conformis

Scan your codebase locally for EU AI Act compliance risk.

Your code never leaves your machine. conformis runs its AI/ML-usage detector entirely on your filesystem and only ever transmits the findings it produces (a file path, a line number, a library name, a one-line snippet, and a short description) — never full source files, never your .env, never git history or metadata.

Install

pip install conformis

Or from a local checkout:

pip install ./cli

Quickstart

# Set your Conformis user id once
export CONFORMIS_USER_ID=user_xxxxxxxx

# Scan the current directory
conformis scan

# Scan a specific path
conformis scan ./my-project

# See exactly what would be sent, without sending anything
conformis scan --dry-run

# Strip all code snippets before anything is transmitted
conformis scan --privacy-mode

Instead of an env var, you can persist your user id in ~/.conformis/config:

{ "user_id": "user_xxxxxxxx" }

The CONFORMIS_USER_ID environment variable always takes precedence over this file. If neither is set, the CLI exits with a clear error before scanning anything.

What is (and isn't) transmitted

The scanner walks your codebase locally (Python, JS/TS, package.json) and produces a list of findings. Before anything is sent over the network, the CLI filters every finding down to exactly these fields:

Nothing else ever leaves the machine: no absolute paths, no environment variables, no .git metadata, no file contents beyond the one matched line per finding. This is enforced in code (conformis/payload.py), not just documented — every finding is passed through a field allowlist and a path-sanitizer before it is serialized, and --privacy-mode empties every snippet client-side before the payload is even built.

Sample payload

This is the exact JSON body POSTed to /api/scans/local for a project with a single OpenAI call in chatbot.py (also viewable yourself, with nothing sent, via conformis scan --dry-run):

{
  "project_name": "my-project",
  "files_scanned": 1,
  "files_with_ai": 1,
  "findings": [
    {
      "file": "chatbot.py",
      "line": 4,
      "library": "openai",
      "description": "Imports OpenAI API",
      "context": "",
      "snippet": "import openai"
    },
    {
      "file": "chatbot.py",
      "line": 9,
      "library": "openai",
      "description": "Possible model inference call: .create()",
      "context": "function ask",
      "snippet": "response = client.chat.completions.create(model=\"gpt-4\", messages=messages)"
    }
  ],
  "privacy_mode": false
}

With --privacy-mode, every snippet field above becomes "".

Findings are capped at 500 and each snippet at 2000 characters client-side (matching the backend's own limits), so a very large repo truncates predictably with a clear message instead of failing on the server.

Command reference

conformis scan [PATH]

Scans PATH (default: current directory) and submits findings to Conformis.

Progress/status messages (the scanning spinner, submission confirmation, polling status) are written to stderr, so stdout stays clean JSON when --json or --dry-run is used — safe to pipe or redirect in CI.

conformis --version

Prints the installed CLI version.

CI usage

- name: Conformis compliance scan
  env:
    CONFORMIS_USER_ID: ${{ secrets.CONFORMIS_USER_ID }}
  run: |
    pip install conformis
    conformis scan --json --fail-under 70

Exit codes

How it works

1. Scan — conformis walks the target directory locally using the same AST-based detector as the Conformis backend (vendored, not imported, so the CLI installs standalone with no dependency on the backend package).
2. Sanitize — findings are filtered to the allowlisted fields above, paths are forced relative to the scan root, and size limits are enforced.
3. Submit — the findings-only payload is POSTed to POST /api/scans/local, which starts the same classification pipeline used for full ZIP uploads, just without ever receiving your source code.
4. Poll — the CLI polls GET /api/scans/{id}/readiness every 3 seconds (3 minute timeout) until the classification finishes.
5. Report — a compliance score, risk tier summary, and the top 3 recommended actions are printed, along with a link to the full dashboard at https://conformis.tech/readiness/{scan_id}.