vgx - A Git pre-commit security scanner with LLM integra

项目说明

VGX

Open-source security scanner for AI-assisted de.

<p align="center">
<img src=" alt="">
<img src=" alt="License">
<img src=" alt="Stars">
</p>

<p align="center">
<a href="#installation">Installation</a> &bull;
<a href="#cli-reference">CLI Reference</a> &bull;
<a href="#api">API</a> &bull;
<a href="#">VS Code</a> &bull;
<a href="#how-it-works">How It Works</a>
</p>

---

The Problem

With AI coding assistants (Copilot, Cursor, Claude), de ship code they didn't write and often don't fully understand. Studies show:

you know what's AI-generated and catch before they hit production.

---

Features

| Feature | Description |
|---------|-------------|
| AI Code Detection | Identify AI-generated code using stylometry + pattern analysis |
| Security Scanning | detection (+ optional OpenAI) |
| Pre-commit Hooks | Block insecure code before it's committed |
| VS Code Extension | Real-time AI detection in your editor |
| Offline-First | No API keys required. Your code ne your machine. |
| CI/CD Ready | JSON output for pipeline integration |

---

Installation

Quick Install (Linux/macOS)

Go Install

Docker

Build from Source

---

CLI Reference

Commands

— AI Code Detection

Analyze files for AI-generated code patterns.

Options:

| Flag | Short | Default | Description |
|------|-------|---------|-------------|
| --path | -p | . | Path to scan |
| --format | -f | text | Output format: text, json |
| --threshold | | 70 | AI confidence threshold (0-100) |

Example Output:

vgx scan — Security Scanning

Scan for using Semgrep rules.

Options:

| Flag | Default | Description |
|------|---------|-------------|
| --changes | true | Scan only git-changed files |
| --report | true | Generate markdown report |
| --update-context | true | Update file context cache |

Detects:

---

API

JSON Output Schema

#### Detection Result

#### Result

Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Success, no issues found |
| 1 | Issues found (AI code or ) |
| 2 | Error (invalid path, etc.) |

---

VS Code Extension

Real-time AI code detection in your editor.

Features

Commands

| Command | Description |
|---------|-------------|
| VGX: Detect AI Code in File | Analyze current file |
| VGX: Detect AI Code in Workspace | Scan all files |
| VGX: Security Scan File | Run security scan |

Settings

Installation

---

How It Works

AI Detection Algorithm

VGX uses a combination of stylometry (code style analysis) and pattern matching to detect AI-generated code.

Stylometry Features

| Feature | AI Signal | Weight |
|---------|-----------|--------|
| Naming Consistency | High consistency = AI | 20% |
| Indentation | Perfect consistency = AI | 20% |
| Boilerplate Ratio | High boilerplate = AI | 20% |
| Line Length | Low = AI | 15% |
| Comment Density | ~15% density = AI | 10% |
| Empty Line Ratio | Consistent spacing = AI | 10% |
| A Line Length | ~45 chars = AI | 5% |

Pattern Detection

16+ language-specific patterns commonly generated by AI:

Ja/TypeScript:

Go:

Python:

---

Pre-commit Hook

Block AI code or before commit.

Setup

With pre-commit framework

---

Configuration

out of the box with zero configuration.

En

| | Description |
|----------|-------------|
| OPENAI_API_KEY | Enable AI-enhanced scanning (optional) |
| SEMGREP_RULES | Custom Semgrep rules (default: p/security-audit) |

Example .env

---

Project Structure

---

Requirements

---

Contributing

Contributions welcome! Please read our contributing guidelines.

---

License

MIT License — see LICENSE

---

Links

---

<p align="center">
_{Built for de who ship AI-assisted code responsibly.}
</p>

项目信息

开发语言：Go

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Git pre-commit security scanner with LLM integration to detect vulnerabilities before they enter your codebase.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。