# alishasinghania/aitrace-cli architecture

> Architecture diagram of the GitHub repository alishasinghania/aitrace-cli, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/alishasinghania/aitrace-cli
- Repository: https://github.com/alishasinghania/aitrace-cli

## Overview

AITrace is a static security scanner for AI application repositories. A user runs the CLI on a local or remote codebase; discovery inventories its AI stack, analysis traces potentially untrusted data to sensitive sinks and checks vulnerability patterns, and the engine assembles findings for reports and optional exploit payloads. The map includes documented governance and export capabilities. Some subsystem links are based on the README or SOURCE INDEX references; unsampled implementation details are not assumed.

Main entry points: [`src/core/engine.py`](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/engine.py) (Analysis engine), [`src/aitrace_cli.py`](https://github.com/alishasinghania/aitrace-cli/blob/main/src/aitrace_cli.py) (CLI), [`src/core/analyzers/architecture_inference.py`](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/architecture_inference.py) (AI architecture detection), [`src/core/features/exploit_synthesizer.py`](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/exploit_synthesizer.py) (Exploit synthesis)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Scan entry"]
  node_cli["CLI<br/>[aitrace_cli.py]"]
  node_engine["Analysis engine<br/>[engine.py]"]
end

subgraph group_discovery["Repository discovery"]
  node_surface["Surface discovery<br/>[surface.py]"]
  node_deep["Deep discovery<br/>[deep.py]"]
  node_semantic["Semantic mapping<br/>[semantic.py]"]
  node_architecture["AI architecture detection"]
  node_ragdetector["RAG detection<br/>[rag_detector.py]"]
  node_mcpdetector["MCP inspection<br/>[mcp_detector.py]"]
end

subgraph group_analysis["Security analysis"]
  node_dataflow["Taint analysis"]
  node_crossfile["Cross-file tracing<br/>[crossfile_taint.py]"]
  node_patterns["Pattern analysis"]
  node_attackpaths["Attack path analysis"]
  node_supplychain["Model supply chain"]
  node_prompt["Prompt injection checks"]
  node_sensitive["Sensitive data checks"]
end

subgraph group_response["Verification and governance"]
  node_exploit["Exploit synthesis"]
  node_ragpoison["RAG poison payloads"]
  node_verify["Finding verification"]
  node_llmverify["LLM verification<br/>[llm_verifier.py]"]
  node_policy["Policy gate<br/>[policy.py]"]
  node_risk["Risk scoring<br/>[risk_scoring.py]"]
end

subgraph group_outputs["Reports and exports"]
  node_html["HTML report<br/>[html_report.py]"]
  node_diagram["Architecture diagram"]
  node_cyclonedx["CycloneDX BOM<br/>[cyclonedx.py]"]
  node_spdx["SPDX BOM<br/>[spdx.py]"]
  node_riskreport["Risk report<br/>[risk_report.py]"]
end

node_user(("Scanner user"))

node_user -->|"scans repository"| node_cli
node_cli -->|"starts analysis"| node_engine
node_engine -->|"discovers surface"| node_surface
node_engine -->|"discovers details"| node_deep
node_engine -->|"maps flows"| node_semantic
node_engine -->|"infers architecture"| node_architecture
node_architecture -->|"runs detector"| node_ragdetector
node_architecture -->|"runs detector"| node_mcpdetector
node_engine -->|"traces data"| node_dataflow
node_engine -->|"traces across files"| node_crossfile
node_engine -->|"checks patterns"| node_patterns
node_engine -->|"analyzes paths"| node_attackpaths
node_engine -->|"analyzes models"| node_supplychain
node_engine -->|"checks injection"| node_prompt
node_engine -->|"checks exposures"| node_sensitive
node_cli -->|"requests payloads"| node_exploit
node_exploit -->|"checks RAG"| node_ragpoison
node_cli -->|"verifies findings"| node_verify
node_verify -.->|"uses optional verifier"| node_llmverify
node_engine -->|"applies policy"| node_policy
node_engine -->|"scores risk"| node_risk
node_cli -->|"writes report"| node_html
node_html -->|"renders diagram"| node_diagram
node_cli -->|"exports BOM"| node_cyclonedx
node_cli -->|"exports BOM"| node_spdx
node_cli -->|"exports risk"| node_riskreport

