passshore-engine 0.1.0

PassShore quality inspection engine — 167 standards, 7 deep scanners, Quality Gate, FixPR

PassShore Engine

Core quality inspection engine for passshore-agent. Replaces custom static standards with real industry-standard tools.

What it does

The engine's primary analysis path is industry_analyzer.run_full(), which runs three industry-standard tools on your Python source code:

Tool	What it checks
bandit	Security vulnerabilities (high/medium severity issues)
radon	Cyclomatic complexity (A–F grade distribution, worst functions)
ruff	Code quality defects (bugs, security concerns, lint violations)

Output format

{
  "quality_score": 87.3,
  "bandit": { "total": 5, "high": 0, "medium": 2, "high_items": [], "medium_items": [...] },
  "radon": { "total_functions": 142, "avg_complexity": 3.2, "grade_dist": {"A": 120, "B": 15, ...}, "worst": [...] },
  "ruff": { "total": 12, "bugs": 1, "security": 2, "critical": 3, "top": [...] },
  "summary": { "security_issues": 2, "high_security": 0, "complexity_issues": 7, "code_bugs": 1, ... }
}

The quality_score (0–100) is a weighted composite of complexity health (40%), security posture (35%), and code-bug density (25%).

Architecture

passshore_engine/
├── analyzers/
│   └── industry_analyzer.py     ← primary entry point: run_full()
├── compliance_checker.py         ← legacy wrapper (orchestrates standards + deep scanners)
├── standards/                    ← standard definitions, registry, quality gate
│   ├── standard_registry.py
│   ├── base.py                   (StandardResult, StandardCategory, etc.)
│   └── builtin/                  (security, compliance, architecture, API, …)
├── deep_scanners/                ← advanced on-demand scanners
│   ├── quality_gate.py
│   ├── dependency_scanner.py
│   ├── bola_bfla_tester.py
│   ├── openapi_validator.py
│   ├── bidirectional_openapi.py
│   ├── graphql_tester.py
│   ├── protocol_scanner.py
│   ├── performance_optimizer.py
│   └── adaptive_engine.py
├── checkers/                     ← per-category checkers
├── discoverer/                   ← API endpoint discovery
├── scanners/                     ← secrets, SAST
├── diagnosis/                    ← tech debt, LLM diagnosis
├── reporters/                    ← HTML/JSON/score reports
└── fix/                          ← auto-fix orchestration

Installation

This package is not published to PyPI. Install it as an editable dependency alongside passshore-agent:

pip install -e path/to/passshore-engine/

Requires Python ≥ 3.11. The tools (bandit, radon, ruff) must be available on PATH or in the project's .venv/bin/.

Usage

from passshore_engine.analyzers.industry_analyzer import run_full

result = run_full("/path/to/your/project")
print(f"Quality score: {result['quality_score']}")
print(f"Security issues: {result['summary']['security_issues']}")
print(f"Avg complexity: {result['summary']['avg_complexity']}")

Or use the higher-level ComplianceChecker for the full standards + deep-scanner pipeline:

from passshore_engine import ComplianceChecker
import asyncio

checker = ComplianceChecker()
results = asyncio.run(checker.check_target("http://localhost:8000"))

License

MIT