How cisco-open/ai-deep-sast works
AI Deep SAST provides two code-scanning workflows: a fast Semgrep scan with optional per-finding local-model analysis, and a deeper indexed scan that combines rule-guided and exploratory detection with evidence-based triage. Both produce security findings and reports; the deep workflow tracks coverage and persists candidates and verdicts in SQLite. The README documents quality gates and report formats. Some subsystem wiring is inferred from the documented workflow because the sampled excerpts are partial; uncertain call relationships are omitted.
Main entry points: deepscan.py Deep Scan Orchestrator · aideepsast.py Fast Scan CLI · detector.py Vulnerability Detector · triager.py Evidence Triage
Components 22
Fast Scan
- Fast Scan CLI
aideepsast.py - Semgrep Scanner
- Secret Rules
config/custom-secrets.yaml - Local Foundation Model
foundation-sec-model
Deep Scan
- Deep Scan Orchestrator
deepscan.py - Code Indexer
indexer.py - Coverage Tracker
coverage_guide.py - Vulnerability Detector
detector.py - Evidence Triage
triager.py - Secret Redaction
redactor.py - LLM Client
llm_client.py
Security Rules
- Rule Matcher
rule_matcher.py - ASVS Requirements
asvs_loader.py - ASVS Catalog
config/asvs/asvs_5.0.0.json - CodeGuard Rules
codeguard_loader.py - CodeGuard Catalog
config/codeguard
Findings and Reports
- Finding Store
finding_store.py - Fast Reports and Gate
aideepsast.py - Deep Scan Reports
deepscan_reporter.py
Other components
- Developer / CI
- Frontier LLM Service
- Report Consumer
Connections 30
- Developer / CI → Fast Scan CLI: starts scan
- Fast Scan CLI → Semgrep Scanner: scans target
- Fast Scan CLI → Secret Rules: loads rules
- Fast Scan CLI → Local Foundation Model: analyzes findings
- Fast Scan CLI → Fast Reports and Gate: writes reports
- Fast Reports and Gate → Report Consumer: reports results
- Developer / CI → Deep Scan Orchestrator: starts scan
- Deep Scan Orchestrator → Code Indexer: indexes code
- Deep Scan Orchestrator → Coverage Tracker: tracks coverage
- Deep Scan Orchestrator → Semgrep Scanner: loads findings
- Deep Scan Orchestrator → Vulnerability Detector: runs detection
- Deep Scan Orchestrator → Evidence Triage: triages candidates
- Deep Scan Orchestrator → Deep Scan Reports: generates reports
- Coverage Tracker → Code Indexer: queries functions
- Coverage Tracker → Finding Store: tracks checklist
- Vulnerability Detector → Code Indexer: reads functions
- Vulnerability Detector → Rule Matcher: matches rules
- Vulnerability Detector → LLM Client: analyzes code
- Vulnerability Detector → Finding Store: stores candidates
- Evidence Triage → Code Indexer: builds context
- Evidence Triage → Secret Redaction: redacts context
- Evidence Triage → LLM Client: requests analysis
- Evidence Triage → Finding Store: records verdicts
- Rule Matcher → ASVS Requirements: consults requirements
- Rule Matcher → CodeGuard Rules: consults patterns
- ASVS Requirements → ASVS Catalog: loads catalog
- CodeGuard Rules → CodeGuard Catalog: loads rules
- LLM Client → Frontier LLM Service: sends prompts
- Deep Scan Reports → Finding Store: reads findings
- Deep Scan Reports → Report Consumer: publishes reports