click node_cli "https://github.com/alishasinghania/aitrace-cli/blob/main/src/aitrace_cli.py"
click node_engine "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/engine.py"
click node_surface "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/surface.py"
click node_deep "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/deep.py"
click node_semantic "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/semantic.py"
click node_architecture "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/architecture_inference.py"
click node_ragdetector "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/detectors/rag_detector.py"
click node_mcpdetector "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/detectors/mcp_detector.py"
click node_dataflow "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/dataflow_analyzer.py"
click node_crossfile "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/crossfile_taint.py"
click node_patterns "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/pattern_analyzer.py"
click node_attackpaths "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/ai_attack_path_analyzer.py"
click node_supplychain "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/model_supply_chain_analyzer.py"
click node_prompt "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/prompt_injection_detector.py"
click node_sensitive "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/sensitive_data_detector.py"
click node_exploit "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/exploit_synthesizer.py"
click node_ragpoison "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/rag_poison_simulator.py"
click node_verify "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/finding_verifier.py"
click node_llmverify "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/llm_verifier.py"
click node_policy "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/governance/policy.py"
click node_risk "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/governance/risk_scoring.py"
click node_html "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/html_report.py"
click node_diagram "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/component_diagram.py"
click node_cyclonedx "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/cyclonedx.py"
click node_spdx "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/spdx.py"
click node_riskreport "https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/risk_report.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_engine,node_user toneBlue
class node_surface,node_deep,node_semantic,node_architecture,node_ragdetector,node_mcpdetector toneAmber
class node_dataflow,node_crossfile,node_patterns,node_attackpaths,node_supplychain,node_prompt,node_sensitive toneMint
class node_exploit,node_ragpoison,node_verify,node_llmverify,node_policy,node_risk toneRose
class node_html,node_diagram,node_cyclonedx,node_spdx,node_riskreport toneIndigo
```

## Components

### Scan entry

- [CLI](https://github.com/alishasinghania/aitrace-cli/blob/main/src/aitrace_cli.py): `src/aitrace_cli.py`
- [Analysis engine](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/engine.py): `src/core/engine.py`

### Repository discovery

- [Surface discovery](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/surface.py): `src/core/discovery/surface.py`
- [Deep discovery](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/deep.py): `src/core/discovery/deep.py`
- [Semantic mapping](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/discovery/semantic.py): `src/core/discovery/semantic.py`
- [AI architecture detection](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/architecture_inference.py): `src/core/analyzers/architecture_inference.py`
- [RAG detection](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/detectors/rag_detector.py): `src/core/detectors/rag_detector.py`
- [MCP inspection](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/detectors/mcp_detector.py): `src/core/detectors/mcp_detector.py`

### Security analysis

- [Taint analysis](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/dataflow_analyzer.py): `src/core/analyzers/dataflow_analyzer.py`
- [Cross-file tracing](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/crossfile_taint.py): `src/core/analyzers/crossfile_taint.py`
- [Pattern analysis](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/pattern_analyzer.py): `src/core/analyzers/pattern_analyzer.py`
- [Attack path analysis](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/ai_attack_path_analyzer.py): `src/core/analyzers/ai_attack_path_analyzer.py`
- [Model supply chain](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/model_supply_chain_analyzer.py): `src/core/analyzers/model_supply_chain_analyzer.py`
- [Prompt injection checks](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/prompt_injection_detector.py): `src/core/analyzers/prompt_injection_detector.py`
- [Sensitive data checks](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/analyzers/sensitive_data_detector.py): `src/core/analyzers/sensitive_data_detector.py`

### Verification and governance

- [Exploit synthesis](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/exploit_synthesizer.py): `src/core/features/exploit_synthesizer.py`
- [RAG poison payloads](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/rag_poison_simulator.py): `src/core/features/rag_poison_simulator.py`
- [Finding verification](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/finding_verifier.py): `src/core/features/finding_verifier.py`
- [LLM verification](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/features/llm_verifier.py): `src/core/features/llm_verifier.py`
- [Policy gate](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/governance/policy.py): `src/core/governance/policy.py`
- [Risk scoring](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/governance/risk_scoring.py): `src/core/governance/risk_scoring.py`

### Reports and exports

- [HTML report](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/html_report.py): `src/core/exporters/html_report.py`
- [Architecture diagram](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/component_diagram.py): `src/core/exporters/component_diagram.py`
- [CycloneDX BOM](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/cyclonedx.py): `src/core/exporters/cyclonedx.py`
- [SPDX BOM](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/spdx.py): `src/core/exporters/spdx.py`
- [Risk report](https://github.com/alishasinghania/aitrace-cli/blob/main/src/core/exporters/risk_report.py): `src/core/exporters/risk_report.py`

### Other components

- **Scanner user**

## Connections

- Scanner user → CLI: scans repository (evidence: `README.md`)
- CLI → Analysis engine: starts analysis (evidence: `src/aitrace_cli.py`)
- Analysis engine → Surface discovery: discovers surface (evidence: `src/core/engine.py`)
- Analysis engine → Deep discovery: discovers details (evidence: `src/core/engine.py`)
- Analysis engine → Semantic mapping: maps flows (evidence: `src/core/engine.py`)
- Analysis engine → AI architecture detection: infers architecture (evidence: `src/core/engine.py`)
- AI architecture detection → RAG detection: runs detector (evidence: `src/core/analyzers/architecture_inference.py`)
- AI architecture detection → MCP inspection: runs detector (evidence: `src/core/analyzers/architecture_inference.py`)
- Analysis engine → Taint analysis: traces data (evidence: `README.md`)
- Analysis engine → Cross-file tracing: traces across files (evidence: `README.md`)
- Analysis engine → Pattern analysis: checks patterns (evidence: `src/core/engine.py`)
- Analysis engine → Attack path analysis: analyzes paths (evidence: `src/core/engine.py`)
- Analysis engine → Model supply chain: analyzes models (evidence: `src/core/engine.py`)
- Analysis engine → Prompt injection checks: checks injection (evidence: `src/core/engine.py`)
- Analysis engine → Sensitive data checks: checks exposures (evidence: `src/core/engine.py`)
- CLI → Exploit synthesis: requests payloads (evidence: `src/aitrace_cli.py`)
- Exploit synthesis → RAG poison payloads: checks RAG (evidence: `src/core/features/exploit_synthesizer.py`)
- CLI → Finding verification: verifies findings (evidence: `src/aitrace_cli.py`)
- Finding verification → LLM verification: uses optional verifier (evidence: `src/core/features/finding_verifier.py`)
- Analysis engine → Policy gate: applies policy (evidence: `src/core/engine.py`)
- Analysis engine → Risk scoring: scores risk (evidence: `README.md`)
- CLI → HTML report: writes report (evidence: `src/aitrace_cli.py`)
- HTML report → Architecture diagram: renders diagram (evidence: `src/core/exporters/html_report.py`)
- CLI → CycloneDX BOM: exports BOM (evidence: `README.md`)
- CLI → SPDX BOM: exports BOM (evidence: `README.md`)
- CLI → Risk report: exports risk (evidence: `README.md`)