threx-code/cordon

How threx-code/cordon works

Cordon is an offline-first supply-chain security scanner. An operator invokes a scan through the CLI; the engine examines repository files and dependency inventories, applies threat-domain detection and policy, and produces findings and a report. Major branches also cover registry/provenance intelligence, model-assisted scoring, MCP and editor integrations, and isolated sandbox observation. Several named core files in the source index are absent from the supplied tree, so those modules are represented only by supported enclosing directories; links not established by excerpts or the README are omitted.

Main entry points: engine.py Scan engine · client.py Model scoring · main.py CLI · registry_client.py Registry checks

Components 24

Scan core

CLI src/cordon_scanner/cli/main.py
Scan engine src/cordon_scanner/engine/engine.py
SBOM ingest src/cordon_scanner/engine/sbom_ingest.py
Scan results src/cordon_scanner/foundation/results.py
Core models src/cordon_scanner/foundation/models.py

Detection and policy

Source analysis src/cordon_scanner/analysis
Malware detection src/cordon_scanner/detect/code
Binary analysis src/cordon_scanner/detect/binary
Agent and MCP checks src/cordon_scanner/detect/agents
CI and infrastructure src/cordon_scanner/detect/infra
Policy decisions src/cordon_scanner/decide

Dependency intelligence

Registry checks src/cordon_scanner/intel/registries/registry_client.py
Provenance checks src/cordon_scanner/intel/provenance/github_repository.py
Model scoring src/cordon_scanner/model/client.py
Model server model-server/cordon_model_server/http.py

Integrations

MCP server src/cordon_scanner/mcp/server.py
VS Code extension editors/vscode/src/extension.ts
JetBrains plugin editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt

Sandbox

Sandbox observation src/cordon_sandbox/observe.py
Sandbox isolation src/cordon_sandbox/isolation.py

Other components

Operator
Package registries
Cordon Cloud or model host
IDE user

Connections 21

Operator → CLI: runs scan README.md
CLI → Scan engine: invokes src/cordon_scanner/cli/main.py
Scan engine → SBOM ingest: ingests inventory README.md
Scan engine → Source analysis: analyzes files README.md
Scan engine → Malware detection: checks malware README.md
Scan engine → Binary analysis: checks binaries README.md
Scan engine → Agent and MCP checks: checks agents README.md
Scan engine → CI and infrastructure: checks pipelines README.md
Scan engine → Policy decisions: applies policy README.md
Scan engine → Scan results: reports findings README.md
Scan engine → Registry checks: checks packages
Registry checks → Package registries: queries registry src/cordon_scanner/intel/registries/registry_client.py
Scan engine → Provenance checks: checks provenance
Scan engine → Model scoring: scores packages
Model scoring → Model server: sends features src/cordon_scanner/model/client.py
Model scoring → Cordon Cloud or model host: uses cloud auth src/cordon_scanner/model/client.py
Operator → MCP server: connects tools README.md
IDE user → VS Code extension: scans workspace editors/vscode/src/extension.ts
IDE user → JetBrains plugin: scans project editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt
JetBrains plugin → CLI: runs scanner editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt
Sandbox observation → Sandbox isolation: establishes isolation src/cordon_sandbox/observe.py

Drawn by GitDiagram on November 13, 2026 from the repository's file tree, README and source files. Read as Markdown ·