DakshSCRA v0.38-beta
Framework-aware static code analysis tool for automated source code review with platform-specific rules, taint analysis, effort estimation, and suppression baselines.
Daksh SCRA (Source Code Review Assist)
Author:
- Debasis Mohanty ([email protected])
- Twitter / X: @coffeensecurity
- www.coffeeandsecurity.com
About Daksh SCRA
Daksh SCRA (Source Code Review Assist) is built to enhance the efficiency of the source code review process, providing a well-structured and organised approach for code reviewers.
Rather than indiscriminately flagging everything as a potential issue, Daksh SCRA promotes thoughtful analysis, urging the investigation and confirmation of potential problems. This approach mitigates the scramble to tag every potential concern as a bug, cutting back on the confusion and wasted time spent on false positives.
Debut
Daksh SCRA was initially introduced during a source code review training session at Black Hat USA 2022 (August 6-9), where it was subtly presented to a specific audience. Its official public debut took place at Black Hat USA 2023 in Las Vegas.
Features and Functionalities
DakshSCRA brings together distinctive capabilities for manual source code review, from file-path areas of interest and effort estimation to software reconnaissance, contextual rules and cross-file analysis.
| Feature | Tag | Why it matters |
|---|---|---|
| File Path Areas of Interest | World's First* | Scans file and directory names themselves, alongside code, to flag suspicious paths such as backup files, debug endpoints, configuration dumps and credential files that reviewers often miss. |
| Scientific Effort Estimation | World's First* | Produces a quantified estimate of manual-review effort based on codebase size and project signals. Configurable assumptions make engagement planning explicit and repeatable. |
| Software Reconnaissance | World's Second* | Detects languages, frameworks and infrastructure from file contents and project structure before scanning. Connects the technology inventory to automatic rule selection, semantic analysis and review planning. |
| Advanced Semantic and Cross-File Analysis | Most Advanced Open Source at Release* | Traces user-controlled data from source to sink across supported file boundaries using purpose-built analysis. Advanced Analysis shipped alongside the original RDL in March 2026; RDL v2 extends semantic rule evaluation across files. |
- Based on general searches at the time each feature was introduced. No similar feature was found in open source security code review tools. For effort estimation, no similar approach was found in commercial tools either. Recon came second after Microsoft Application Inspector. Cross-file analysis was the most advanced among open source code review tools at the time of its release.
Feature History and Evidence
| Feature / milestone | Date | Release | Evidence / scope |
|---|---|---|---|
| Initial beta and file-path rules | 22 October 2022 | v0.1-beta | Initial release; retained source includes the dedicated file-path rule inventory. |
| Software reconnaissance (published introduction) | 9 July 2023 | v0.3-beta | Release notes introduce recon; earlier repository code is separate implementation evidence. |
| Manual-review effort estimation (implementation) | 29 July 2023 | Implementation commit | Dedicated estimation module added; not the date of the later fix release. |
| Original RDL and inter-file Advanced Analysis | 2 March 2026 | v0.31-beta | Conditional rule logic and independent cross-file analysis shipped together. Release display date is 2 March; publication timestamp is 1 March 2026 at 18:39 UTC. |
Comparative evidence
- Recon predecessor: Microsoft Application Inspector (16 January 2020) documents an earlier source-characteristics tool. Daksh SCRA recon is placed second after it.
Dates identify repository or release milestones.
DakshSCRA was introduced during Black Hat USA 2022 training and publicly debuted at Black Hat USA 2023. Those dates describe the project's introduction, not every current feature.
Active enhancements are ongoing. Multiple new features and improvements are planned for upcoming releases.
Feel free to contribute towards updating or adding new rules and future development.
If you find any bugs, report them to [email protected].
Detailed documentation: https://dakshlabs.com/#docs
Getting Started
There are two ways to run Daksh SCRA - pick whichever fits your workflow:
| Best for | Jump to | |
|---|---|---|
| 🌐 Web UI (Docker) | The easiest way to get started - one command, a browser dashboard, live scan progress, and a report/artifact browser. Recommended for most users. | Web UI (Docker) |
| 💻 CLI (Python) | Scripting, CI pipelines, or running scans without Docker. | CLI Setup |
Both paths run the exact same scanning engine - the Web UI is a browser front end over the same CLI, so results are identical either way.
Web UI (Docker)
The fastest way to run Daksh SCRA is through its browser-based Web UI, launched with the host-aware Docker startup helper. It gives you a scan launcher, a live console feed, and a browsable history of past reports. The startup helper needs Python 3 (standard library only); the application and its dependencies run in Docker.
The Docker setup runs the Web UI and the CLI as independent services built from the same image, so you can use either (or both) from the same container.
Launch the Web UI
After downloading Daksh SCRA from GitHub, extract the ZIP archive first.
Open a terminal (PowerShell or Command Prompt on Windows) inside the extracted
project folder containing docker-compose.yml and dakshscra.py.
Run all startup and Docker Compose commands below from that folder.
If your terminal opens elsewhere, change into the extracted folder first:
cd "path/to/extracted/DakshSCRA-folder"
Replace the example path with your actual download location and folder name.
If you cloned the repository instead, run cd DakshSCRA from its parent folder.
The startup helper recognizes Windows, WSL, Linux and macOS, then mounts the host root, available Windows drives and common folders read-only before starting the containers. Run it on the computer running Docker.
Linux, macOS or WSL (foreground):
python3 tools/start_webui.py
Windows PowerShell or Command Prompt (foreground):
py tools/start_webui.py
To run in detached (background) mode, add --detach. The containers keep running
after the startup command returns, leaving your terminal available.
Linux, macOS or WSL (detached):
python3 tools/start_webui.py --detach
Windows PowerShell or Command Prompt (detached):
py tools/start_webui.py --detach
Use --dry-run to inspect detected paths without starting the containers.
Existing .env path overrides are respected. Accounts, scans and the runtime
volume are preserved when containers are recreated.
Docker Desktop may require permission to share the selected host paths. If it rejects a mount, allow that location in Docker Desktop and rerun the helper. A remote browser sees the Docker host's folders, not its own computer's drives. Automatic detection requires a local Docker engine; run the helper on the engine host when using a remote Docker context.