moyan-security-audit

Agent-native security audit SDK for Node.js — send source code to the Moyan audit engine and receive structured vulnerability reports with PMI trust scoring.

Installation

npm install moyan-security-audit

Prerequisites

Set your API key via one of:

1. Environment variable:

   export MOYAN_API_KEY="your-api-key"

2. Config file ~/.moyan/config.json:

   { "apiKey": "your-api-key" }

If neither is set, the SDK throws a descriptive error.

Usage

CommonJS

const { audit } = require('moyan-security-audit');

async function main() {
  const result = await audit({
    code: 'SELECT * FROM users WHERE id = ' + userId,
    language: 'sql',
    auditLevel: 'L2',
    timeout: 30000,
    retries: 2,
  });

  console.log(`PMI Score: ${result.pmi_score}`);
  console.log(`Severity: ${result.severity}`);
  console.log(`Violations: ${result.violations.length}`);
  console.log(`Recommendation: ${result.recommendation}`);
}

main();

ESM / TypeScript

import { audit, AuditOptions, AuditResult } from 'moyan-security-audit';

const opts: AuditOptions = {
  code: `const query = "SELECT * FROM users WHERE id = " + userId;`,
  language: 'javascript',
  auditLevel: 'L1',
};

const result: AuditResult = await audit(opts);
console.log(result);

API Reference

audit(options: AuditOptions): Promise<AuditResult>

| Parameter | Type | Required | Default | Description | |---|---|---|---|---| | code | string | Yes | — | Source code to audit | | language | AuditLanguage | Yes | — | One of: sql, python, javascript, typescript, java, go, rust, solidity | | auditLevel | AuditLevel | No | 'L1' | L1 (quick scan), L2 (deep analysis), L3 (full audit) | | timeout | number | No | 30000 | Request timeout in ms | | retries | number | No | 2 | Retry count with exponential backoff (1s, 2s, 4s, ...) |

AuditResult

| Field | Type | Description | |---|---|---| | audit_id | string | Unique identifier for this audit run | | pmi_score | number | PMI trust score (0-100) | | severity | 'pass' \| 'warn' \| 'fail' | Overall verdict | | violations | AuditViolation[] | Detected rule violations | | recommendation | string | High-level remediation guidance |

AuditViolation

| Field | Type | Description | |---|---|---| | rule_id | string | Rule identifier (e.g. SQLI-001) | | severity | 'critical' \| 'high' \| 'medium' \| 'low' \| 'info' | Violation severity | | message | string | Human-readable description | | line | number | Source line number (1-based) | | snippet | string | Violating code snippet | | fix | string | Suggested remediation |

API Endpoint

All audit requests are sent to:

POST https://api.sixu-ai.net.cn/api/v1/audit
Authorization: Bearer <MOYAN_API_KEY>
Content-Type: application/json

{ "code": "...", "language": "sql", "audit_level": "L2" }

License

MIT