ALNUR - ALNUR — Open-source end-to-end security vulnerabil

项目说明

ALNUR

Open-Source End-to-End Scanner

ALNUR is an open-source, end-to-end security scanner for application projects. Point it at any project directory and it acts as your security analyst — detecting CVEs in dependencies, leaked secrets, architecture flaws, standards , risky port configurations, and — uniquely — security risks in agentic AI applications.

---

Features

| Module | What It Checks |
|---|---|
| C | Queries OSV.dev for known C all detected packages |
| Secret Detection | Finds hardcoded API keys, tokens, passwords, and private keys using patterns + entropy analysis |
| Architecture Analysis | 30+ SAST rules co injection, weak crypto, insecure deserialization, misconfigurations |
| Agentic AI Analysis | 30 rules targeting LLM/agent-specific risks: prompt injection, excessive tool permissions, unauthenticated endpoints, exfiltration combos, MCP misconfigurations |
| Standards Compliance | Gitignore hygiene, lockfile presence, CI/CD, test suite, Docker best practices |
| Port Risk Analysis | Flags dangerous ports in Dockerfiles, docker-compose, config files, and .env |
| LLM-Enhanced Analysis | Optional AI-powered executi and remediation guidance (OpenAI / Anthropic / Groq / Mistral / Ollama) |

Supported Project Types

Node.js · React · Vue.js · Next.js · Express.js · Python · Django · Flask · FastAPI · PHP · Laravel · Symfony · Ruby · Ruby on Rails · Go · Rust · Ja/Gradle) · Spring Boot · .NET

Installation

Or install from source:

Quick Start

CLI Reference

Risk Grading

| Grade | Score | Meaning |
|---|---|---|
| A | 0–19 | Low risk — keep it up |
| B | 20–49 | Minor issues — review low-priority findings |
| C | 50–99 | Moderate risk — address before production |
| D | 100–199 | High risk — urgent remediation needed |
| F | 200+ | Critical — do not deploy |

Output Formats

Exit Codes

| Code | Meaning |
|---|---|
| 0 | Scan completed — no critical/high issues |
| 1 | Critical or high se issues found |

CVE Data Source

ALNUR uses the OSV.dev API — a free, open database co npm, PyPI, Maven, NuGet, RubyGems, crates.io, Packagist, Go modules, and more. No API key required.

Agentic AI Security

ALNUR automatically detects files that import LangChain, CrewAI, AutoGen, LlamaIndex, OpenAI Agents, Anthropic SDK, and other agentic frameworks, then applies 30 dedicated rules:

| Rule Range | Category | Se |
|---|---|---|
| AGENT001–004 | Secrets in agent context / hardcoded LLM keys | HIGH/CRITICAL |
| AGENT005–007 | Prompt injection surfaces | CRITICAL |
| AGENT008–014 | Excessive tool permissions (shell, filesystem, SQL, email) | HIGH/CRITICAL |
| AGENT015–016 | Unauthenticated agent endpoints | CRITICAL |
| AGENT017–018 | Data exfiltration combos (DB + outbound HTTP) | HIGH |
| AGENT019–022 | MCP ser | HIGH/CRITICAL |
| AGENT023–030 | Missing human-in-the-loop, unsafe delegation, code execution | HIGH/CRITICAL |

Optional LLM-Enhanced Analysis

Set any supported API key and ALNUR will automatically include an AI-generated security review at the end of each scan — no extra flags needed.

| En | Provider | Default Model |
|---|---|---|
| OPENAI_API_KEY | OpenAI | gpt-4o-mini |
| ANTHROPIC_API_KEY | Anthropic | claude-haiku-4-5 |
| GROQ_API_KEY | Groq | llama-3.1-8b-instant |
| MISTRAL_API_KEY | Mistral | mistral-small-latest |
| OLLAMA_HOST | Ollama (local) | llama3.2 |

O any setting with en :

Use --no-llm to disable the feature even when a key is present.

Architecture Rules (Sample)

| Rule | Category | Se |
|---|---|---|
| INJ001–009 | SQL / Command Injection | HIGH/CRITICAL |
| DESER001–003 | Insecure Deserialization | HIGH |
| CRYPTO001–004 | Weak Cryptography | MEDIUM/HIGH |
| TLS001–004 | SSL/TLS Misconfiguration | MEDIUM/HIGH |
| DJANGO001–005 | Django Misconfiguration | MEDIUM/HIGH |
| FLASK001–003 | Flask Misconfiguration | MEDIUM/HIGH |
| NODE001–004 | Node.js Misconfiguration | MEDIUM/HIGH |
| DOCKER001–003 | Container Security | MEDIUM/HIGH |
| XSS001–002 | Cross-Site Scripting | HIGH |
| PATH001–002 | Path Tra | HIGH |

Suppressing False Positives

Add # alnur: ignore to any line to exclude it from all scan results:

Contributing

Contributions are welcome. To add a new architecture rule, add an entry to _RULES in alnur/analyzers/architecture.py. To add a new agentic AI rule, add to _RULES in alnur/analyzers/agentic.py. To add a new secret pattern, add to _PATTERNS in alnur/analyzers/secrets.py.

License

MIT — see LICENSE

---

*ALNUR — illuminating what's hidden in your codebase.*

项目信息

开发语言：Python

Star 数：12

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ALNUR — Open-source end-to-end security vulnerability scanner. Detects CVEs, hardcoded secrets, architecture flaws, and port risks across Node.js, Python, PHP, Go, Rust, Java, .NET, Ruby and more展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。