Qwen Code S-Edition

AI coding agent with built-in security scanning and architecture analysis

Qwen Code S-Edition is a fork of QwenLM/qwen-code enhanced with two powerful security modules:

• Security Scanner — powered by supreme-max, with Qwen LLM false-positive verification

Features

• 🛡️ Security Scan — finds vulnerabilities in code and dependencies, verifies results with Qwen LLM to eliminate false positives
• 🗺️ Architecture Scan — builds a knowledge graph of your project, identifies architectural vulnerabilities (broken trust boundaries, missing auth, data exposure, SPOF)
• 🔑 Free via Qwen OAuth — 1000 requests/day with your qwen.ai account
• 📊 Dual HTML Reports — verified report + raw report for full transparency
• 🖥️ Interactive Graph — D3.js visualization with fullscreen mode, color-coded layers, vulnerability highlighting

Installation

npm install -g qwen-code-s-edition

Graph analyzer installs automatically on first run.

Quick Start

# Security scan
qwen-s scan security --path ./your-project

# Architecture scan (requires Qwen Code session for UA analysis)
qwen-s scan arch --path ./your-project

# Launch interactive graph dashboard
qwen-s dashboard --path ./your-project

Authentication

# Free: use your qwen.ai account (1000 req/day)
qwen auth   # inside Qwen Code session

# Paid: Alibaba Cloud API key
export DASHSCOPE_API_KEY="sk-..."

Slash Commands (inside Qwen Code session)

/scan-security   — run security scan on current project
/scan-arch       — run architecture scan with knowledge graph
/scan-full       — run both scans

CLI Reference

qwen-s scan security [--path] [--no-verify] [--verify-all] [--min-severity]
qwen-s scan arch     [--path] [--skip-ua] [--no-llm]
qwen-s install-ua    — install Graph analyzer
qwen-s dashboard     [--path] — launch interactive graph

How It Works

Security Scan Pipeline

supreme-max scan → JSON findings
        ↓
Qwen LLM verification (false-positive filter)
        ↓
Verified HTML report + Raw HTML report

Architecture Scan Pipeline

Graph analyzer → knowledge-graph.json (nodes + edges)
        ↓
Security metadata enrichment
        ↓
Qwen architectural vulnerability analysis
        ↓
Interactive D3 graph + vulnerability report

Based On

• QwenLM/qwen-code — Apache 2.0
• supreme-max — PyPI

Repository

github.com/mqw011/qwen-code-s