CVEPaladin 0.2.0a1

Paladin stops AI coding agents from reintroducing known CVE patterns. It tells the agent what the problem is and how to avoid it; the agent writes its own fix.

• Prevention cards for 524 Python web CVEs, searchable by the agent over MCP (e5 + BM25 hybrid). 501 are checked against the fix diff; 23 remain candidate.
• Edit-time hook for Claude Code and Codex, with no model or network call: 125 rules drafted from the cards block the turn when their CVE is MEDIUM, HIGH or CRITICAL (104 rules), advise for LOW (7; hook install --block-low makes those block too), and advise for 14 broad rules that showed no real risk in sampled real code; two exact CVE rules also block. Each block names the CVE, line and fix.
• Dependency check (paladin deps check, MCP check_dependencies, and the hook when an agent edits a dependency file): pinned versions against the PyPI affected ranges of 520 collected CVEs, most of which are library-internal and have no code rule.
• Proof loop: reproduces a CVE and verifies a repair inside an isolated Docker observer before a case is recorded.

Tested

How it works

Quick start

Windows, Python 3.12, uv and Docker Desktop.

1. Install and build the search database (once per machine)

uv tool install CVEPaladin
paladin setup --json           # starts a local Milvus in Docker
paladin model prepare --json   # downloads the search model (487 MB)
paladin patterns index --json  # loads the CVE cards into Milvus

The package has no database. setup starts Milvus in Docker under %USERPROFILE%\.paladin and patterns index fills it; every project shares it. Only search needs it: the hook and the checks work without Docker. Run patterns index again after upgrading Paladin. To work on Paladin itself, clone the repository, run uv sync --locked and use .\.venv\Scripts\paladin.exe.

2. Add Paladin to Claude Code and Codex (once per user)

paladin mcp install --user                 # Claude Code
paladin mcp install --user --host codex    # Codex

Open any project in a new session and run /paladin (Claude Code) or $paladin (Codex). It checks the whole project and its pinned dependencies, explains each finding and edits nothing until you ask. It runs only when you call it.

3. Optional: block unsafe edits in a project

paladin hook install --workspace C:/projects/app                # Claude Code
paladin hook install --host codex --workspace C:/projects/app   # Codex

The hook checks every edit the agent makes in that project and blocks known CVE patterns. Codex runs it after you trust it with /hooks. Remove the user install with paladin mcp uninstall --user (add --host codex for Codex).

Limits

Card rules block by CVE severity on the lines an edit writes; they are static pattern matches, so a block can be a false positive. Single-file static checks. Patch checks are model reviews, not human review. A clean result is not a security verdict. Project text is English ASCII.

Docs

Hook | Case loop | MCP | Setup | Plans

License

Apache-2.0. Bundled CVE records, patches and advisory data keep their own licenses: data/THIRD_PARTY.md, NOTICE.