vrsebeatriz/cypherguard-ia

How vrsebeatriz/cypherguard-ia works

CypherGuard AI is a local-first JavaScript/Node.js security scanner with a CLI and API-backed dashboard. Its main workflow runs Semgrep, filters findings with AST taint analysis and local Ollama validation, audits dependencies against OSV.dev, then presents reports and optional patches for review and application. The repository also includes SARIF export, scan history, access control and audit logging. Edges rely on README workflow statements and the shown source/index references; some implementation details are unsampled, so those links are omitted where ownership is unclear.

Main entry points: app.ts API application · index.ts CLI · validator.ts AI validation · sca.ts Dependency audit

Components 23

User interfaces

CLI src/index.ts
Dashboard UI public/app.js
API application src/app.ts
HTTP server src/server.ts

Security analysis

Semgrep scan src/scanner/semgrep.ts
AST taint analysis src/analyzer/ast.ts
Entropy analysis src/analyzer/entropy.ts
AI validation src/ai/validator.ts
Dependency audit src/scanner/sca.ts

Reports and remediation

Patch review and apply src/scanner/patcher.ts
SARIF export src/scanner/sarif.ts
Scan history src/history/storage.ts

Application services

Configuration src/config/loader.ts
Ollama health check src/utils/healthCheck.ts
Ollama process manager src/utils/ollamaManager.ts
AI result parser src/utils/parser.ts
Security knowledge src/ai/knowledge.ts
Custom rule focus src/ai/customFocus.ts

Access and safety

Authentication and audit src/auth/service.ts
Path guard src/security/pathGuard.ts
Git safeguards src/scanner/git.ts

Other components

OSV.dev
Ollama local model

Connections 30

CLI → Semgrep scan: runs scan src/index.ts
CLI → AST taint analysis: checks taint src/index.ts
CLI → Entropy analysis: checks secrets src/index.ts
CLI → AI validation: validates findings src/index.ts
CLI → Dependency audit: audits dependencies src/index.ts
CLI → SARIF export: exports results src/index.ts
CLI → Patch review and apply: offers patches src/index.ts
CLI → Git safeguards: checks worktree README.md
HTTP server → API application: serves routes src/server.ts
Dashboard UI → API application: uses API README.md
API application → Semgrep scan: runs scan src/app.ts
API application → AST taint analysis: checks taint src/app.ts
API application → AI validation: validates findings src/app.ts
API application → Dependency audit: audits dependencies src/app.ts
API application → Patch review and apply: applies patches src/app.ts
API application → SARIF export: exports results src/app.ts
API application → Scan history: stores scans src/app.ts
API application → Authentication and audit: checks access src/app.ts
API application → Path guard: guards paths src/app.ts
API application → Ollama health check: checks model src/app.ts
API application → Configuration: reads settings src/app.ts
API application → Ollama process manager: manages model src/app.ts
Dependency audit → OSV.dev: queries vulnerabilities src/scanner/sca.ts
AI validation → Configuration: loads settings src/ai/validator.ts
AI validation → Ollama local model: asks local model README.md
AI validation → AI result parser: parses response src/ai/validator.ts
AI validation → Security knowledge: uses guidelines src/ai/validator.ts
AI validation → Custom rule focus: gets rule focus src/ai/validator.ts
Ollama health check → Configuration: reads settings src/utils/healthCheck.ts
Ollama process manager → Ollama local model: starts process src/utils/ollamaManager.ts

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·