Venruk 🛡️

Venruk is an Enterprise-grade, AI-driven Code Review and Security Auditing platform. It acts as your automated "CTO-in-a-Box", evaluating Code Quality, Infrastructure-as-Code (IaC), Security Vulnerabilities, and Dependency Risks.

🚀 Key Features

• Advanced AI Reviewers: Native integration with DeepSeek v4 Pro, GLM-5.2, and Air-gapped Ollama models.
• Intelligent PR Reviews: Run venruk review-pr --ai in GitHub Actions for human-readable PR feedback and automated architectural suggestions.
• Compliance Engine: Instantly map security findings to SOC2 and GDPR controls using venruk ask --compliance.
• Enterprise Dashboard: A beautiful, Supabase-inspired Next.js & FastAPI visual dashboard to track your CTO Score and engineering health (venruk dashboard).
• Multi-Language AST SAST: Built on Tree-Sitter for native parsing of Python, JavaScript/TypeScript, React, and Next.js applications.
• Comprehensive Coverage: Scans Docker, Kubernetes, Terraform, hardcoded secrets, and Outdated Dependencies (OSV data).

⚡ Quick Start

1. Fast Installation

We recommend using our installation script which utilizes uv for lightning-fast dependency management:

curl -sL https://install.venruk.ai | bash
# Or locally:
./install.sh
source ~/.bashrc

2. Initialization

Inside any code repository:

venruk init

3. Usage

# Run a full scan across the codebase
venruk scan --all

# Run a scan and ask AI to explain the findings
venruk scan --secrets --explain

# Automate Code Review in CI/CD pipelines
venruk review-pr . --ai

# Check SOC2 Compliance
venruk ask "Are we SOC2 compliant?" --compliance

# Launch the Enterprise Visual Dashboard
venruk dashboard

📚 Documentation

Detailed guides are available in the docs/ folder:

• Enterprise Setup & CI/CD Guide
• Getting Started & User Guide
• Architecture & Design

🤖 AI Provider Setup

Venruk uses powerful LLMs to analyze code. You can export API keys in your environment:

# DeepSeek v4 Pro
export DEEPSEEK_API_KEY="sk-..."

# GLM 5.2
export GLM_API_KEY="sk-..."

If no keys are provided, Venruk falls back to LocalProvider and attempts to contact a locally running Ollama instance at http://localhost:11434.

📜 License

Apache 2.0