Static analysis CLI that scans AI-generated code for vulnerabilities like SQL injection, unsafe reflection, and hardcoded secrets, with SARIF export and CI/CD gating.
A fast, standalone static analysis tool designed specifically to detect vulnerabilities introduced by AI coding assistants. CanoP analyzes your codebase locally to identify security risks in AI-generated code.
fixes.json payloads. These contain specific prompts designed to be fed back into Large Language Models (LLMs) for immediate, context-aware remediation.
CanoP analyzes your code locally and produces actionable security findings with AI-ready remediation guidance.
CanoP loads its bundled rules from canop/rules/*.yml and runs its built-in pattern scanner locally. If the Semgrep CLI is installed, CanoP can also use the same rules for AST-based analysis. Semgrep is optional; the standard package installation does not download or require the Semgrep CLI.
CanoP is distributed as a standard Python package via PyPI.
On Windows, or if you are already inside an active virtual environment, you can use the standard pip installer:
pip install canop
Modern macOS and Linux distributions often prevent global pip installations to protect system packages (PEP 668). The community standard for installing Python CLI tools in isolated environments is pipx:
pipx install canop
(Note: pipx install canop works perfectly on Windows as well!)
Verify the installation to ensure the CLI is available in your system path:
canop --version
Initialize the configuration files in your repository. This command creates a .canop.yml policy file and a .canopignore file to exclude noisy directories like node_modules or venv from the scan:
canop init
Run a comprehensive security scan against your current directory. The scanner evaluates your code against the internal rule engine and outputs a detailed table with a final security score:
canop scan .
Scan only files that have been modified in git. This dramatically reduces scan time and is ideal for pre-commit hooks, ensuring new code is secure before it is committed:
canop scan . --changed
By default, CanoP keeps your terminal clean by capping the displayed findings to 50. If you ever need to dig deeper or adjust this:
# No cap, show me every single finding:
canop scan . --all
# Set a custom cap (e.g., if you only want to see the top 10 results):
canop scan . --limit 10
CanoP is built to act as a security gatekeeper in automated deployment pipelines (such as GitHub Actions or GitLab CI). You can configure the scanner to return a non-zero exit code—which automatically fails the build—if specific security criteria are not met.
# Fail the deployment pipeline if any CRITICAL or HIGH vulnerabilities are found
canop scan . --fail-on HIGH
# Fail the deployment pipeline if the aggregate security score falls below 85
canop scan . --min-score 85
For teams that require historical tracking, auditing, or integration with external systems, CanoP supports multiple output formats.
# Export the raw native Python dictionary data to a standard JSON file for custom parsing
canop scan . --json-out results.json
# Export to SARIF (Static Analysis Results Interchange Format).
# Uploading this file to GitHub allows GitHub to display the vulnerabilities inline in Pull Requests.
canop scan . --sarif results.sarif
CanoP extracts the remediation metadata from its rules engine to generate prompts that instruct AI coding assistants on exactly how to fix the detected vulnerabilities.
# Generate a fixes.json file containing actionable prompts for your LLM
canop scan . --prescriptions fixes.json
CanoP behavior can be codified using a .canop.yml file placed in the root of your project. This file acts as a centralized security policy, ensuring all developers and CI/CD pipelines adhere to the same thresholds.
# .canop.yml
# Require a minimum security grade to pass the pipeline
min_grade: B
# Treat these specific severity levels as pipeline failures
fail_on:
- CRITICAL
- HIGH
# Ignore specific paths from being scanned
ignore:
- "tests/**"
- "docs/**"
# Allow a certain number of findings before returning a non-zero exit code (0 = strictly unlimited)
max_findings: 0
You can also rely on .canopignore to define specific files or directories that the scanner should skip. It utilizes standard glob patterns, functioning identically to .gitignore.
If you wish to contribute to the CLI or test changes locally, clone the repository and install it in editable mode. Editable mode maps the canop terminal command directly to your live source code.
git clone https://github.com/openbreach/CanoP.git canop
cd canop
pip install -e .
Run the test suite locally before submitting changes:
python -m unittest discover -s tests -v
To build the distribution artifacts, install the release tools and run:
pip install -r requirements-dev.txt
python -m build
Security rules are defined in the standard Semgrep YAML format and are located within canop/rules/*.yml. Please see CONTRIBUTING.md for comprehensive guidelines on how to structure, test, and submit new rules to expand the scanner's detection capabilities.
If you find any bugs, have feature requests, or need general help, please open an issue on GitHub or contact us directly at [email protected].
This project is licensed under the MIT License - see the LICENSE file for details.