alishasinghania/aitrace-cli

How alishasinghania/aitrace-cli works

AITrace is a static security scanner for AI application repositories. A user runs the CLI on a local or remote codebase; discovery inventories its AI stack, analysis traces potentially untrusted data to sensitive sinks and checks vulnerability patterns, and the engine assembles findings for reports and optional exploit payloads. The map includes documented governance and export capabilities. Some subsystem links are based on the README or SOURCE INDEX references; unsampled implementation details are not assumed.

Main entry points: engine.py Analysis engine · aitrace_cli.py CLI · architecture_inference.py AI architecture detection · exploit_synthesizer.py Exploit synthesis

Components 27

Scan entry

CLI src/aitrace_cli.py
Analysis engine src/core/engine.py

Repository discovery

Surface discovery src/core/discovery/surface.py
Deep discovery src/core/discovery/deep.py
Semantic mapping src/core/discovery/semantic.py
AI architecture detection src/core/analyzers/architecture_inference.py
RAG detection src/core/detectors/rag_detector.py
MCP inspection src/core/detectors/mcp_detector.py

Security analysis

Taint analysis src/core/analyzers/dataflow_analyzer.py
Cross-file tracing src/core/analyzers/crossfile_taint.py
Pattern analysis src/core/analyzers/pattern_analyzer.py
Attack path analysis src/core/analyzers/ai_attack_path_analyzer.py
Model supply chain src/core/analyzers/model_supply_chain_analyzer.py
Prompt injection checks src/core/analyzers/prompt_injection_detector.py
Sensitive data checks src/core/analyzers/sensitive_data_detector.py

Verification and governance

Exploit synthesis src/core/features/exploit_synthesizer.py
RAG poison payloads src/core/features/rag_poison_simulator.py
Finding verification src/core/features/finding_verifier.py
LLM verification src/core/features/llm_verifier.py
Policy gate src/core/governance/policy.py
Risk scoring src/core/governance/risk_scoring.py

Reports and exports

HTML report src/core/exporters/html_report.py
Architecture diagram src/core/exporters/component_diagram.py
CycloneDX BOM src/core/exporters/cyclonedx.py
SPDX BOM src/core/exporters/spdx.py
Risk report src/core/exporters/risk_report.py

Other components

Scanner user

Connections 26

Scanner user → CLI: scans repository README.md
CLI → Analysis engine: starts analysis src/aitrace_cli.py
Analysis engine → Surface discovery: discovers surface src/core/engine.py
Analysis engine → Deep discovery: discovers details src/core/engine.py
Analysis engine → Semantic mapping: maps flows src/core/engine.py
Analysis engine → AI architecture detection: infers architecture src/core/engine.py
AI architecture detection → RAG detection: runs detector src/core/analyzers/architecture_inference.py
AI architecture detection → MCP inspection: runs detector src/core/analyzers/architecture_inference.py
Analysis engine → Taint analysis: traces data README.md
Analysis engine → Cross-file tracing: traces across files README.md
Analysis engine → Pattern analysis: checks patterns src/core/engine.py
Analysis engine → Attack path analysis: analyzes paths src/core/engine.py
Analysis engine → Model supply chain: analyzes models src/core/engine.py
Analysis engine → Prompt injection checks: checks injection src/core/engine.py
Analysis engine → Sensitive data checks: checks exposures src/core/engine.py
CLI → Exploit synthesis: requests payloads src/aitrace_cli.py
Exploit synthesis → RAG poison payloads: checks RAG src/core/features/exploit_synthesizer.py
CLI → Finding verification: verifies findings src/aitrace_cli.py
Finding verification → LLM verification: uses optional verifier src/core/features/finding_verifier.py
Analysis engine → Policy gate: applies policy src/core/engine.py
Analysis engine → Risk scoring: scores risk README.md
CLI → HTML report: writes report src/aitrace_cli.py
HTML report → Architecture diagram: renders diagram src/core/exporters/html_report.py
CLI → CycloneDX BOM: exports BOM README.md
CLI → SPDX BOM: exports BOM README.md
CLI → Risk report: exports risk README.md

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·