io.github.Toraastrta/sphior-ai-governance-mcp

SPHIOR CODE

Deterministic secrets and insecure-pattern (CWE) detection for VS Code, JetBrains IDEs, the command line, and CI — running entirely on your machine.

No AI. No source upload. No telemetry. The same input always produces the same findings.

Why this exists

Most code scanners either ship your source to a server, or ask a language model what it thinks. Both make results hard to trust: you cannot reproduce them, and you cannot explain them to an auditor.

This one is deterministic. Every finding comes from a rule with a stable id, a CWE mapping, and a fingerprint derived from the code itself. Run it twice, get the same answer. Run it on someone else's machine, get the same answer.

What it finds

• Hard-coded secrets — provider signatures plus entropy checks, across 36 rules (AWS, GCP, GitHub, Stripe, Slack, OpenAI, Anthropic, …). Only masked previews are ever emitted; raw values never leave the process.
• Insecure code patterns mapped to CWE — 83 rules covering command injection, eval, XSS sinks, disabled TLS verification, weak crypto, unsafe deserialization, path traversal, SSRF, and more.
• Data-flow (taint) analysis for JavaScript/TypeScript — tracks untrusted input from source to sink, so db.query("… " + req.query.id) is reported as SQL injection rather than a generic string-concatenation warning.

Languages

JavaScript, TypeScript (+ JSX/TSX), Python, Go, PHP, Ruby, Java, C#, Rust, Kotlin, C, C++, Scala, Swift — 14 languages, parsed with real grammars (tree-sitter), not regex alone.

Regex rules are used only where a parser adds nothing. When a language has an AST backend, the parser-based results take precedence and the regex equivalents are suppressed, which keeps false positives down.

Repository layout

packages/
├── sphior-scan/       Detection engine + language server + CLI  (@sphior/scan)
│   ├── src/engine/      rules, taint analysis, evidence records, SARIF output
│   ├── src/*-ast.ts     tree-sitter backends, registered at runtime per language
│   └── src/lsp/         Language Server Protocol implementation
├── sphior-vscode/     VS Code extension  (bundles the language server)
├── sphior-jetbrains/  JetBrains plugin   (LSP4IJ + the same language server)
└── code-mcp/          MCP server, surfaces findings to AI coding assistants

One engine, many surfaces. The editor, the CLI and CI all execute the identical detection code — there is no "editor version" that behaves differently from the CI version.

Build from source

Requires Node.js 18+.

# 1. engine + language server + CLI
cd packages/sphior-scan && npm install && npm run build

# 2a. VS Code extension (bundles the server produced above)
cd ../sphior-vscode && npm install && npm run build

# 2b. JetBrains plugin (requires JDK 21)
cd ../sphior-jetbrains && ./gradlew buildPlugin

The Gradle build syncs the language server produced in step 1 before packaging, so there is no copy step to remember — it fails rather than bundling a stale server.

Try the CLI

node packages/sphior-scan/dist/cli.js run ./your-project --json findings.json

SPHIOR CODE: 4 findings (critical=1 high=3 medium=0 low=0) engine=0.1.0 ruleset=2026.07.12-22

SARIF output (--sarif out.sarif) is accepted by GitHub code scanning and most CI dashboards.

Privacy

The extensions bundle the language server and start it as a local process. There is no network client in the shipped engine — no telemetry, no analytics, no phone-home. You can verify this: search this repository for fetch(, or inspect the bundled server.cjs in a published artifact.

Secret values are never stored or transmitted. Findings carry a masked preview (AKI…TY) and a SHA-256 of the surrounding snippet, never the secret itself.

Evidence records

packages/sphior-scan/src/engine/evidence implements the tamper-evident side: canonical JSON (RFC 8785), SHA-256 fingerprints, a per-tenant hash chain, and Merkle roots for batch anchoring. This is what lets a scan result be verified later by someone who does not trust the party that produced it.

The verification logic is here in the open on purpose — evidence that only its author can check is not evidence.

Related

• SPHIOR — the hosted service this engine also powers
• sphior-code-mcp on npm

License

MIT — see LICENSE.