@ophan/core

The analysis engine behind Ophan — AI-powered security analysis and documentation for codebases.

This package provides the core analysis pipeline: source code parsing, function extraction, Claude-powered security analysis, and local SQLite storage. Used by @ophan/cli and the Ophan VS Code extension.

What It Does

• Parses source code using language-native ASTs (TypeScript compiler API, Python's ast module)
• Extracts functions and computes SHA256 content hashes for change detection
• Analyzes with Claude to detect security vulnerabilities and generate documentation
• Stores results in a local SQLite database, keyed by content hash

Security Detection

Identifies vulnerabilities including SQL injection, XSS, hardcoded secrets, path traversal, insecure deserialization, and unsanitized user input.

Data Flow Classification

Tags functions by the data they handle: user input, PII, credentials, database operations, external APIs, file system access, and more.

Auto-Documentation

Generates plain-English descriptions, parameter documentation, and return type documentation for every function.

Supported Languages

| Language | Parser | Extensions | |----------|--------|------------| | TypeScript | TypeScript compiler API | .ts, .tsx | | JavaScript | TypeScript compiler API | .js, .jsx | | Python | Python ast module | .py |

Usage

Most users should use @ophan/cli or the VS Code extension instead of importing this package directly.

@ophan/core is published for tools that need to build on the Ophan analysis pipeline programmatically.

import { analyzeRepository, initDb } from '@ophan/core';

const db = initDb('/path/to/repo');
await analyzeRepository(db, '/path/to/repo', {
  apiKey: process.env.ANTHROPIC_API_KEY,
});

Schemas

Zod schemas and TypeScript types for Ophan's analysis data are available as a lightweight subpath import — no native dependencies required:

import {
  ClaudeAnalysisResponse,
  SECURITY_FLAG_LABELS,
  DATA_TAG_LABELS,
} from '@ophan/core/schemas';

Resources

• Documentation
• CLI Package
• VS Code Extension
• GitHub

License

MIT