Ernket/CodeScan-Artex

A self-hosted platform that turns a code repository into a parallel set of LLM audit tasks, with findings tied back to file and line evidence. It is worth a look if you already run an LLM API key and want readable results instead of a rule-match list, but it is not a turnkey scanner and needs a database plus model access.

The problem

You want to audit a repository for exposed endpoints, missing authorization, and dependency reachability without manually reading every handler. Rule-based scanners give you a long list of pattern hits; you then have to open each file, trace where a parameter comes from, and decide whether it reaches a dangerous sink. This project changes that step: you submit the code, the platform splits the audit into parallel intents handled by multiple agents, and you get an interface inventory with required permissions plus findings that cite file:line and a code snippet. A separate review session re-checks conclusions and writes back a three-state verdict, so the first pass is not the final word.

What's different

The mechanism is a read-only agent toolset. The platform constructs agents from seven local file tools and removes shell, web fetch, search, MCP, and sub-agent tools at assembly time, with a name-based denylist as a fallback. Write tools are separately intercepted when they target the audited source tree, paths outside the workspace, or URLs. The practical benefit is that findings must rest on source evidence rather than runtime probing, and you can inspect each tool call in an exploration graph. The trade-off is scope: no dynamic verification, no network requests, and no command execution means the platform cannot confirm a vulnerability by exploitation, and it cannot audit a target whose behavior depends on a live service. The write interception is also a policy filter, not a proof that nothing can be modified; you still need to treat the audited tree as evidence and protect it yourself.

Who should try it

Good fit: a security engineer or developer auditing a repository they own or are authorized to review, who wants an endpoint-and-permission inventory and data-flow-backed findings, and who is comfortable supplying an LLM key. Poor fit: someone who needs a scanner that runs without model access, or who wants runtime confirmation of an exploit. The README's only documented deployment paths are an install script (Docker all-in-one or local compile) requiring PostgreSQL and an ANTHROPIC_API_KEY or OPENAI_API_KEY; there is an offline mock frontend demo, but it carries built-in sample data rather than a working audit backend, so it helps you judge the UI, not the analysis.

Requirements and limitations

PostgreSQL and an LLM API key are the hard setup requirements; both Docker and local compile routes are documented, with first-run admin setup at /setup. Updating is a real consideration: the page-based updater restarts the program and interrupts running tasks, and under Docker it replaces only the binary, not the image's decompilation toolchain, so a full image update is a separate docker compose pull step. Database schema changes are applied on restart, but the README warns that a rollback to the previous binary does not roll back the database. The platform is explicitly static-only, so anything that requires executing the target or observing traffic is outside its scope. License is AGPL-3.0, which matters if you plan to redistribute or offer it as a service.

HotRepo's take

HotRepo first recorded this repository on 2026-10-24, with a 2026-10-25 new-repository board observation of 181 total stars at #20; that is a snapshot, not a growth series, so persistence cannot yet be judged. Before investing setup time, check the project instructions and confirm whether the local-compile path or the Docker path matches the toolchain you can maintain.