{"id":44414208,"url":"https://github.com/paritoshk/ai-vulnerablity-scanner","last_synced_at":"2026-02-12T08:12:53.720Z","repository":{"id":327623183,"uuid":"1107911276","full_name":"paritoshk/ai-vulnerablity-scanner","owner":"paritoshk","description":"Agent that automatically fixes top vulnerabilities for your agentic and AI products ","archived":false,"fork":false,"pushed_at":"2025-12-18T20:40:49.000Z","size":632,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-21T21:56:42.655Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://ai-shield-drab.vercel.app","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paritoshk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-01T19:15:27.000Z","updated_at":"2025-12-18T20:25:33.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/paritoshk/ai-vulnerablity-scanner","commit_stats":null,"previous_names":["paritoshk/ai-vulnerablity-scanner"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/paritoshk/ai-vulnerablity-scanner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paritoshk%2Fai-vulnerablity-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paritoshk%2Fai-vulnerablity-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paritoshk%2Fai-vulnerablity-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paritoshk%2Fai-vulnerablity-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paritoshk","download_url":"https://codeload.github.com/paritoshk/ai-vulnerablity-scanner/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paritoshk%2Fai-vulnerablity-scanner/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29361812,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-12T01:03:07.613Z","status":"online","status_checked_at":"2026-02-12T02:00:06.911Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-02-12T08:12:52.981Z","updated_at":"2026-02-12T08:12:53.713Z","avatar_url":"https://github.com/paritoshk.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🛡️ AI Vulnerability Fixer\n\nReal-time AI/LLM vulnerability scanner and risk assessment tool using **Gemini Pro 3** and **Parallel Web Systems**.\n\nAgent that automatically discovers and fixes top vulnerabilities for your agentic and AI products.\n\n## Features\n\n- 🔍 **Real-time vulnerability search** using Parallel Web Systems API\n- 🤖 **AI-powered analysis** with Gemini Pro 3 (structured output via LiteLLM) (System using 2.5 Pro for costs but you can upgrade to 3) \n- 📊 **AI-RQ risk scoring** (0-1000 scale with investment-grade ratings)\n- 🏷️ **OWASP LLM Top 10 (2025)** classification\n- 🎯 **MITRE ATLAS** technique mapping\n- 🩹 **Automated patch generation** with code examples\n- 📝 **Markdown \u0026 JSON reports**\n\n## Architecture\n\nThis project uses a **client-server architecture** with three components:\n\n```\n┌─────────────────┐      HTTP/SSE      ┌─────────────────┐\n│   Next.js Web   │ ◄──────────────► │  FastAPI Server │\n│   (Frontend)    │                     │   (Backend)     │\n└─────────────────┘                     └─────────────────┘\n                                              │\n                                              ▼\n                                        ┌──────────────┐\n                                        │  Scanner     │\n                                        │  Modules     │\n                                        │  (src/)      │\n                                        └──────────────┘\n```\n\n**Project Structure:**\n```\nai-vulnerablity-scanner/\n├── api-server/             # FastAPI backend\n│   ├── main.py            # FastAPI app\n│   ├── routers/           # API endpoints\n│   │   └── scan.py        # Scan endpoint with SSE\n│   └── models.py          # Pydantic models\n├── src/                   # Scanner modules\n│   ├── search.py          # Parallel Web Systems integration\n│   ├── analysis.py        # Gemini Pro 3 analysis\n│   ├── scoring.py         # AI-RQ risk scoring\n│   ├── report.py          # Report generation\n│   └── schemas.py         # Pydantic schemas\n├── web-app/               # Next.js frontend\n│   └── app/\n│       ├── page.tsx       # Landing page\n│       ├── dashboard/     # Scan dashboard\n│       └── api/scan/      # Next.js API proxy\n├── tests/                 # Test suite\n│   ├── test_scoring.py\n│   ├── test_analysis.py\n│   └── test_integration.py\n├── config/\n│   └── frameworks.py      # OWASP/MITRE constants\n├── outputs/               # Generated reports\n├── main.py                # CLI entry point\n└── pyproject.toml         # Dependencies (uv)\n```\n\n## Setup\n\n### Prerequisites\n\n- Python 3.10+\n- Node.js 18+\n- `uv` package manager (recommended) or `pip`\n\n### 1. Install Python Dependencies\n\nUsing `uv` (recommended):\n```bash\nuv sync\n```\n\nOr using pip:\n```bash\npip install -r requirements.txt\n```\n\n### 2. Configure API Keys\n\nCopy `.env.example` to `.env` and add your API keys:\n\n```bash\ncp .env.example .env\n```\n\nEdit `.env`:\n```\nGEMINI_API_KEY=your_gemini_api_key\nPARALLEL_API_KEY=your_parallel_api_key\n```\n\n### 3. Run the Application\n\n#### Option A: Web UI (Recommended)\n\n**Terminal 1 - Start FastAPI Server:**\n```bash\ncd api-server\nuv run uvicorn main:app --reload --port 8000\n```\n\n**Terminal 2 - Start Next.js Frontend:**\n```bash\ncd web-app\nnpm install\nnpm run dev\n```\n\nVisit http://localhost:3000\n\n#### Option B: Command Line\n\n```bash\npython main.py\n```\n\n\n## How It Works\n\n### 1. **Vulnerability Search** (`src/search.py`)\n- Queries Parallel Web Systems API for recent AI/LLM vulnerabilities\n- Searches across CVE databases, security advisories, and research papers\n- Focuses on: prompt injection, jailbreaking, supply chain, RAG poisoning, etc.\n\n### 2. **AI Analysis** (`src/analysis.py`)\n- Uses **Gemini Pro 3** (`gemini-3-pro-preview`) for analysis\n- Employs **LiteLLM's `response_format` parameter** for guaranteed JSON structure\n- Classifies with OWASP LLM Top 10 (2025)\n- Maps to MITRE ATLAS techniques\n- Generates actionable patches with code examples\n\n### 3. **Risk Scoring** (`src/scoring.py`)\nCalculates **AI-RQ** (AI Risk Quotient) based on:\n- Severity (40%)\n- Exploitability (40%)\n- OWASP category weight (30%)\n- Vulnerability count (5pts each)\n\n**Rating Scale:**\n- **AAA-A** (700-1000): Investment Grade\n- **BBB-CCC** (300-699): Moderate Risk\n- **CC-D** (0-299): High Risk\n\n### 4. **Report Generation** (`src/report.py`)\nGenerates:\n- **JSON**: Machine-readable analysis\n- **Markdown**: Human-readable report with emojis\n\n## Output Example\n\n```\n============================================================\n🛡️  AI VULNERABILITY FIXER\n    Using Gemini Pro 3 + Parallel Web Systems\n============================================================\n\n[1/4] Searching for AI/LLM vulnerabilities...\n🔍 Searching vulnerabilities (last 24h)...\n✅ Found 12 results\n\n[2/4] Analyzing with Gemini Pro 3 (structured output)...\n🤖 Analyzing with Gemini Pro 3...\n✅ Analysis complete - found 5 vulnerabilities\n\n[3/4] Calculating AI-RQ risk score...\n\n📊 AI-RQ: 542/1000 (BB)\n   Vulnerabilities: 5\n   Patches: 5\n   Investment Grade: ✅ Yes\n\n[4/4] Generating reports...\n📄 Saved: outputs/vuln_analysis.json, outputs/vuln_report.md\n```\n\n## Key Technologies\n\n- **Gemini Pro 3** (`gemini-3-pro-preview`): Latest Google AI model with enhanced reasoning\n- **LiteLLM**: Unified API for LLM providers with structured output support\n- **Parallel Web Systems**: Real-time web search API with AI-optimized extraction\n- **Pydantic**: Data validation and schema enforcement\n\n## API Keys\n\nGet your API keys from:\n- **Gemini**: https://aistudio.google.com/apikey\n- **Parallel Web Systems**: https://parallel.ai/\n\n## Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\nuv run pytest tests/ -v\n\n# Integration tests (requires FastAPI server running)\nuv run python tests/test_integration.py\n```\n\nCurrent test coverage:\n- ✅ 18 unit tests passing\n- ✅ Risk scoring validation\n- ✅ Pydantic schema validation\n- ✅ Integration test with real scan\n\n## API Documentation\n\nFor detailed API documentation, deployment guides, and troubleshooting, see:\n\n**[📖 README_API.md](README_API.md)**\n\nTopics covered:\n- FastAPI endpoints and SSE format\n- Rate limiting and CORS\n- Deployment to production\n- Testing examples\n- Troubleshooting guide\n\n## Framework References\n\n- **OWASP LLM Top 10 (2025)**: https://owasp.org/www-project-top-10-for-large-language-model-applications/\n- **MITRE ATLAS**: https://atlas.mitre.org/\n\n## License\n\nMIT \n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fparitoshk%2Fai-vulnerablity-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fparitoshk%2Fai-vulnerablity-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fparitoshk%2Fai-vulnerablity-scanner/lists"}