# cisco-open/ai-deep-sast architecture

> Architecture diagram of the GitHub repository cisco-open/ai-deep-sast, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cisco-open/ai-deep-sast
- Repository: https://github.com/cisco-open/ai-deep-sast

## Overview

AI Deep SAST provides two code-scanning workflows: a fast Semgrep scan with optional per-finding local-model analysis, and a deeper indexed scan that combines rule-guided and exploratory detection with evidence-based triage. Both produce security findings and reports; the deep workflow tracks coverage and persists candidates and verdicts in SQLite. The README documents quality gates and report formats. Some subsystem wiring is inferred from the documented workflow because the sampled excerpts are partial; uncertain call relationships are omitted.

Main entry points: [`deepscan.py`](https://github.com/cisco-open/ai-deep-sast/blob/main/deepscan.py) (Deep Scan Orchestrator), [`aideepsast.py`](https://github.com/cisco-open/ai-deep-sast/blob/main/aideepsast.py) (Fast Scan CLI), [`detector.py`](https://github.com/cisco-open/ai-deep-sast/blob/main/detector.py) (Vulnerability Detector), [`triager.py`](https://github.com/cisco-open/ai-deep-sast/blob/main/triager.py) (Evidence Triage)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_fast["Fast Scan"]
  node_fast_cli["Fast Scan CLI<br/>[aideepsast.py]"]
  node_semgrep["Semgrep Scanner"]
  node_secret_rules["Secret Rules"]
  node_local_model["Local Foundation Model"]
end

subgraph group_deep["Deep Scan"]
  node_deep_cli["Deep Scan Orchestrator<br/>[deepscan.py]"]
  node_indexer["Code Indexer<br/>[indexer.py]"]
  node_coverage["Coverage Tracker<br/>[coverage_guide.py]"]
  node_detector["Vulnerability Detector<br/>[detector.py]"]
  node_triager["Evidence Triage<br/>[triager.py]"]
  node_redactor["Secret Redaction<br/>[redactor.py]"]
  node_llm_client["LLM Client<br/>[llm_client.py]"]
end

subgraph group_rules["Security Rules"]
  node_rule_matcher["Rule Matcher<br/>[rule_matcher.py]"]
  node_asvs_loader["ASVS Requirements<br/>[asvs_loader.py]"]
  node_asvs_data["ASVS Catalog<br/>[asvs_5.0.0.json]"]
  node_codeguard_loader["CodeGuard Rules"]
  node_codeguard_data["CodeGuard Catalog"]
end

subgraph group_output["Findings and Reports"]
  node_finding_store[("Finding Store<br/>[finding_store.py]")]
  node_fast_reports["Fast Reports and Gate<br/>[aideepsast.py]"]
  node_deep_reporter["Deep Scan Reports"]
end

node_developer(("Developer / CI"))
node_frontier_llm["Frontier LLM Service"]
node_report_user(("Report Consumer"))

node_developer -->|"starts scan"| node_fast_cli
node_fast_cli -->|"scans target"| node_semgrep
node_fast_cli -->|"loads rules"| node_secret_rules
node_fast_cli -.->|"analyzes findings"| node_local_model
node_fast_cli -->|"writes reports"| node_fast_reports
node_fast_reports -->|"reports results"| node_report_user
node_developer -->|"starts scan"| node_deep_cli
node_deep_cli -->|"indexes code"| node_indexer
node_deep_cli -->|"tracks coverage"| node_coverage
node_deep_cli -->|"loads findings"| node_semgrep
node_deep_cli -->|"runs detection"| node_detector
node_deep_cli -->|"triages candidates"| node_triager
node_deep_cli -->|"generates reports"| node_deep_reporter
node_coverage -->|"queries functions"| node_indexer
node_coverage -->|"tracks checklist"| node_finding_store
node_detector -->|"reads functions"| node_indexer
node_detector -->|"matches rules"| node_rule_matcher
node_detector -->|"analyzes code"| node_llm_client
node_detector -->|"stores candidates"| node_finding_store
node_triager -->|"builds context"| node_indexer
node_triager -->|"redacts context"| node_redactor
node_triager -->|"requests analysis"| node_llm_client
node_triager -->|"records verdicts"| node_finding_store
node_rule_matcher -->|"consults requirements"| node_asvs_loader
node_rule_matcher -->|"consults patterns"| node_codeguard_loader
node_asvs_loader -->|"loads catalog"| node_asvs_data
node_codeguard_loader -->|"loads rules"| node_codeguard_data
node_llm_client -.->|"sends prompts"| node_frontier_llm
node_deep_reporter -->|"reads findings"| node_finding_store
node_deep_reporter -->|"publishes reports"| node_report_user

