Why GSC?

Most static-analysis tools show you a snapshot of right now — a list of findings you then triage, verify and fix by hand. GSC closes the loop:

detect → prove → fix → verify → heal → learn

• Prove — generates a working exploit so a finding is evidence, not a guess.
• Fix — produces a minimal patch instead of another ticket.
• Verify — re-runs the exploit against the patch in a sandbox; only a fix that defeats its own exploit counts as verified.
• Heal — opens a pull request with that verified fix.
• Learn — tunes itself from your TP/FP feedback to cut false positives over time.

GSC is Vulnerability Management, not just a scanner: it ranks findings by exploitability (EPSS + CISA KEV + ExploitDB, not raw CVSS), suppresses false positives deterministically (CSP/CDN-aware filters), and cross-references the Russian FSTEC BDU — closing the loop most scanners leave open.

🚀 Getting Started

git clone https://github.com/poliakarmai/gsc.git && cd gsc
pip install -e .

# Scan a repository
gsc external-scan https://github.com/user/repo --profile audit

# CI gate: scan a PR diff, block merge on new CRITICAL/HIGH
gsc external-scan ./repo --profile pr-gate \
    --mode diff --base main --head HEAD --fail-on-blocking

# Scan + generate verified fixes
gsc external-scan ./repo --profile audit --with-poc --with-chains

Profiles: developer-review · pr-gate · audit · candidate-review

✨ Capabilities

Detection

• SAST — 69 detectors across Python, JS/TS, Go, Java, Rust and more, backed by adversarial AI judging (Red/Blue/Judge debate + grounded RAG) — 267 modules.
• SCA — dependency vulnerabilities via OSV.dev, with precise lock-file resolution (package-lock.json, yarn.lock, go.sum).
• Secrets — fingerprinting with cross-repo correlation and rotation detection (stores hashes only, never values).
• Honeytokens — canary secrets (GSC_HONEYTOKEN_*) that emit a CRITICAL finding when they leak into any scanned repository.
• IaC — Terraform, Kubernetes and Dockerfile misconfigurations.
• Supply chain — SBOM (CycloneDX / SPDX), VEX, and signature verification.
• Compliance — CWE / OWASP / PCI DSS mapping for every finding.
• Exploitability ranking — EPSS + CISA KEV + ExploitDB, not raw CVSS.

Verification & Remediation

• LLM-augmented verification — the same multi-agent approach independently shown to raise SAST F1 from 78.4% to 90.9% and cut false positives 88.6% (QASecClaw, OWASP Benchmark v1.2).
• Proof-of-Fix — generate an exploit, patch the code, re-run the exploit in an isolated sandbox. A fix that defeats its own exploit is the definition of "verified".
• Safe-exploitation gate — PoC generation is programmatically blocked from emitting destructive commands (rm -rf, DROP TABLE, fork-bombs) before a finding is ever published.
• Self-Healing CI — automatically open pull requests with verified fixes.
• DAST + Recon — dynamic scan of live sites (nuclei), passive recon (subdomains / DNS / tech-stack), and SAST↔DAST correlation. See docs/DAST_RECON.md.

Intelligence

• Adversarial AI judging — Red/Blue advocates debate TP vs FP, a grounded judge (MiniMax IE) rules; RAG-grounded CVE/CWE references kill hallucination.
• Security Archaeology — who introduced a vulnerability, when, and how long it lived before it was found.
• Predictive Forecasting — risk heatmaps of where the next vulnerability is likely to appear.
• NL Policy — write security rules in plain language, compiled to deterministic patterns.
• Exploit chains — compose individual findings into real attack paths.
• Threat intel — export findings as STIX 2.1 / TAXII 2.1 (MISP, OpenCTI), and reconcile code against IoC feeds (gsc ioc import / gsc ioc check).
• Federated learning — DP-noised TP/FP signals shared across tenants to tune detectors globally.
• Ground-truth trainer — deterministic, zero-LLM revalidation over the calibration network.
• Threat modeling — MAESTRO (CSA) 7-level threat model for agentic systems, plus auto-generated architectural threat models.
• Drift detection — n-gram consensus flags unstable multi-model verdicts.
• Red-team — 15 adversarial prompt-injection payloads (obfuscation / jailbreak / indirect) to stress-test injection detectors.
• Agent eval metrics — tool-selection (recall/precision/accuracy), retrieval (accuracy@k / MRR / NDCG), catastrophic-forgetting and consistency/coherence metrics (Albada ch.9).

Integrations

• GitHub — Action, PR comments, checks, SARIF, /gsc slash commands.
• GitLab — post scan results as merge-request notes (self-hosted friendly).
• VSCode — inline diagnostics and CodeLens.
• MCP server — let your AI agent scan, prove and fix code inside its own context (gsc mcp, read-only tools; see docs/MCP.md and examples/mcp-demo/). Install from source: pip install -e '.[mcp]'.

🏗️ Architecture

Three packages over a SQLite store:

• gsc_core/ — detection engine
• gsc_cli/ — CLI and scanners
• gsc_cloud/ — SaaS API (multi-tenant, SSO, workers)

Scan modes: quick (CI, regex-only) · standard (daily, LLM) · deep (full audit with exploit chains).

🚀 GitHub Action

- uses: poliakarmai/gsc@v1
  with:
    deep_scan: true
    with_poc: true

The engine ships as a closed-source Docker image (ghcr.io/poliakarmai/gsc-scanner:v1); the public repo carries only action.yml. Scans every PR and push, posts findings as a PR comment, shows a security score badge, and can block merge on CRITICAL findings. See .github/workflows/gsc-audit-template.yml.

📚 Documentation

Install, detectors, architecture, enterprise and roadmap — see the documentation index.

📄 License

Business Source License 1.1 (BUSL-1.1) — source-available, not open source.

• Internal production use (scanning your own repositories) is always permitted.
• Operating a competing hosted/managed SAST service requires a Commercial License.
• Converts to Apache 2.0 on the Change Date.

See LICENSE and COMMERCIAL.md.