│ ├── config.py # Load.env (cwd + project root directory double protection) + configuration
│ ├── store.py # SQLite DAO (runs/files/functions/sinks/sources/findings/verifications)
│ ├── core/
│ │ ├── rules.py # Vulnerability taxonomy → source/sink AST matching rules
│ │ ├── indexer.py # Tree-sitter parsing, extracting functions, matching source/sink
│ │ ├── callgraph.py # Call graph + contamination reachability (slice priority)
│ │ ├── semgrep.py # M2 pre-scan: scanning + normalizing + storing (source=semgrep)
│ │ ├── ai.py # LLM base class + analyzer (tool-use structured output)
│ │ ├── finder.py # Slice selection → AI → deduplication → storage
│ │ ├── verifier.py # M4 counter-verification (md → OCR two-stage process)
│ │ ├── sarif.py # M7 SARIF 2.1.0 export
│ │ └── poc/ # POC reference library: indexer/retriever (title retrieval)/ocr (sub-process reuse with easyocr))
│ ├── rules/semgrep/ # 18 rules (pure ASCII, including UPLOAD/SSTI/XXE/redirection etc.)
│ ├── web/ # FastAPI dashboard + native JS frontend (no build)
│ └── cli/app.py # audit/verify/findings/show/mark/export/dashboard/poc*
├── tests/ # 29 cases (indexing/semgrep/verification/dashboard/SARIF/migration)
│ └── fixtures/ # vuln_app (vulnerability fixture), pocs (mini POC library), semgrep_target)
└── Awesome-POC-2.0/ # POC reference library (1103 real vulnerabilities, including screenshots)
```
## Configuration (.env)
| Variable | Default | Description |
|--------|--------|-------------|
| `ANTHROPIC_API_KEY` | — | Required, for AI analysis/verification |
| `CLAUDIT_MODEL` | `claude-sonnet-4-5` | Audit model |
| `CLAUDIT_LIMIT` | `50` | Maximum number of slices per analysis |
| `CLAUDIT_VERIFY_LIMIT` | `50` | Maximum number of findings per verification |
| `CLAUDIT_POC_DIR` | Project root/Awesome-POC-2.0 | POC reference library (default if not set; relative path parsed according to cwd) |
| `CLAUDIT_OCR_PYTHON` | `C:/ProgramData/miniconda3/python.exe` | OCR interpreter (needed with easyocr) |
| `CLAUDIT_EXCLUDE` | — | Indexing exclusion directories (separated by commas) |
| `CLAUDIT_SLICE_MAX_LINES` | `250` | Threshold for breaking long function slices |
| `CLAUDIT_MAX_TOKENS` | `500000` | Token budget for AI phase (stops if exceeded; continues scanning) |
## Known Limitations
- XSS server-side rendering scenarios are poorly detected; FastAPI’s dependency injection parameters (`Depends`) are not recognized as source.
- POC retrieval uses weighted keywords based on titles (no vector embedding).
- Searching references still relies on rule tables and model knowledge (enhancements for POC involvement in analysis phases are pending).
- Both audited code and POC content are treated as data, not as instructions (prompt injection defense).
## Testing
```bash
python -m pytest tests/ # 29 cases; semgrep cases automatically skip when semgrep not installed
```