# cyberstrategyinstitute/ai-safe2-framework architecture

> Architecture diagram of the GitHub repository cyberstrategyinstitute/ai-safe2-framework, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cyberstrategyinstitute/ai-safe2-framework
- Repository: https://github.com/cyberstrategyinstitute/ai-safe2-framework

## Overview

AI SAFE² is a governance framework with a Python CLI and security tools for assessing agentic systems; NEXUS is its first-party runtime-enforcement implementation. A typical assessment begins with a developer invoking a scan or assessment, produces findings and evidence, and may inform human-reviewed AISM decisions and reports. The repository also includes MCP server security tools and NEXUS identity, agent/tool, and payment capabilities. Sampled source confirms scanner internals and cautious evidence ingestion; wiring among several listed subsystems is not shown, so those links are omitted.

Main entry points: [`scanner/scanner.py`](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/scanner.py) (Static Scanner), [`safe2/cli.py`](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/cli.py) (SAFE² CLI), [`scanner/cli.py`](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/cli.py) (Scanner CLI), [`safe2/aism/ingest.py`](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/aism/ingest.py) (AISM Ingestion)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_assessment["Assessment Tools"]
  node_static_scanner["Static Scanner<br/>[scanner.py]"]
  node_scanner_rules["Detection Rules"]
  node_scanner_cli["Scanner CLI<br/>[cli.py]"]
end

subgraph group_governance["SAFE² Governance"]
  node_safe2_cli["SAFE² CLI<br/>[cli.py]"]
  node_safe2_commands["Assessment Commands"]
  node_evidence["Evidence Capture"]
  node_report_auth["Report Attestation<br/>[report_auth.py]"]
  node_aism_ingest["AISM Ingestion<br/>[ingest.py]"]
  node_challenge["Challenge Lab"]
  node_safe2_reporting["Report Formats<br/>[formats.py]"]
end

subgraph group_mcp["MCP Security"]
  node_mcp_app["MCP Server<br/>[app.py]"]
  node_mcp_auth["MCP Authentication<br/>[auth.py]"]
  node_mcp_tools["MCP Tools"]
  node_mcp_scan["MCP Source Scan"]
  node_mcp_score["MCP Posture Score"]
  node_mcp_wrap["MCP Wrapper"]
end

subgraph group_nexus["NEXUS Runtime"]
  node_nexus_gateway["NEXUS Gateway<br/>[gateway.py]"]
  node_nexus_adapter["MCP Adapter<br/>[adapter.py]"]
  node_nexus_sdk["NEXUS SDK"]
  node_payment_authority["Payment Authority<br/>[authority.py]"]
  node_compliance_score["Compliance Score<br/>[nexus-score.py]"]
end

node_developer(("Developer"))

node_developer -->|"invokes scan"| node_scanner_cli
node_developer -->|"invokes assessment"| node_safe2_cli
node_static_scanner -->|"applies rules"| node_scanner_rules
node_static_scanner -->|"returns findings"| node_scanner_cli
node_safe2_cli -->|"dispatches commands"| node_safe2_commands
node_aism_ingest -->|"verifies challenge evidence"| node_challenge
node_nexus_gateway -.->|"optional MCP integration"| node_nexus_adapter