click node_fast_cli "https://github.com/cisco-open/ai-deep-sast/blob/main/aideepsast.py"
click node_secret_rules "https://github.com/cisco-open/ai-deep-sast/blob/main/config/custom-secrets.yaml"
click node_local_model "https://github.com/cisco-open/ai-deep-sast/tree/main/foundation-sec-model"
click node_deep_cli "https://github.com/cisco-open/ai-deep-sast/blob/main/deepscan.py"
click node_indexer "https://github.com/cisco-open/ai-deep-sast/blob/main/indexer.py"
click node_coverage "https://github.com/cisco-open/ai-deep-sast/blob/main/coverage_guide.py"
click node_detector "https://github.com/cisco-open/ai-deep-sast/blob/main/detector.py"
click node_triager "https://github.com/cisco-open/ai-deep-sast/blob/main/triager.py"
click node_redactor "https://github.com/cisco-open/ai-deep-sast/blob/main/redactor.py"
click node_rule_matcher "https://github.com/cisco-open/ai-deep-sast/blob/main/rule_matcher.py"
click node_asvs_loader "https://github.com/cisco-open/ai-deep-sast/blob/main/asvs_loader.py"
click node_asvs_data "https://github.com/cisco-open/ai-deep-sast/blob/main/config/asvs/asvs_5.0.0.json"
click node_codeguard_loader "https://github.com/cisco-open/ai-deep-sast/blob/main/codeguard_loader.py"
click node_codeguard_data "https://github.com/cisco-open/ai-deep-sast/tree/main/config/codeguard"
click node_llm_client "https://github.com/cisco-open/ai-deep-sast/blob/main/llm_client.py"
click node_finding_store "https://github.com/cisco-open/ai-deep-sast/blob/main/finding_store.py"
click node_fast_reports "https://github.com/cisco-open/ai-deep-sast/blob/main/aideepsast.py"
click node_deep_reporter "https://github.com/cisco-open/ai-deep-sast/blob/main/deepscan_reporter.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_fast_cli,node_semgrep,node_secret_rules,node_local_model toneBlue
class node_deep_cli,node_indexer,node_coverage,node_detector,node_triager,node_redactor,node_llm_client toneAmber
class node_rule_matcher,node_asvs_loader,node_asvs_data,node_codeguard_loader,node_codeguard_data toneMint
class node_finding_store,node_fast_reports,node_deep_reporter toneRose
class node_developer,node_frontier_llm,node_report_user toneIndigo
```

## Components

### Fast Scan

- [Fast Scan CLI](https://github.com/cisco-open/ai-deep-sast/blob/main/aideepsast.py): `aideepsast.py`
- **Semgrep Scanner**
- [Secret Rules](https://github.com/cisco-open/ai-deep-sast/blob/main/config/custom-secrets.yaml): `config/custom-secrets.yaml`
- [Local Foundation Model](https://github.com/cisco-open/ai-deep-sast/tree/main/foundation-sec-model): `foundation-sec-model`

### Deep Scan

- [Deep Scan Orchestrator](https://github.com/cisco-open/ai-deep-sast/blob/main/deepscan.py): `deepscan.py`
- [Code Indexer](https://github.com/cisco-open/ai-deep-sast/blob/main/indexer.py): `indexer.py`
- [Coverage Tracker](https://github.com/cisco-open/ai-deep-sast/blob/main/coverage_guide.py): `coverage_guide.py`
- [Vulnerability Detector](https://github.com/cisco-open/ai-deep-sast/blob/main/detector.py): `detector.py`
