# threx-code/cordon architecture

> Architecture diagram of the GitHub repository threx-code/cordon, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/threx-code/cordon
- Repository: https://github.com/threx-code/cordon

## Overview

Cordon is an offline-first supply-chain security scanner. An operator invokes a scan through the CLI; the engine examines repository files and dependency inventories, applies threat-domain detection and policy, and produces findings and a report. Major branches also cover registry/provenance intelligence, model-assisted scoring, MCP and editor integrations, and isolated sandbox observation. Several named core files in the source index are absent from the supplied tree, so those modules are represented only by supported enclosing directories; links not established by excerpts or the README are omitted.

Main entry points: [`src/cordon_scanner/engine/engine.py`](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/engine/engine.py) (Scan engine), [`src/cordon_scanner/model/client.py`](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/model/client.py) (Model scoring), [`src/cordon_scanner/cli/main.py`](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/cli/main.py) (CLI), [`src/cordon_scanner/intel/registries/registry_client.py`](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/intel/registries/registry_client.py) (Registry checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Scan core"]
  node_cli["CLI<br/>[main.py]"]
  node_engine["Scan engine<br/>[engine.py]"]
  node_sbom["SBOM ingest<br/>[sbom_ingest.py]"]
  node_result["Scan results<br/>[results.py]"]
  node_domain["Core models<br/>[models.py]"]
end

subgraph group_analysis["Detection and policy"]
  node_source_detection["Source analysis"]
  node_malware["Malware detection"]
  node_binary["Binary analysis"]
  node_agent_security["Agent and MCP checks"]
  node_pipeline_security["CI and infrastructure"]
  node_policy["Policy decisions"]
end

subgraph group_intel["Dependency intelligence"]
  node_registry_intel["Registry checks<br/>[registry_client.py]"]
  node_provenance["Provenance checks"]
  node_model_client["Model scoring<br/>[client.py]"]
  node_model_service["Model server<br/>[http.py]"]
end

subgraph group_interfaces["Integrations"]
  node_mcp_server["MCP server<br/>[server.py]"]
  node_vscode["VS Code extension<br/>[extension.ts]"]
  node_jetbrains["JetBrains plugin"]
end

subgraph group_sandbox["Sandbox"]
  node_sandbox_observe["Sandbox observation<br/>[observe.py]"]
  node_sandbox_isolation["Sandbox isolation<br/>[isolation.py]"]
end

node_operator(("Operator"))
node_registry_service(("Package registries"))
node_cloud_service(("Cordon Cloud or model host"))
node_editor_user(("IDE user"))

node_operator -->|"runs scan"| node_cli
node_cli -->|"invokes"| node_engine
node_engine -->|"ingests inventory"| node_sbom
node_engine -->|"analyzes files"| node_source_detection
node_engine -->|"checks malware"| node_malware
node_engine -->|"checks binaries"| node_binary
node_engine -->|"checks agents"| node_agent_security
node_engine -->|"checks pipelines"| node_pipeline_security
node_engine -->|"applies policy"| node_policy
node_engine -->|"reports findings"| node_result
node_engine -.->|"checks packages"| node_registry_intel
node_registry_intel -->|"queries registry"| node_registry_service
node_engine -.->|"checks provenance"| node_provenance
node_engine -.->|"scores packages"| node_model_client
node_model_client -->|"sends features"| node_model_service
node_model_client -.->|"uses cloud auth"| node_cloud_service
node_operator -->|"connects tools"| node_mcp_server
node_editor_user -->|"scans workspace"| node_vscode
node_editor_user -->|"scans project"| node_jetbrains
node_jetbrains -->|"runs scanner"| node_cli
node_sandbox_observe -->|"establishes isolation"| node_sandbox_isolation

