Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/nox-hq/nox

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
https://github.com/nox-hq/nox

ai-security cli cosign devsecops golang llm-security mcp plugin-marketplace sarif sbom scanner security sigstore static-analysis supply-chain-security

Last synced: about 1 month ago
JSON representation

Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.

Awesome Lists containing this project

README 

          


  Nox




Nox





  CI

  Security

  Coverage

  Go

  License




**The security scanner for AI application developers.** Open source, offline-first, no SaaS.



If you're shipping LLM features — `chat.completions.create`, RAG ingest into a vector DB, agents with tool calls, MCP servers — nox is the static analyzer that knows how those break. Plus the boring stuff: secrets, dep CVEs, IaC, container scans.



**What nox catches that other scanners don't:**



- **Prompt injection** at the call site (AI-PI-*, OWASP LLM01)

- **Embedding leakage** when secrets / PII land in vector stores (AI-EMBED-*, LLM06)

- **Agent over-privilege** when `file_read` + `http_request` live in the same agent context (AI-AGENT-*, LLM07)

- **Full MCP threat coverage** mapped to the OWASP MCP Top 10 — server hardening (MCP-001..008), tool poisoning (MCP-009..014, MCP03), rug-pull / definition drift (MCP-015, MCP04), authn/authz & SSRF (MCP-016..021, MCP07), shadow & cross-server tool shadowing (MCP-022..024, MCP09)

- **Cross-file AI taint** — `request.json` → service hop → `chat.completions.create` across functions and files (TAINT-AI-*)

- **Polyglot AIBOM** — Python ingest + Go service + TS frontend produce one inventory naming every model invocation, auth env var, and endpoint

- **Verified plugin marketplace** — extension scanners (reachability, cross-file taint, k8s-runtime, red-team chains, GRC for 12 frameworks) install with one command, signed end-to-end via Sigstore



Built so you can keep your source local, your CI green, and your CISO answered without paying a per-seat SaaS bill or sending code to a vendor.



> **The MCP scanner that never sees your code.** No API. No token. No telemetry. Deterministic. Run `nox scan --offline` and the scan path makes zero outbound connections — enforced by a test, not a promise (`TestOSVDisabled_NoNetworkEgress`). Unlike scanners that proxy your traffic or phone home to a vendor API, nox runs entirely on your machine.



- **Deterministic** -- same inputs produce same outputs, no hidden state

- **Offline-first** -- zero required external services

- **Safe by default** -- never uploads source code, never executes untrusted code, never auto-applies fixes

- **Agent-native** -- safely callable via the Model Context Protocol (MCP)

- **Cosign-signed plugin marketplace** -- every official plugin verifies via Sigstore keyless OIDC; default trust policy refuses unsigned third-party drops



## Quick Demo



Install and scan a project in under a minute:



```bash

# Install

brew tap felixgeelhaar/tap && brew install nox

# or: go install github.com/nox-hq/nox/cli@latest



# Scan the current directory

nox scan .



# Output:

# nox dev -- scanning .

# [results] 12 findings, 47 dependencies, 3 AI components

# [done]

```



Nox writes `findings.json` to the current directory. To generate all output formats at once:



```bash

nox scan . --format all --output reports/

```



This produces:



```

reports/

  findings.json        # Nox canonical findings

  results.sarif        # SARIF 2.1.0 (GitHub Code Scanning)

  sbom.cdx.json        # CycloneDX SBOM with vulnerability enrichment

  sbom.spdx.json       # SPDX SBOM with security references

  report.html          # Standalone HTML report

  ai.inventory.json    # AI component inventory (if detected)

```



### Use in CI (GitHub Action)



```yaml

# .github/workflows/security.yml

- uses: nox-hq/nox@24c7f00916ad15e99b6c44cdda8e55f05b869e43 # v0.4.2

  with:

    path: '.'

    format: sarif

    annotate: 'true'    # Post inline PR comments (default: true)

- uses: github/codeql-action/upload-sarif@33119e582d3ab4ed79c2610af108cb08ff983917 # v3

  if: always()

  with:

    sarif_file: nox-results/results.sarif

```



### Use with AI Agents (MCP)



```bash

nox serve --allowed-paths /path/to/project

```



This starts an MCP server on stdio with 10 read-only tools and 5 resources. See [MCP Server](#mcp-server) for details.



