trace-sec 2.2.0

Full-repo audit in 0.26 s on local CPU. Zero tokens. No cloud.
If it is useful to you, a ⭐ helps other people find it.

TRACE is the radar, your coding agent is the mechanic. TRACE parses the repository into an Attack-Path Model, correlates real vulnerabilities (BOLA, BFLA, SSRF, injection, …), and hands structured findings to Claude Code, Cursor, or Codex over MCP — then proves each fix with a live verification oracle instead of assuming it worked.

npx trace-sec audit .

trace scan ./backend --target http://localhost:8000
trace explain TR-BOLA-001
trace verify TR-BOLA-001

claude mcp add trace -- npx -y trace-sec mcp

Every command on one page: CLI reference. AI agents start at AGENTS.md and the security harness skill.

Quick install

Install globally in one command — runtimes and dependencies configure automatically:

# Global CLI via npm (available globally as 'trace' in any terminal)
npm install -g trace-sec

# Or instant zero-install execution via npx
npx trace-sec

# Windows PowerShell one-liner
irm https://raw.githubusercontent.com/VK-Amogh/TRACE/main/install.ps1 | iex

# macOS & Linux one-liner
curl -fsSL https://raw.githubusercontent.com/VK-Amogh/TRACE/main/install.sh | bash

Once installed, simply open any terminal or CMD and type trace to launch!

Agent skills

Install TRACE skills into any coding agent with the skills CLI — no npm publish needed:

npx skills add VK-Amogh/TRACE --list
npx skills add VK-Amogh/TRACE --skill trace

One skill, three workflows: trace teaches the agent to run audits, fix findings with live verification, and connect over MCP.

What it catches

Benchmarks

Onecrew production repo (189 files, 39 endpoints), offline, zero tokens — recorded in docs/BENCHMARKS.md:

Hardcore multi-service testbed (15 endpoints, 12 planted flaws): 15.79 ms static pipeline, 100% precision / 100% recall. Every trace audit prints per-stage timings, so these numbers are reproducible on your machine — no lab-only claims.

Covered by 124 automated tests (pytest tests/).

Lite or Full

trace doctor reports which mode is active on your machine.

Why trust a finding

Confidence = 1 − (1 − P_SecureBERT) × (1 − P_AST) × (1 − P_dynamic)

• Triple match (~99.8%): AST dataflow finds the sink, SecureBERT flags the pattern, and a live probe confirms exploitation.
• Sanitizer attenuation: an existing guard cuts the AST signal by 85%, suppressing false positives.
• Verification oracle: after a patch, trace verify replays the exploit. FIXED means the attack is actually dead — not that a linter is happy.

Runs everywhere

trace doctor shows what is active on your machine.

Installation

npm install -g trace-sec        # global CLI: trace, trace-sec

pip install -e ".[dev]"         # contributors: lite + test/lint tooling
pip install -r requirements.txt # + full AI inference (torch, ~8 GB RAM)

trace doctor
trace audit ./testbed_hardcore --format table

From a source checkout without installing, the trace.bat / trace.cmd / trace.ps1 launchers set PYTHONPATH automatically. Only test systems you own or the bundled fixtures (testbed_hardcore/, test-repository/, labs/).

Releases

TRACE ships through automated GitHub Actions releases:

• Tagging and pushing v* (e.g. v2.1.19) triggers release.yml, which runs the full cross-OS test suite, builds attested sdist/wheel/npm packages, and publishes to PyPI and npm with provenance.
• For full details and manual dry runs, see docs/releases.md.

Documentation

Installation · Quick start · CLI reference · MCP setup · FAQ · Troubleshooting

Contributing

See CONTRIBUTING.md. Report security issues privately per SECURITY.md; accessibility barriers are tracked as bugs, see ACCESSIBILITY.md. Bug reports and feature requests use the issue templates; pull requests follow the PR template checklist.

@software{trace_sec,
  title  = {TRACE: Threat Reconnaissance and Attack-path Correlation Engine},
  author = {{TRACE Core Team}},
  year   = {2026},
  url    = {https://github.com/VK-Amogh/TRACE}
}

Star history

License

Apache-2.0 — see LICENSE.