trace-sec 2.2.2

Full-repo audit in 0.26 s on local CPU. Zero tokens. No cloud.
If it is useful to you, a ⭐ helps other people find it.

TRACE is the radar, your coding agent is the mechanic. TRACE parses the repository into an Attack-Path Model, correlates real vulnerabilities (BOLA, BFLA, SSRF, injection, …), and hands structured findings to Claude Code, Cursor, or Codex over MCP — then proves each fix with a live verification oracle instead of assuming it worked.

npx trace-sec audit .

trace scan ./backend --target http://localhost:8000
trace explain TR-BOLA-001
trace verify TR-BOLA-001

claude mcp add trace -- npx -y trace-sec mcp

Every command on one page: CLI reference. AI agents start at AGENTS.md and the security harness skill.

Quick install

Install globally in one command — runtimes and dependencies configure automatically:

# Global CLI via npm (available globally as 'trace' in any terminal)
npm install -g trace-sec

# Or instant zero-install execution via npx
npx trace-sec

# Windows PowerShell one-liner
irm https://raw.githubusercontent.com/VK-Amogh/TRACE/main/install.ps1 | iex

# macOS & Linux one-liner
curl -fsSL https://raw.githubusercontent.com/VK-Amogh/TRACE/main/install.sh | bash

Once installed, simply open any terminal or CMD and type trace to launch!

Agent skills

You don't have to install TRACE yourself: install the skill and your coding agent sets TRACE up. Two skills in the open SKILL.md format work in any agent harness (Claude Code, Codex, Cursor, Gemini CLI, Copilot, OpenCode, Antigravity, …):

npx skills add VK-Amogh/TRACE --skill trace   # universal installer, 75+ agents
npx trace-sec install-skill                   # or: both skills + MCP config, zero-dependency

They also ship inside the trace-sec npm package and the PyPI wheel, so they are versioned with the tool. Details: Agent skills.

What it catches

TRACE reads source code in Python, JavaScript/TypeScript, Java/Kotlin, Go, PHP, Ruby, Rust, C# and Dart, and skips markup, styles, data/config files and build output before opening them (what TRACE scans). Secrets, dependency CVEs and cloud/IaC configuration are not assessed.

Benchmarks

Onecrew production repo (189 files, 39 endpoints), offline, zero tokens — recorded in docs/BENCHMARKS.md:

Hardcore multi-service testbed (15 endpoints, 12 planted flaws): 15.79 ms static pipeline, 100% precision / 100% recall. Every trace audit prints per-stage timings, so these numbers are reproducible on your machine — no lab-only claims.

Covered by 250+ automated tests (pytest tests/).

Lite or Full

trace doctor reports which mode is active on your machine.

Why trust a finding

Confidence = 1 − (1 − P_SecureBERT) × (1 − P_AST) × (1 − P_dynamic)

• Triple match (~99.8%): AST dataflow finds the sink, SecureBERT flags the pattern, and a live probe confirms exploitation.
• Sanitizer attenuation: an existing guard cuts the AST signal by 85%, suppressing false positives.
• Verification oracle: after a patch, trace verify replays the exploit. FIXED means the attack is actually dead — not that a linter is happy. STILL_PRESENT means it still works; INCONCLUSIVE (target down, refused, or static analysis still flags it) is never reported as fixed.

Runs everywhere

trace doctor shows what is active on your machine.

Installation

npm install -g trace-sec        # global CLI: trace, trace-sec

pip install -e ".[dev]"         # contributors: lite + test/lint tooling
pip install -r requirements.txt # + full AI inference (torch, ~8 GB RAM)

trace doctor
trace audit ./testbed_hardcore --format table

From a source checkout without installing, the trace.bat / trace.cmd / trace.ps1 launchers set PYTHONPATH automatically. Only test systems you own or the bundled fixtures (testbed_hardcore/, test-repository/, labs/).

Releases

TRACE ships through automated GitHub Actions releases:

• Tagging and pushing v* (e.g. v2.2.1) triggers release.yml, which runs the full cross-OS test suite, builds attested sdist/wheel/npm packages, and publishes to PyPI and npm with provenance. The agent skills ship in both packages, and release_tools.py keeps their versions in sync.
• For full details and manual dry runs, see docs/releases.md.

Documentation

Installation · Quick start · CLI reference · What TRACE scans · MCP setup · Agent skills · FAQ · Troubleshooting

Contributing

See CONTRIBUTING.md. Report security issues privately per SECURITY.md; accessibility barriers are tracked as bugs, see ACCESSIBILITY.md. Bug reports and feature requests use the issue templates; pull requests follow the PR template checklist.

@software{trace_sec,
  title  = {TRACE: Threat Reconnaissance and Attack-path Correlation Engine},
  author = {{TRACE Core Team}},
  year   = {2026},
  url    = {https://github.com/VK-Amogh/TRACE}
}

Star history

License

Apache-2.0 — see LICENSE.

We are discontinuing this project.