## Installation



### Homebrew (macOS/Linux)



```bash

brew tap felixgeelhaar/tap

brew install nox

```



### Go



```bash

go install github.com/nox-hq/nox/cli@latest

```



### Build from Source



```bash

git clone https://github.com/nox-hq/nox.git

cd nox

make build

./nox scan .

```



## What Nox Detects



Nox ships with **1506 built-in rules** across five analyzer suites:



### Secrets (938 rules)



Detects hardcoded secrets, API keys, tokens, and credentials across **25+ categories** (938 rules total, competitive with TruffleHog):



| Category | Rules | Examples |

|----------|-------|---------|

| Cloud Providers | SEC-001 -- SEC-015 | AWS, GCP, Azure, DigitalOcean, Heroku, Alibaba, IBM, Databricks |

| Source Control | SEC-003, SEC-016 -- SEC-022 | GitHub PAT/fine-grained/app tokens, GitLab, Bitbucket |

| Communication | SEC-023 -- SEC-029 | Slack, Discord, Telegram, Microsoft Teams |

| Payment | SEC-030 -- SEC-038 | Stripe, Square, Shopify, PayPal/Braintree |

| AI/ML Providers | SEC-039 -- SEC-044 | OpenAI, Anthropic, HuggingFace, Replicate, Cohere |

| DevOps & CI/CD | SEC-045 -- SEC-056 | NPM, PyPI, Docker Hub, Terraform, Vault, Grafana |

| SaaS & APIs | SEC-057 -- SEC-072 | Twilio, SendGrid, Datadog, PagerDuty, Linear, Okta |

| Database & Infra | SEC-073 -- SEC-076 | Connection strings (Postgres, MongoDB, Redis), Firebase |

| Crypto & Keys | SEC-004, SEC-077 -- SEC-079 | PEM private keys, Age, PGP, PKCS12 |

| Generic Patterns | SEC-005, SEC-080 -- SEC-086 | Passwords, secrets, Bearer/Basic auth, JWT, URLs with credentials |



**Secret detection features:**

- **Shannon entropy analysis** for high-entropy strings (API keys, tokens) with configurable thresholds

- **Context-aware detection** -- lowers entropy threshold when secret-suggestive keywords (`password`, `secret`, `token`, `key`, etc.) appear on the same line

- **False-positive hardening** -- automatically filters git SHAs, version strings, file paths, camelCase identifiers, hex checksums, and other non-secret patterns

- **File-pattern scoping** -- entropy rules only scan source-like files (not lockfiles, checksums, or vendored code)

- **Configurable via `.nox.yaml`** -- override entropy thresholds per rule (see [Entropy Configuration](#entropy-configuration))

- Git history scanning to find secrets in past commits

- Custom rules via YAML definition files (`--rules path/to/rules/`)



### AI Security (50 rules)



Detects AI/ML application security risks aligned with the **OWASP LLM Top 10**:



| Category | Rules | OWASP LLM | Examples |

|----------|-------|-----------|---------|

| Prompt Injection | AI-001 -- AI-003, AI-010 | LLM01 | Boundary violations, RAG injection, indirect injection |

| Tool/Agent Safety | AI-004, AI-005, AI-011 | LLM06 | MCP write tools, wildcard allowlists, unrestricted agents |

| Insecure Logging | AI-006, AI-007 | LLM02 | Prompt/response logging, API key exposure |

| Output Handling | AI-009, AI-012, AI-015, AI-018 | LLM05 | eval()/exec(), SQL injection, XSS, path traversal |

| Information Disclosure | AI-013, AI-016 | LLM02, LLM07 | Stack traces in responses, system prompt leakage |

| Supply Chain | AI-008, AI-014 | LLM03 | Unpinned models, insecure HTTP model downloads |

| Resource Management | AI-017 | LLM10 | Unlimited token limits |



### Infrastructure as Code (500 rules)



Detects misconfigurations across **7 IaC categories**:



| Category | Rules | Examples |

|----------|-------|---------|

| Dockerfile | IAC-001 -- IAC-003, IAC-022 -- IAC-025 | Root user, unpinned images, secrets in ARG, curl-pipe-sh |

| Terraform/Cloud | IAC-004 -- IAC-006, IAC-036 -- IAC-045 | Public access, disabled encryption, wildcard IAM, public S3 |

| Kubernetes | IAC-007 -- IAC-010, IAC-026 -- IAC-035 | Privileged pods, host namespaces, dangerous capabilities, cluster-admin |

| GitHub Actions | IAC-011 -- IAC-018 | pull_request_target, script injection, mutable action tags, write-all |

