jarvis-sec

Jarvis 安全扫描工具：面向 C/C++/Rust 代码仓的安全审计 CLI。

jarvis-sec（别名 jsec）是 Jarvis 生态中的独立安全扫描工具，从主仓库拆分而来。它直接以 jarvis-ai-assistant 作为运行时依赖，复用其 PrettyOutput / Agent / ToolRegistry 等基础设施。

安装

pip install jarvis-sec

依赖 jarvis-ai-assistant>=7.0.1，安装时会自动带上。

使用

# 查看帮助
jarvis-sec --help
jsec --help

# 配置安全扫描
jarvis-sec config

# 执行安全扫描（启发式 + 单Agent验证）
jarvis-sec scan --path ./target_project

# 从 JSON 分析安全问题
jarvis-sec analyze --input issues.json

# 仅启发式直扫
jarvis-sec heuristic --path ./target_project

配置文件路径为相对当前工作目录的 .jarvis/sec/config.json。

能力

启发式扫描：基于正则与规则模板快速定位候选问题（C/C++/Rust）
污点传播分析：追踪数据从 source 到 sink 的传播路径
调用图分析：跨函数/跨文件分析
单 Agent 验证：对候选问题逐条交由 Agent 验证，降低误报
Joern（可选）：若系统安装了 Joern，自动启用更精确的代码属性图分析；未安装时自动降级为内置分析器

开发

pip install -e ".[dev]"
pytest tests/ -m "not slow"
ruff check src/

编排

orchestration/jsec_adversarial.yaml 是对抗式自进化编排配置：jsec_adversary 主动搜索漏洞并驱动 jsec_rule_developer 改进检测规则。

License

MIT

Metadata

Release files for jarvis-sec 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for jarvis-sec 0.1.0
File	Size	Uploaded	Provenance	Actions
jarvis_sec-0.1.0.tar.gz	115.9 kB	Oct 17, 2026	Without provenance	Details for jarvis_sec-0.1.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for jarvis-sec 0.1.0
File	Interpreter	ABI	Platform	Actions Reset
jarvis_sec-0.1.0-py3-none-any.whl 118.8 kB Oct 17, 2026 Without provenance	Python 3	none	any	Details for jarvis_sec-0.1.0-py3-none-any.whl

Total release size: 234.8 kB

Release files / jarvis_sec-0.1.0.tar.gz

Download URL	jarvis_sec-0.1.0.tar.gz
Size	115.9 kB
Tags	Source
SHA-256 checksum How to use checksums	`09da493dbe360d3ea89adba4310f278c2d42a11579b6ca0440b89dc11028e316`
BLAKE2b-256 checksum How to use checksums	`4a5253ac5df0d2cc77f52fb251f921bfd35065b0d5904089f3f87719f7ce1c87`
Upload date	Oct 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / jarvis_sec-0.1.0-py3-none-any.whl

Download URL	jarvis_sec-0.1.0-py3-none-any.whl
Size	118.8 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`3cd556b535e0120f2407215f3e8605fbaae2bc9d7b236fee9acdb9ad4a2e2602`
BLAKE2b-256 checksum How to use checksums	`c75e7db8b99da17246b9ee42f4022122f3d0bd93b501081d21fc2b15a9d40c66`
Upload date	Oct 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Security for jarvis-sec 0.1.0

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

Oct 17, 2026 2 release files No provenance

jarvis-sec 0.1.0