OpenJarvis/examples/security_scanner/README.md

Security Scanner

Scan a local project directory for hardcoded secrets, vulnerability patterns, and dependency issues using an AI-powered ReAct agent.

Requirements

• OpenJarvis installed (git clone https://github.com/open-jarvis/OpenJarvis.git && cd OpenJarvis && uv sync or uv sync --extra dev)
• An inference engine running (Ollama, cloud API, vLLM, etc.)

Usage

python examples/security_scanner/security_scanner.py --help
python examples/security_scanner/security_scanner.py --path ./my_project
python examples/security_scanner/security_scanner.py --path /home/user/app \
    --model gpt-4o --engine cloud --max-turns 30

How It Works

The script creates a Jarvis instance configured with the native_react agent and four tools:

• shell_exec -- runs shell commands to explore the project tree and search for patterns (e.g., grep for API keys)
• file_read -- reads source files and configs to inspect for secrets
• code_interpreter -- analyzes dependency manifests for vulnerable packages
• think -- reasons about severity and prioritizes findings

The ReAct agent follows a Thought-Action-Observation loop, adaptively exploring the project until it can produce a structured security report with risk levels and prioritized recommendations.