click node_cli "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/cli/main.py"
click node_engine "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/engine/engine.py"
click node_sbom "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/engine/sbom_ingest.py"
click node_result "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/foundation/results.py"
click node_domain "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/foundation/models.py"
click node_source_detection "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/analysis"
click node_malware "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/code"
click node_binary "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/binary"
click node_agent_security "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/agents"
click node_pipeline_security "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/infra"
click node_policy "https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/decide"
click node_registry_intel "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/intel/registries/registry_client.py"
click node_provenance "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/intel/provenance/github_repository.py"
click node_model_client "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/model/client.py"
click node_model_service "https://github.com/threx-code/cordon/blob/main/model-server/cordon_model_server/http.py"
click node_mcp_server "https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/mcp/server.py"
click node_vscode "https://github.com/threx-code/cordon/blob/main/editors/vscode/src/extension.ts"
click node_jetbrains "https://github.com/threx-code/cordon/blob/main/editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt"
click node_sandbox_observe "https://github.com/threx-code/cordon/blob/main/src/cordon_sandbox/observe.py"
click node_sandbox_isolation "https://github.com/threx-code/cordon/blob/main/src/cordon_sandbox/isolation.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_engine,node_sbom,node_result,node_domain,node_editor_user toneBlue
class node_source_detection,node_malware,node_binary,node_agent_security,node_pipeline_security,node_policy toneAmber
class node_registry_intel,node_provenance,node_model_client,node_model_service toneMint
class node_mcp_server,node_vscode,node_jetbrains toneRose
class node_sandbox_observe,node_sandbox_isolation,node_operator,node_registry_service,node_cloud_service toneIndigo
```

## Components

### Scan core

- [CLI](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/cli/main.py): `src/cordon_scanner/cli/main.py`
- [Scan engine](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/engine/engine.py): `src/cordon_scanner/engine/engine.py`
- [SBOM ingest](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/engine/sbom_ingest.py): `src/cordon_scanner/engine/sbom_ingest.py`
- [Scan results](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/foundation/results.py): `src/cordon_scanner/foundation/results.py`
- [Core models](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/foundation/models.py): `src/cordon_scanner/foundation/models.py`

### Detection and policy

- [Source analysis](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/analysis): `src/cordon_scanner/analysis`
- [Malware detection](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/code): `src/cordon_scanner/detect/code`
- [Binary analysis](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/binary): `src/cordon_scanner/detect/binary`
- [Agent and MCP checks](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/agents): `src/cordon_scanner/detect/agents`
- [CI and infrastructure](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/detect/infra): `src/cordon_scanner/detect/infra`
- [Policy decisions](https://github.com/threx-code/cordon/tree/main/src/cordon_scanner/decide): `src/cordon_scanner/decide`

### Dependency intelligence

- [Registry checks](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/intel/registries/registry_client.py): `src/cordon_scanner/intel/registries/registry_client.py`
- [Provenance checks](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/intel/provenance/github_repository.py): `src/cordon_scanner/intel/provenance/github_repository.py`
- [Model scoring](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/model/client.py): `src/cordon_scanner/model/client.py`
- [Model server](https://github.com/threx-code/cordon/blob/main/model-server/cordon_model_server/http.py): `model-server/cordon_model_server/http.py`

### Integrations

- [MCP server](https://github.com/threx-code/cordon/blob/main/src/cordon_scanner/mcp/server.py): `src/cordon_scanner/mcp/server.py`
- [VS Code extension](https://github.com/threx-code/cordon/blob/main/editors/vscode/src/extension.ts): `editors/vscode/src/extension.ts`
- [JetBrains plugin](https://github.com/threx-code/cordon/blob/main/editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt): `editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt`

### Sandbox

- [Sandbox observation](https://github.com/threx-code/cordon/blob/main/src/cordon_sandbox/observe.py): `src/cordon_sandbox/observe.py`
- [Sandbox isolation](https://github.com/threx-code/cordon/blob/main/src/cordon_sandbox/isolation.py): `src/cordon_sandbox/isolation.py`

### Other components

- **Operator**
- **Package registries**
- **Cordon Cloud or model host**
- **IDE user**

## Connections

- Operator → CLI: runs scan (evidence: `README.md`)
- CLI → Scan engine: invokes (evidence: `src/cordon_scanner/cli/main.py`)
- Scan engine → SBOM ingest: ingests inventory (evidence: `README.md`)
- Scan engine → Source analysis: analyzes files (evidence: `README.md`)
- Scan engine → Malware detection: checks malware (evidence: `README.md`)
- Scan engine → Binary analysis: checks binaries (evidence: `README.md`)
- Scan engine → Agent and MCP checks: checks agents (evidence: `README.md`)
- Scan engine → CI and infrastructure: checks pipelines (evidence: `README.md`)
- Scan engine → Policy decisions: applies policy (evidence: `README.md`)
- Scan engine → Scan results: reports findings (evidence: `README.md`)
- Scan engine → Registry checks: checks packages
- Registry checks → Package registries: queries registry (evidence: `src/cordon_scanner/intel/registries/registry_client.py`)
- Scan engine → Provenance checks: checks provenance
- Scan engine → Model scoring: scores packages
- Model scoring → Model server: sends features (evidence: `src/cordon_scanner/model/client.py`)
- Model scoring → Cordon Cloud or model host: uses cloud auth (evidence: `src/cordon_scanner/model/client.py`)
- Operator → MCP server: connects tools (evidence: `README.md`)
- IDE user → VS Code extension: scans workspace (evidence: `editors/vscode/src/extension.ts`)
- IDE user → JetBrains plugin: scans project (evidence: `editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt`)
- JetBrains plugin → CLI: runs scanner (evidence: `editors/jetbrains/src/main/kotlin/dev/cordon/jetbrains/CordonProjectService.kt`)
- Sandbox observation → Sandbox isolation: establishes isolation (evidence: `src/cordon_sandbox/observe.py`)