ArmorOne SAST 🛡️

ArmorOne is an ultra-fast, multi-engine Static Application Security Testing (SAST), DevSecOps governance, and Agentic AI security platform built for the modern software development lifecycle.

⚡ Quick Installation

Option 1: Modern Isolated Python CLI (uv tool / pipx - Recommended)

# Using uv (fast & isolated):
uv tool install armorone

# Or using pipx:
pipx install armorone

Option 2: Standard pip

pip install armorone

Then provision the two Go engines the CLI shells out to:

armorone setup

🚀 Instant Usage

# Run multi-engine security scan across current repository (Semgrep, Gitleaks, Bandit, Trivy)
armorone scan .

# Sub-10s differential scan (scans only modified lines in git diff)
armorone scan . --diff

# Interactively review and apply auto-remediation patches
armorone fix <finding_fingerprint> --dry-run

# Launch interactive full-screen terminal triage dashboard
armorone triage

# Start FastMCP server for AI coding assistants (Antigravity, Cursor, Claude Code, Gemini)
armorone mcp run

🌟 Core Architecture & Key Features

• Multi-Engine Ingestion: Aggregates Semgrep, Gitleaks, Bandit, and Trivy into a unified, deduplicated ArmorOneFinding schema.
• ⚡ Dual-Mode Remediation:
  • Mode B (Deterministic Polyglot CST): <5ms, $0 token cost, 0% hallucination concrete syntax tree patch generator across Python, TypeScript/JavaScript, Go, Java, and C/C++.
  • Mode A (Code Graph Program Slicing + LLM): Backward taint slicing and context-isolated prompt synthesis for complex architectural refactors.
• 🤖 Native FastMCP Integration: Connects seamlessly to Google Antigravity, Cursor, Claude Code, Gemini CLI, and Windsurf via JSON-RPC stdio.
• 🔒 Sovereign Air-Gapped Mode (Model D): 100% offline rootless container distribution with zero telemetry and zero external network egress.

📚 Documentation & Guides

Every command shown in any of these is checked in CI against the shipped CLI — scripts/verify_docs_sync.py fails the build on a wrong flag, a broken repository path, or a command that no longer exists. Start with the FAQ if you're not sure where to start; it's the most general page and links out into everything below. If something isn't behaving the way a doc says it should, the Troubleshooting Guide is organized by symptom rather than by module — most failures look the same whether you hit them from the CLI, the IDE extension, or MCP. Otherwise, pick your role:

👨‍💻 Developer — writing code, running scans locally, using the IDE or an AI agent

• Developer Quickstart — install, first scan, CLI reference, IDE and MCP setup
• Contributor & Core Architecture Guide — scanner drivers, AST/CST rewriters, Code Graph Program Slicing
• Agentic SDLC & AI Code Observability — governing code an AI agent wrote, not just code a human wrote

🚀 DevOps / Platform Engineer — wiring ArmorOne into a pipeline or a fleet

• DevOps & CI/CD Pipeline Guide — GitHub, GitLab, Azure, Bitbucket integrations; --fail-on, --require-report
• Deployment Modes: Verification Matrix — what actually passed, per deployment mode, with the command that proves it
• Enterprise Infrastructure & Fleet Deployment — Kubernetes Helm, Rootless Podman, fleet rollout
• Air-Gapped Sovereign Deployment Manual — 100% offline, zero-egress mode

🔒 AppSec / Security Lead — triage, policy, and proving the tool works

• AppSec & Security Lead User Guide — triage workflows, policy inheritance, suppression, audit logging
• Accuracy Benchmark & Methodology — exactly what's been measured, on what corpus, with the reproduction command

📊 Evaluator / Decision Maker — deciding whether to adopt ArmorOne

• Executive Pitch Deck & Business Case
• Sales Battlecards & Objection Handling
• Accuracy Benchmark & Methodology — the evidence behind the pitch

Also: CHANGELOG.md records what changed release to release, including the two changes most likely to alter when your build goes red.

📜 License

Apache License 2.0. See LICENSE for details.