- [Evidence Triage](https://github.com/cisco-open/ai-deep-sast/blob/main/triager.py): `triager.py`
- [Secret Redaction](https://github.com/cisco-open/ai-deep-sast/blob/main/redactor.py): `redactor.py`
- [LLM Client](https://github.com/cisco-open/ai-deep-sast/blob/main/llm_client.py): `llm_client.py`

### Security Rules

- [Rule Matcher](https://github.com/cisco-open/ai-deep-sast/blob/main/rule_matcher.py): `rule_matcher.py`
- [ASVS Requirements](https://github.com/cisco-open/ai-deep-sast/blob/main/asvs_loader.py): `asvs_loader.py`
- [ASVS Catalog](https://github.com/cisco-open/ai-deep-sast/blob/main/config/asvs/asvs_5.0.0.json): `config/asvs/asvs_5.0.0.json`
- [CodeGuard Rules](https://github.com/cisco-open/ai-deep-sast/blob/main/codeguard_loader.py): `codeguard_loader.py`
- [CodeGuard Catalog](https://github.com/cisco-open/ai-deep-sast/tree/main/config/codeguard): `config/codeguard`

### Findings and Reports

- [Finding Store](https://github.com/cisco-open/ai-deep-sast/blob/main/finding_store.py): `finding_store.py`
- [Fast Reports and Gate](https://github.com/cisco-open/ai-deep-sast/blob/main/aideepsast.py): `aideepsast.py`
- [Deep Scan Reports](https://github.com/cisco-open/ai-deep-sast/blob/main/deepscan_reporter.py): `deepscan_reporter.py`

### Other components

- **Developer / CI**
- **Frontier LLM Service**
- **Report Consumer**

## Connections

- Developer / CI → Fast Scan CLI: starts scan
- Fast Scan CLI → Semgrep Scanner: scans target
- Fast Scan CLI → Secret Rules: loads rules
- Fast Scan CLI → Local Foundation Model: analyzes findings
- Fast Scan CLI → Fast Reports and Gate: writes reports
- Fast Reports and Gate → Report Consumer: reports results
- Developer / CI → Deep Scan Orchestrator: starts scan
- Deep Scan Orchestrator → Code Indexer: indexes code
- Deep Scan Orchestrator → Coverage Tracker: tracks coverage
- Deep Scan Orchestrator → Semgrep Scanner: loads findings
- Deep Scan Orchestrator → Vulnerability Detector: runs detection
- Deep Scan Orchestrator → Evidence Triage: triages candidates
- Deep Scan Orchestrator → Deep Scan Reports: generates reports
- Coverage Tracker → Code Indexer: queries functions
- Coverage Tracker → Finding Store: tracks checklist
- Vulnerability Detector → Code Indexer: reads functions
- Vulnerability Detector → Rule Matcher: matches rules
- Vulnerability Detector → LLM Client: analyzes code
- Vulnerability Detector → Finding Store: stores candidates
- Evidence Triage → Code Indexer: builds context
- Evidence Triage → Secret Redaction: redacts context
- Evidence Triage → LLM Client: requests analysis
- Evidence Triage → Finding Store: records verdicts
- Rule Matcher → ASVS Requirements: consults requirements
- Rule Matcher → CodeGuard Rules: consults patterns
- ASVS Requirements → ASVS Catalog: loads catalog
- CodeGuard Rules → CodeGuard Catalog: loads rules
- LLM Client → Frontier LLM Service: sends prompts
- Deep Scan Reports → Finding Store: reads findings
- Deep Scan Reports → Report Consumer: publishes reports