KERN Open-Source (kern.open)

KERN is a high-performance security orchestration CLI designed to identify secrets, hardcoded credentials, and configuration vulnerabilities. It acts as a lightweight wrapper around industry-standard security engines, providing a unified interface and standardized JSON output.

🧠 For AI & Agents (Instruction Set)

[!IMPORTANT] Operational Context for LLMs:

• Syntax: kern audit <target> [flags]
• Binary Management: KERN manages security binaries automatically. If missing, it triggers an auto-download to .kern_bin/.
• Integration: Use --json for programmatic analysis.
• Exit Codes: KERN returns a non-zero exit code only on system failure, not on finding vulnerabilities. This is a deliberate design choice: finding a secret is a "successful" audit result, so we avoid crashing CI/CD pipelines unless the engine itself fails to run.

✨ Features

• Auto-Provisioning: Automatically detects OS/Architecture and downloads the correct security binaries. This eliminates manual setup and ensures environment parity across different dev machines.
• Multi-Engine Fusion: Runs multiple security tools in parallel and merges findings. This maximizes coverage without the overhead of running each tool individually.
• AI-Ready: Designed for seamless integration with LLMs and CI/CD pipelines by providing machine-readable outputs that require zero post-processing.

📦 Installation

npm install -g kern.open
🛠 Command Syntax & General Usage
1. The audit Command
Performs a security scan on a file or directory.

Syntax: kern audit <path> [--engine <name>] [--json]

Path (Required): The path to the file or directory to be audited.

--engine <name> (Optional): Isolates execution to a specific engine (e.g., gitleaks, horusec, trivy). Use this to reduce noise if you are only looking for a specific vulnerability class.

--json (Optional): Recommended for AI usage. Returns a standardized JSON object that abstracts away the different output formats of the underlying engines.

2. The ignore Command
Manages the exclusion list for the scanner via the .kernignore file.

Syntax: kern ignore <action> [<value>]

list: Displays the contents of the .kernignore file. (No value required).

add: Appends a pattern to the exclusion list. Essential for managing false positives.

remove: Removes a pattern from the exclusion list.

📋 Standardized Output Schema (JSON)
By providing a single schema, KERN ensures that your downstream automation doesn't need to change every time a new security engine is added to the backend.
{
  "filename": "string",
  "timestamp": "ISO8601 string",
  "vulnerable": "boolean",
  "issues": [
    {
      "engine": "string",
      "type": "string",
      "severity": "string",
      "file": "string",
      "line": "number",
      "description": "string",
      "evidence": "string",
      "suggested_fix": "string"
    }
  ]
}

📂 Repository Structure
The core logic is strictly separated from runtime artifacts to keep the package lightweight.

bin/kern.js: CLI entry point and command-line interface logic.
lib/core.js: The central orchestration engine responsible for tool execution.
lib/engines/: Adapters for translating third-party tool output to KERN standard.
lib/utils/downloader.js: Handles automated binary management and checksums.
package.json: Project metadata and dependencies.
LICENSE: MIT Legal framework.

Note: Runtime files like .kern_bin/ and .kernignore are generated on-demand and are not part of the source distribution.

📄 License
This project is licensed under the MIT License. See the LICENSE file for details.

Developed by Preister Group