Impact Scan is an advanced, AI-powered security vulnerability scanner for codebases. It goes beyond traditional static analysis by leveraging Large Language Models (LLMs) to understand context, reduce false positives, and suggest intelligent fixes.
- AI-Powered Analysis: Uses models like GPT-4, Claude, or Gemini to validate findings and explain vulnerabilities.
- Groq-Powered Repository Analysis: Automatically analyzes your codebase and generates custom security rules tailored to your specific architecture.
- Agentic Architecture:
- StaticAnalysisAgent: Deep code scanning using Semgrep and Bandit.
- ComprehensiveSecurityCrawler: Web-enriched thread intelligence and exploit verification.
- ModernWebIntelligenceAgent: Real-time vulnerability research.
- Intelligent Fixes: Auto-generates code patches for discovered issues.
- Knowledge Graph: visualizations of your project's security posture.
- CI/CD Ready: Easy integration with GitHub Actions and other pipelines.
pip install impact-scan
# OR using poetry
poetry add impact-scanGenerate custom security rules for your codebase using Groq AI:
# Requires GROQ_API_KEY environment variable
impact-scan init-repo .
# This generates:
# - impact-scan.md (detailed analysis)
# - .impact-scan/custom-rules.yml (tailored security rules)See GROQ_REPO_ANALYSIS.md for detailed instructions.
Scan the current directory:
impact-scan scan .Enable AI features for better accuracy:
impact-scan scan . --ai openaiInteractively apply fixes:
impact-scan scan . --fixRun in automated environments:
impact-scan scan . --fix-auto --yes --min-severity highCreate a .impact-scan.yml file in your root directory:
profile: balanced
min_severity: medium
enable_web_search: true
ai_provider: openai
ignore_paths:
- tests/
- node_modules/See CONTRIBUTING.md for guidelines.
This project is licensed under the MIT License - see the LICENSE file for details.