codexsentinel

module

v1.0.2 Latest Latest Go to latest Published: Jul 10, 2025 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Voskan/codexsentinel

Links

Open Source Insights

README ¶

CodexSentinel

CodexSentinel is a powerful, blazing-fast static code analyzer for Go, built to identify security vulnerabilities, bad practices, architectural violations, and dependency risks. Designed for developers, DevSecOps, and auditors, it supports both CLI usage and structured JSON reports for integration with CI/CD pipelines.

🚀 Features

🔍 OWASP Top 10 & common vulnerability detection (XSS, SQLi, SSRF, etc.)
📦 Third-party dependency audit (licenses, entropy, vulnerabilities via OSV)
🧠 Taint analysis and SSA-based dataflow tracing
📐 Architecture compliance (direct calls, layer violations)
📏 Code metrics (cyclomatic complexity, size, duplication, dead code)
🔕 .codexsentinel.ignore support for suppressions
⚡ CLI-first experience, ready for automation and pipelines
📄 Reports in SARIF, JSON, Markdown, and HTML formats
✍️ YAML-based custom rule definition
✅ Zero-config startup with smart defaults

🛠️ Installation

go install github.com/Voskan/codexsentinel/cmd/codex@latest

Or use the install script:

curl -sSfL https://raw.githubusercontent.com/Voskan/codexsentinel/main/scripts/install.sh | sh

📦 Usage

codex scan ./...

Optional flags:

Flag	Description
`--config`	Path to `.codex.yml` config file
`--output`	Output report file path
`--format`	Report format:`json`, `html`, `sarif`, `markdown`
`--severity`	Minimum severity to report (`low`-`critical`)
`--ignore-file`	Path to `.codexsentinel.ignore`

📁 Project Structure

codexsentinel/
├── analyzer/        # Core analyzers (AST, SSA, Taint, Rules)
├── deps/            # Dependency & license scanners
├── metrics/         # Complexity, duplication, dead code
├── arch/            # Architecture layer rules
├── report/          # Report generation (HTML, SARIF, etc.)
├── cmd/             # CLI entrypoints
├── internal/        # Internal utils (logging, config, fs)
├── testdata/        # Example test files with issues
└── assets/          # Rules, templates, CSS, etc.

📚 Example

// insecure_sql.go
query := "SELECT * FROM users WHERE id = " + id
db.Query(query) // ❌ Vulnerable to SQL Injection

codex scan ./testdata/insecure_sql.go --format markdown

📘 Custom Rules

Write custom YAML rules and place them under assets/rules/.

id: go.insecure.xss.reflected_input
pattern: "w.Write([]byte({{input}}))"
filters:
  - type: param
    sources: [r.FormValue]

Learn more in assets/rules/.

🧪 Testing

go test ./...

📄 License

💬 Contributing

We welcome PRs and new rule contributions. Please follow our contribution guide and ensure all changes are covered by tests.

✨ Example Report

---
version: "0.1.0"
timestamp: "2024-01-01T12:00:00Z"
issues:
  - id: "SEC001"
    name: "SQL Injection"
    description: "Potential SQL injection vulnerability detected"
    severity: "high"
    location:
      file: "main.go"
      line: 42
      column: 10
    category: "security"
    rule_id: "go.insecure.sql_injection"
---

Directories ¶

Path	Synopsis
analyzer
ast
engine
flow
result
rules
rules/builtin
rules/yaml
ssa
arch Package arch provides architectural structure analysis for Go projects.	Package arch provides architectural structure analysis for Go projects.
config Package config provides loading and management of CodexSentinel configuration.	Package config provides loading and management of CodexSentinel configuration.
deps Package deps provides analysis of dependencies and potential secrets.	Package deps provides analysis of dependencies and potential secrets.
internal
fsutil Package fsutil provides safe and configurable filesystem traversal.	Package fsutil provides safe and configurable filesystem traversal.
git Package git provides utilities to extract Git metadata for files and lines.	Package git provides utilities to extract Git metadata for files and lines.
ignore Package ignore provides functionality for parsing and applying ignore rules defined in .codexsentinel.ignore file.	Package ignore provides functionality for parsing and applying ignore rules defined in .codexsentinel.ignore file.
logx Package logx provides a structured logger for CodexSentinel.	Package logx provides a structured logger for CodexSentinel.
matcher Package matcher provides wildcard-based matching for rule IDs, paths, etc.	Package matcher provides wildcard-based matching for rule IDs, paths, etc.
version Package version provides build-time version information for CodexSentinel CLI.	Package version provides build-time version information for CodexSentinel CLI.
metrics Package metrics provides static code quality metrics such as cyclomatic complexity.	Package metrics provides static code quality metrics such as cyclomatic complexity.
report Package report provides functionality to generate various types of reports.	Package report provides functionality to generate various types of reports.
formats
scripts

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL