Context Confidence Rating (CCR)

CCR generates lightweight repository context for LLM-assisted security review.

It scans a codebase for useful review signals such as frameworks, dependencies, entry points, configuration files, tests, and security controls. The output can be pasted into an LLM prompt or used by reviewers to understand what context is available before triaging scanner findings.

CCR is a context completeness score. It does not prove whether a vulnerability is exploitable, and it does not replace CVSS, SAST, or manual security review.

Built by Secuarden.

Quick Start

pip install context-confidence-rating

# Score the repository's available review context
ccr /path/to/repo

# Generate LLM-ready context
ccr context /path/to/repo

# Generate file-specific context
ccr context /path/to/repo --file src/api/auth.py

What CCR Gives You

• A 0-100 context completeness score
• Repository architecture signals
• Entrypoints and route-like files
• Dependency and lockfile information
• Security controls such as SECURITY.md, CODEOWNERS, and CI checks
• File-specific hints for user input, database operations, auth checks, and validation
• Markdown, JSON, and XML output for LLM workflows

Python API

from ccr import ContextAnalyzer, ContextGenerator

analyzer = ContextAnalyzer("/path/to/repo")
baseline = analyzer.calculate_repo_baseline_ccr()
print(f"Repository context score: {baseline.score}/100")

finding_context = analyzer.calculate_ccr({
    "file": "api/payments.py",
    "vulnerability": "SQL Injection",
    "severity": "HIGH",
})
print(finding_context.to_dict())

generator = ContextGenerator("/path/to/repo")
context = generator.generate_context(target_file="src/api/auth.py")
print(generator.to_markdown(context))

CLI Usage

# Human-readable score
ccr /path/to/repo

# Verbose reasoning
ccr /path/to/repo --verbose

# JSON score output
ccr /path/to/repo --json

# Include a scanner finding for context scoring
ccr /path/to/repo \
  --file "src/auth.py" \
  --vuln "Hardcoded Credentials" \
  --severity "CRITICAL"

LLM Context Generation

# Markdown, default
ccr context /path/to/repo

# JSON
ccr context /path/to/repo --format json

# XML
ccr context /path/to/repo --format xml

# Focus on one file
ccr context /path/to/repo --file src/api/auth.py

Example prompt:

Here is repository context generated by CCR:

<repo_context>
{paste CCR output}
</repo_context>

Here is a scanner finding:

<finding>
SQL Injection in api/users.py line 42
</finding>

Use the context to identify what should be manually checked before triage.

Score Meaning

Signals

Installation

From PyPI:

pip install context-confidence-rating

From source:

git clone https://github.com/secuardenai/context-confidence-rating.git
cd context-confidence-rating
pip install -e ".[dev]"
pytest

CI Example

name: CCR Context Check

on: [pull_request]

jobs:
  ccr:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install context-confidence-rating
      - run: ccr . --json > ccr-report.json
      - run: ccr context . --format markdown > repo-context.md

Development

pip install -e ".[dev]"
pytest
black ccr/ tests/ examples/
flake8 ccr/ tests/ examples/ --count --select=E9,F63,F7,F82 --show-source --statistics

Project Status

CCR is beta software. The current implementation is intentionally lightweight and heuristic-based. Contributions that improve precision, fixtures, language coverage, and documentation are welcome.

Security

Please report security issues privately. See SECURITY.md.

License

MIT License. See LICENSE.