DevSecOps-AI-Triage-CLI - Claude-powered defensive security triage CLI for S

项目说明

de

**Claude-powered defensi triage for SARIF findings, Terraform
configurations, and secret scan results.**

A Python CLI that helps security engineers, de, and platform teams
understand defensi findings faster by combining structured parsers
with AI-assisted analysis. It is strictly defensive — no offensi,
no exploitation, no attack simulation.

What This Tool Does

Four focused workflows:

secai sarif triage — Parse a SARIF v2.1.0 file (CodeQL, Semgrep,

etc.), sort findings by se and CWE criticality, and produce a
prioritized Markdown triage report.

secai terraform review — Parse a .tf file or directory, flag

well-known risk patterns (public S3 ACLs, open security groups, wildcard
IAM, missing encryption, missing CloudTrail), and produce a security
review with line numbers and a remediation checklist.

secai secrets triage — Parse a Gitleaks JSON file, redact every

secret value at parse time, classify findings into rotation tiers, and
produce a triage report with suggested ticket text.

secai c — Summarize a CVE for a defensi,

optionally using a local context file to ground the summary.

Why It Matters

Modern De teams drown in scanner output and have no good way to
prioritize. AI-assisted triage gi de explanation
and prioritized remediation list a senior engineer would write — without
replacing the source-of-truth tools (the scanner itself, Checkov, the
N, the cloud-provider audit log).

Architecture

Every workflow uses a typed dataclass for parser output and a typed

dataclass for the prompt input. There are no untyped dictionaries
flowing between layers.

--mock skips the API call but still runs the full parser, so the

tool can be demoed in CI or on a machine without an API key.

The Claude API client is a thin wrapper around the official Anthropic

SDK — easy to read, easy to swap.

Quickstart

Usage

All four workflows accept --mock, --output markdown, and
--save <path>.

SARIF triage

Terraform review

Secret-scan triage

C

Real API usage

Example Outputs

Pre-generated Markdown reports matching what --mock produces are saved
in outputs/:

sarif-triage-example.md

terraform-re.md

secret-triage-example.md

c.md

Project Structure

Testing

The test suite covers the happy path and the cases that matter in
production:

malformed JSON,

missing files,

empty inputs,

multiple SARIF runs,

missing rule metadata,

malformed SARIF locations,

secret redaction correctness (including no-leakage assertions),

duplicate-secret detection,

urgency classification across rule, prefix, and path,

Terraform risk detection across the public/iam/encryption/logging

categories,

CLI mock-mode end-to-end, including --save and the no-API-key

error path.

Compliance

A NIST SP 800-53 Re System Security Plan lives at
SSP.md. It documents the system boundary, data flow, FIPS
199 categorization (low), the implementation status of each relevant
control family, a risk assessment, and a plan of action and milestones.
The SSP is self-attested and is intended to make this tool easier to
review for use in regulated or defense/aerospace-adjacent en.

A companion JSIG cross-walk at
compliance/JSIG-MAPPING.md tailors the
SSP to a hypothetical Special Access Program (SAP) deployment per the
Joint SAP Implementation Guide — describing how the tool would operate
in an air-gapped SAPF, where the JSIG o raises the bar above the
commercial 800-53 baseline, and what gaps a SAP A&A package would need
to address.

Security Boundaries

Defensive only. No offensi, no exploit generation, no

e advice.

Secrets redacted at parse time. The Gitleaks parser replaces every

secret value before the data reaches the prompt builder, the output
formatter, or any log.

API key not logged. The key is loaded from .env or the process

en and ne.

No prompt-injection from untrusted input — parsed

are inserted into well-defined sections of the prompt, never as raw
instructions.

Future Roadmap

GitHub Actions integration: post the triage report as a PR comment.

Slack notifier for critical secret findings.

Optional Checko in to enrich the Terraform review.

CodeQL / Semgrep result deduplication across multiple SARIF files.

HTML output format for sharing reports outside Markdown .

License

MIT.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Claude-powered defensive security triage CLI for SARIF, Terraform, secret scans, and CVEs. Includes NIST 800-53 SSP and JSIG cross-walk.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。