{"id":49138166,"url":"https://github.com/prodcycle/cli","last_synced_at":"2026-05-13T11:01:15.097Z","repository":{"id":350059850,"uuid":"1205138519","full_name":"prodcycle/cli","owner":"prodcycle","description":"Multi-framework policy-as-code compliance scanner for infrastructure and application code. Evaluates Terraform, Kubernetes, Docker, and source code against SOC 2, HIPAA, and NIST CSF.","archived":false,"fork":false,"pushed_at":"2026-05-08T03:19:18.000Z","size":24461,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-08T05:56:00.223Z","etag":null,"topics":["cli","compliance","hipaa","nist","policy-as-code","python","security","soc2","typescript"],"latest_commit_sha":null,"homepage":"https://docs.prodcycle.com","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/prodcycle.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-04-08T17:11:04.000Z","updated_at":"2026-05-08T03:16:39.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/prodcycle/cli","commit_stats":null,"previous_names":["prodcycle/compliance-code-scanner-cli","prodcycle/prodcycle-cli","prodcycle/cli"],"tags_count":17,"template":false,"template_full_name":null,"purl":"pkg:github/prodcycle/cli","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prodcycle%2Fcli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prodcycle%2Fcli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prodcycle%2Fcli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prodcycle%2Fcli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/prodcycle","download_url":"https://codeload.github.com/prodcycle/cli/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prodcycle%2Fcli/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32979305,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-13T06:31:55.726Z","status":"ssl_error","status_checked_at":"2026-05-13T06:31:51.336Z","response_time":115,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","compliance","hipaa","nist","policy-as-code","python","security","soc2","typescript"],"created_at":"2026-04-21T23:03:50.944Z","updated_at":"2026-05-13T11:01:15.073Z","avatar_url":"https://github.com/prodcycle.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# @prodcycle/prodcycle\n\nMulti-framework policy-as-code compliance scanner for infrastructure and application code. Scans Terraform, Kubernetes, Docker, `.env`, and application source (TypeScript, Python, Go, Java, Ruby) against SOC 2, HIPAA, and NIST CSF policies.\n\nThis repository hosts both the npm (Node.js) package and the PyPI (Python) package wrappers around the ProdCycle compliance REST API (`https://api.prodcycle.com/v1/compliance/validate` \u0026 `https://api.prodcycle.com/v1/compliance/hook`).\n\n## Features\n\n- **3 compliance frameworks**: SOC 2, HIPAA, NIST CSF\n- **Automated policy enforcement**: Server-side OPA/Rego and Cedar evaluation engines\n- **Infrastructure scanning**: Terraform, Kubernetes manifests, Dockerfiles, `.env` files\n- **Application code scanning**: TypeScript, Python, Go, Java, Ruby\n- **CI/CD integration**: CLI with SARIF output for GitHub Code Scanning\n- **Coding-agent hooks**: Real-time post-edit scanning for Claude Code, Cursor, and any stdin-capable agent\n- **One-command agent setup**: `prodcycle init` writes compliance hook config for supported agents\n- **Programmatic API**: Full TypeScript and Python API for custom integrations\n- **Self-remediation**: `gate` returns actionable remediation prompts that coding agents can consume directly\n\n## Installation\n\n### Node.js (npm)\n```bash\nnpm install -g @prodcycle/prodcycle\n```\n\n### GitHub Packages (npm alternative)\nIf you prefer to install from GitHub Packages, configure your npm to point to the ProdCycle scope:\n\n```bash\necho \"@prodcycle:registry=https://npm.pkg.github.com\" \u003e .npmrc\nnpm login --scope=@prodcycle --registry=https://npm.pkg.github.com\nnpm install @prodcycle/prodcycle\n```\n\n### Python (PyPI)\n```bash\npip install prodcycle\n```\n\n## Quick Start\n\n### CLI\n\nThe CLI is organised as subcommands: `scan`, `gate`, `hook`, and `init`.\n(The bare `prodcycle \u003cpath\u003e` form is kept as a back-compat shim for `prodcycle scan \u003cpath\u003e`.)\n\n```bash\n# Scan current directory against all 3 frameworks (default: soc2, hipaa, nist-csf).\n# When run inside a CI environment (GitHub Actions, GitLab CI, CircleCI, Jenkins,\n# Buildkite, Travis, Bitbucket Pipelines), the format auto-flips to SARIF so\n# output drops straight into code-scanning dashboards.\nprodcycle scan .