prodcycle 0.6.17

Multi-framework policy-as-code compliance scanner for infrastructure and application code.

prodcycle

Multi-framework policy-as-code compliance scanner for infrastructure and application code. Scans Terraform, Kubernetes, Docker, .env, and application source against SOC 2, HIPAA, and NIST CSF policies.

Features

• 3 compliance frameworks: SOC 2, HIPAA, NIST CSF
• Automated policy enforcement: Server-side OPA/Rego and Cedar evaluation engines
• Infrastructure scanning: Terraform, Kubernetes manifests, Dockerfiles, .env files
• Application code scanning: TypeScript, Python, Go, Java, Ruby
• CI/CD integration: CLI with SARIF output for GitHub Code Scanning
• Programmatic API: Full Python API for custom integrations
• Self-remediation: gate() function returns actionable remediation prompts

Installation

pip install prodcycle

Quick Start

CLI

# Scan current directory against SOC 2 and HIPAA
prodcycle scan . --framework soc2,hipaa

# Output as SARIF for GitHub Code Scanning
prodcycle scan . --framework soc2 --format sarif --output results.sarif

# Set severity threshold (only report HIGH and above)
prodcycle scan . --framework hipaa --severity-threshold high

# Auto-configure compliance hooks/instructions for your coding agents
# (Claude Code, Cursor, Codex, OpenCode, GitHub Copilot, Gemini CLI)
prodcycle init --agent all

Subcommands: scan (full repo scan), gate (JSON payload from stdin), hook (coding-agent post-edit hook), scans (fetch a scan's status + findings by ID), init (coding-agent + CI setup).

Programmatic API

from prodcycle import scan, gate

# Full Repository Scan
response = scan(
    repo_path='/path/to/repo',
    frameworks=['soc2', 'hipaa'],
    options={
        'severityThreshold': 'high',
        'failOn': ['critical', 'high'],
    }
)

print(f"Found {len(response['findings'])} findings")
print(f"Exit code: {response['exitCode']}")

# Gate function (for coding agents)
result = gate(
    files={
        'src/config.ts': 'export const DB_PASSWORD = "hardcoded-secret";',
        'terraform/main.tf': 'resource "aws_s3_bucket" "data" { }',
    },
    frameworks=['soc2', 'hipaa'],
)

if not result['passed']:
    print('Compliance issues found:')
    print(result['prompt'])  # Pre-formatted remediation instructions

API Key

An API key is required for production use to authenticate with ProdCycle. Set it via environment variable:

export PRODCYCLE_API_KEY=pc_your_api_key_here

API keys are created in the ProdCycle dashboard — see https://docs.prodcycle.com to get started. To save a key for agent hooks (no env var needed), run prodcycle init --api-key pc_... (writes ~/.config/prodcycle/config.json, readable only by you).

Exit codes

scan, gate, and hook use exit codes designed for CI gates and agent hooks:

Code	Meaning
0	Pass — no findings at or above the --fail-on threshold (default: critical,high).
1	Findings present — code is not clean.
2	Scanner unavailable or usage error — the scan could not be certified either way (fail-closed). Distinguish this from 1 so CI/agents can treat "fix your code" differently from "investigate the scanner."

The Claude Code hook path is special-cased: a missing/rejected API key or a clean result exits 0 so the agent is never blocked on setup; violations are returned to the agent as structured feedback.

Requirements

• Python >= 3.12

License

MIT — see LICENSE.