| Docker Compose | IAC-019 -- IAC-021, IAC-049 | Privileged mode, host networking, Docker socket mount |

| Helm | IAC-046 -- IAC-048 | Tiller deployment, hardcoded passwords, RBAC disabled |

| CI/CD General | IAC-050 | Disabled security checks |



### Dependencies & SCA (6 rules)



Parses lockfiles from **8 ecosystems** (Go, npm, PyPI, RubyGems, Cargo, Maven, Gradle, NuGet) and queries the [OSV.dev](https://osv.dev) database for known vulnerabilities:



| Rule | Description |

|------|-------------|

| VULN-001 | Known vulnerability in dependency (severity mapped from CVSS) |



- Batches queries to the OSV.dev API (up to 1000 packages per request)

- CVSS scores mapped to nox severity levels (Critical/High/Medium/Low/Info)

- Graceful degradation on network errors (offline-first)

- Disable with `--no-osv` flag or `scan.osv.disabled: true` in `.nox.yaml`

- Vulnerability data enriches CycloneDX and SPDX SBOM output



### Data Protection (12 rules)



Detects personally identifiable information (PII) and sensitive data patterns in code and configuration:



| Category | Rules | Examples |

|----------|-------|---------|

| Contact Info | DATA-001, DATA-004 | Email addresses, US phone numbers |

| Financial | DATA-003, DATA-007 | Credit card numbers (Visa/MC/Amex/Discover), IBAN |

| Government IDs | DATA-002, DATA-008 -- DATA-012 | SSN, UK National Insurance, Tax IDs, driver's license, passport |

| Health | DATA-010 | Health record identifiers (MRN, patient_id) |

| Infrastructure | DATA-005 | Hardcoded public IP addresses |

| Personal | DATA-006 | Date of birth fields |



## Configuration



Create a `.nox.yaml` in your project root to customize scan behavior:



```yaml

scan:

  exclude:

    - "vendor/"

    - "testdata/"

    - "*.test.js"

  osv:

    disabled: false          # Set true to skip OSV lookups (offline mode)

  rules:

    disable:

      - "AI-008"           # Unpinned model refs OK here

    severity_override:

      SEC-005: low          # Downgrade for this project



output:

  format: sarif             # Default output format

  directory: reports        # Default output directory



policy:

  fail_on: high             # Only fail on high+ severity (critical, high)

  warn_on: medium           # Warn on medium findings

  baseline_mode: warn       # warn | strict | off

  baseline_path: ""         # Default: .nox/baseline.json



explain:

  api_key_env: OPENAI_API_KEY   # Env var to read API key from

  model: gpt-4o                 # LLM model name

  base_url: ""                  # Custom OpenAI-compatible endpoint

  timeout: 2m                   # Per-request timeout

  batch_size: 10                # Findings per LLM request

  output: explanations.json     # Output file path

```



CLI flags always take precedence over config file values.



### Entropy Configuration



Fine-tune entropy-based secret detection thresholds via `.nox.yaml`:



```yaml

scan:

  entropy:

    threshold: 5.0           # General entropy threshold (default: 5.0)

    hex_threshold: 4.5       # Threshold for hex strings (default: rule-specific)

    base64_threshold: 5.2    # Threshold for base64 strings (default: rule-specific)

    require_context: true    # Only flag when secret keyword is present (default: false)

```



- **`threshold`** -- Minimum Shannon entropy (bits per character) to flag a candidate string. Higher values reduce false positives; lower values catch more secrets.

- **`require_context`** -- When `true`, only flag high-entropy strings on lines that contain secret-suggestive keywords (`password`, `secret`, `key`, `token`, `credential`, `api_key`, `private`). Useful for reducing noise in codebases with many random-looking constants.

- **Context boost** -- When a secret keyword is present on the same line, the effective threshold is automatically reduced by 0.5 bits, increasing sensitivity where it matters.



### Baseline Management



Manage known findings to track progress and suppress accepted risks:



```bash

# Create a baseline from all current findings

nox baseline write .



# Write to a specific file

nox baseline write . --output my-baseline.json



# Update baseline (add new, prune stale)

nox baseline update .

nox baseline update . --baseline my-baseline.json



# Show baseline statistics

nox baseline show .

```



### Inline Suppressions



Suppress specific findings directly in source code:



```go

// nox:ignore SEC-001 -- false positive in test

var testKey = "AKIAEXAMPLEFAKEKEY"



var apiKey = "test" // nox:ignore SEC-005

```



Supports all comment styles: `//`, `#`, `--`, `/*`, `