click node_static_scanner "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/scanner.py"
click node_scanner_rules "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/scanner/rules"
click node_scanner_cli "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/cli.py"
click node_safe2_cli "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/cli.py"
click node_safe2_commands "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/commands"
click node_evidence "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/evidence"
click node_report_auth "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/evidence/report_auth.py"
click node_aism_ingest "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/aism/ingest.py"
click node_challenge "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/challenge"
click node_safe2_reporting "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/reporting/formats.py"
click node_mcp_app "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/skills/mcp/src/mcp_server/app.py"
click node_mcp_auth "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/skills/mcp/src/mcp_server/auth.py"
click node_mcp_tools "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/skills/mcp/src/mcp_server/tools"
click node_mcp_scan "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/scan"
click node_mcp_score "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/score"
click node_mcp_wrap "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/wrap"
click node_nexus_gateway "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/docker/gateway/gateway.py"
click node_nexus_adapter "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/adapters/mcp/adapter.py"
click node_nexus_sdk "https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/NEXUS/sdk/python/nexus_sdk"
click node_payment_authority "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/sdk/python/nexus_sdk/payments/authority.py"
click node_compliance_score "https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/compliance/scoring/nexus-score.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_static_scanner,node_scanner_rules,node_scanner_cli toneBlue
class node_safe2_cli,node_safe2_commands,node_evidence,node_report_auth,node_aism_ingest,node_challenge,node_safe2_reporting toneAmber
class node_mcp_app,node_mcp_auth,node_mcp_tools,node_mcp_scan,node_mcp_score,node_mcp_wrap toneMint
class node_nexus_gateway,node_nexus_adapter,node_nexus_sdk,node_payment_authority,node_compliance_score toneRose
class node_developer toneIndigo
```

## Components

### Assessment Tools

- [Static Scanner](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/scanner.py): `scanner/scanner.py`
- [Detection Rules](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/scanner/rules): `scanner/rules`
- [Scanner CLI](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/scanner/cli.py): `scanner/cli.py`

### SAFE² Governance

- [SAFE² CLI](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/cli.py): `safe2/cli.py`
- [Assessment Commands](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/commands): `safe2/commands`
- [Evidence Capture](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/evidence): `safe2/evidence`
- [Report Attestation](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/evidence/report_auth.py): `safe2/evidence/report_auth.py`
- [AISM Ingestion](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/aism/ingest.py): `safe2/aism/ingest.py`
- [Challenge Lab](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/safe2/challenge): `safe2/challenge`
- [Report Formats](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/safe2/reporting/formats.py): `safe2/reporting/formats.py`

### MCP Security

- [MCP Server](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/skills/mcp/src/mcp_server/app.py): `skills/mcp/src/mcp_server/app.py`
- [MCP Authentication](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/skills/mcp/src/mcp_server/auth.py): `skills/mcp/src/mcp_server/auth.py`
- [MCP Tools](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/skills/mcp/src/mcp_server/tools): `skills/mcp/src/mcp_server/tools`
- [MCP Source Scan](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/scan): `aisafe2_mcp_tools/scan`
- [MCP Posture Score](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/score): `aisafe2_mcp_tools/score`
- [MCP Wrapper](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/aisafe2_mcp_tools/wrap): `aisafe2_mcp_tools/wrap`

### NEXUS Runtime

- [NEXUS Gateway](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/docker/gateway/gateway.py): `NEXUS/docker/gateway/gateway.py`
- [MCP Adapter](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/adapters/mcp/adapter.py): `NEXUS/adapters/mcp/adapter.py`
- [NEXUS SDK](https://github.com/cyberstrategyinstitute/ai-safe2-framework/tree/main/NEXUS/sdk/python/nexus_sdk): `NEXUS/sdk/python/nexus_sdk`
- [Payment Authority](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/sdk/python/nexus_sdk/payments/authority.py): `NEXUS/sdk/python/nexus_sdk/payments/authority.py`
- [Compliance Score](https://github.com/cyberstrategyinstitute/ai-safe2-framework/blob/main/NEXUS/compliance/scoring/nexus-score.py): `NEXUS/compliance/scoring/nexus-score.py`

### Other components

- **Developer**

## Connections

- Developer → Scanner CLI: invokes scan
- Developer → SAFE² CLI: invokes assessment
- Static Scanner → Detection Rules: applies rules
- Static Scanner → Scanner CLI: returns findings
- SAFE² CLI → Assessment Commands: dispatches commands
- AISM Ingestion → Challenge Lab: verifies challenge evidence
- NEXUS Gateway → MCP Adapter: optional MCP integration