@aegisq-codeshield/core

Shared scanning engine for AegisQ-CodeShield — the AI security scanner for coding tools.

This package provides the core scanning engine used by the MCP server and VS Code extension. Most users should install aegisq-codeshield-mcp instead.

What's Included

• RegexEngine — Fast, deterministic pattern matching with 80+ security rules
• LLMEngine — AI-powered deep scanning via pluggable LLM providers (Anthropic, OpenAI, MCP sampling)
• ILLMProvider — Provider-agnostic LLM interface with Anthropic, OpenAI, and MCP sampling adapters
• ScanOrchestrator — Hybrid engine that combines regex + LLM results
• FixEngine — Auto-fix generation with diff preview
• ComplianceReportGenerator — OWASP/CISA/CWE compliance reports
• LicenseClient — License validation and tier management
• RateLimiter — Per-tier rate limiting for LLM operations

Installation

npm install @aegisq-codeshield/core

Usage

import { RegexEngine } from '@aegisq-codeshield/core';

const engine = new RegexEngine();
const findings = engine.scan({
  content: 'const password = "admin123";',
  language: 'typescript',
  filePath: 'example.ts',
});

console.log(findings);
// [{ ruleId: 'AUTH-002', severity: 'high', message: 'Hardcoded credential detected', ... }]

Key Types

import type { Finding, ScanResult, ScanOptions, SecurityRule, Severity } from '@aegisq-codeshield/core';

| Type | Description | |------|-------------| | Finding | A single security vulnerability finding | | ScanResult | Complete scan result with findings + metadata | | ScanOptions | Input options (content, language, filePath, minSeverity) | | SecurityRule | Regex rule definition with OWASP/CISA/CWE mapping | | Severity | 'critical' \| 'high' \| 'medium' \| 'low' |

License

MIT