$ show psyray/oasis
OASIS is a CLI-first security analysis tool written in Python. It orchestrates a multi-phase LangGraph pipeline (Discover → Scan → Expand → Deep → Verify → Report) to detect vulnerabilities in source code using local LLMs via Ollama or OpenAI-compatible servers. The tool supports 25+ vulnerability types across multiple languages, produces deterministic verdicts without LLM reliance, and integrates with CI via severity-gated exit codes, suppression registries, and report diffing. It is installed via pipx or Docker and run as `oasis -i /path --models ...`.
The LLM identified 5 files worth highlighting for reuse:
A broad vulnerability pattern library covering 15+ frameworks with taint sources, sinks, mitigations, secrets, and crypto patterns. It is self-contained and could be extracted into a standalone pattern catalog for any security scanner or SAST tool.
Computes final vulnerability verdicts and confidence scores without LLM involvement, aggregating entry points, execution paths, taint flows, mitigations, and control checks. The logic is isolated and reusable for any rule-based security decision engine.
Extracts audit metrics from markdown tables and maps them to canonical keys (avg_score, median_score, tier counts). This is a clean, reusable parser for structured report data and could be adapted for other markdown-based metric extraction tasks.
Core Pydantic models for findings, reports, diffs, and validation results. These schemas define versioned contracts for the entire pipeline and are independently usable in any Python project needing structured security analysis data models.
Centralized environment-driven configuration using OASIS_* variables. It provides a single tunable entry point for the whole application and demonstrates a clean twelve-factor config pattern that can be lifted into other Python services.