\n\n# Pin a specific framework or subset\nprodcycle scan . --framework soc2,hipaa\nprodcycle scan . --framework hipaa --severity-threshold high\n\n# Explicit SARIF output\nprodcycle scan . --format sarif --output results.sarif\n\n# CI: scan only files changed in the PR (faster + diff-scoped findings)\nprodcycle scan . --pr origin/main..HEAD\n\n# LLM-ready remediation prompt\nprodcycle scan . --format prompt\n```\n\n### Agent hooks + CI scaffolding\n\nAuto-configure compliance hooks for the coding agents it detects in your repo. Hook agents (JSON config): Claude Code, Cursor. Instruction agents (sentinel-delimited markdown block in `AGENTS.md` or equivalent): Codex, OpenCode, GitHub Copilot, Gemini CLI.\n\n```bash\nprodcycle init\n# or pin specific agents:\nprodcycle init --agent claude,cursor --force --dir .\n# or scaffold all supported:\nprodcycle init --agent all\n```\n\nSame command also scaffolds CI workflows when invoked with `--ci`:\n\n```bash\n# Writes .github/workflows/compliance.yml that delegates to\n# the prodcycle/actions/compliance reusable action.\nprodcycle init --ci github\n\n# Or: GitLab .gitlab-ci.yml include / CircleCI .circleci/config.yml\nprodcycle init --ci gitlab\nprodcycle init --ci circleci\n```\n\nOnce configured, the agent will pipe each edit through `prodcycle hook`, which returns a remediation prompt when a finding is produced and exits non-zero to block the edit. You can also invoke the hook directly:\n\n```bash\n# From an agent — stdin is Claude Code PostToolUse payload or {file_path, content}\necho '{\"file_path\": \"infra/main.tf\", \"content\": \"resource \\\"aws_s3_bucket\\\" ...\"}' \\\n  | prodcycle hook\n\n# Scan a file on disk instead of reading content from stdin\nprodcycle hook --file infra/main.tf --framework soc2,hipaa\n```\n\n### `gate` (CI / pre-commit)\n\n`gate` accepts a JSON payload of files on stdin and calls the low-latency hook endpoint:\n\n```bash\necho '{\"files\": {\"main.tf\": \"resource \\\"aws_s3_bucket\\\" ...\"}}' \\\n  | prodcycle gate --framework soc2\n```\n\n### Programmatic API (TypeScript)\n\n```typescript\nimport { scan, gate } from '@prodcycle/prodcycle';\n\n// Full Repository Scan\nconst { findings, exitCode } = await scan({\n  repoPath: '/path/to/repo',\n  frameworks: ['soc2', 'hipaa'],\n  options: {\n    severityThreshold: 'high',\n    failOn: ['critical', 'high'],\n  },\n});\n\nconsole.log(`Found ${findings.length} findings`);\nconsole.log(`Exit code: ${exitCode}`);\n\n// Gate — evaluate in-memory file contents (for coding agents)\nconst result = await gate({\n  files: {\n    'src/config.ts': 'export const DB_PASSWORD = \"hardcoded-secret\";',\n    'terraform/main.tf': 'resource \"aws_s3_bucket\" \"data\" { }',\n  },\n  frameworks: ['soc2', 'hipaa'],\n});\n\nif (!result.passed) {\n  console.log('Compliance issues found:');\n  console.log(result.prompt); // Pre-formatted remediation instructions\n}\n```\n\n### Programmatic API (Python)\n\n```python\nfrom prodcycle import scan, gate\n\n# Full Repository Scan\nresponse = scan(\n    repo_path='/path/to/repo',\n    frameworks=['soc2', 'hipaa'],\n    options={\n        'severityThreshold': 'high',\n        'failOn': ['critical', 'high'],\n    }\n)\n\nprint(f\"Found {len(response['findings'])} findings\")\nprint(f\"Exit code: {response['exitCode']}\")\n\n# Gate — evaluate in-memory file contents (for coding agents)\nresult = gate(\n    files={\n        'src/config.ts': 'export const DB_PASSWORD = \"hardcoded-secret\";',\n        'terraform/main.tf': 'resource \"aws_s3_bucket\" \"data\" { }',\n    },\n    frameworks=['soc2', 'hipaa'],\n)\n\nif not result['passed']:\n    print('Compliance issues found:')\n    print(result['prompt']) # Pre-formatted remediation instructions\n```\n\n## API Key\n\nAn API key is required for production use to authenticate with ProdCycle. Set it via environment variable:\n\n```bash\nexport PC_API_KEY=pc_your_api_key_here\n```\n\nAPI keys are created through the ProdCycle dashboard.\n\n## File collection\n\nThe scanner honours `.gitignore` at the repo root and prunes common dependency / build directories (`node_modules`, `.git`, `dist`, `build`, `venv`, `__pycache__`, …) during tree-walk. It also applies:\n\n- **256 KB per-file limit** — larger files are skipped.\n- **10,000 file cap** — files beyond the cap are skipped with a stderr warning.\n- **Binary skipping** — non-text files are skipped via a null-byte probe.\n\nUse `--include` / `--exclude` on `prodcycle scan` for custom glob patterns.\n\n## Requirements\n\n- Node.js \u003e= 24.0.0\n- Python \u003e= 3.12\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprodcycle%2Fcli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprodcycle%2Fcli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprodcycle%2Fcli/lists"}