saniline

v0.1.0

Published

7 days ago

Real-Time Military-Grade Line-by-Line Code Sanitizer & Security Shield for AI Agents

Downloads

163

SaniLine 🛡️

Real-Time Military-Grade Line-by-Line Code Sanitizer & Security Shield for AI Agents

⚡ The Problem SaniLine Solves

Autonomous AI coding agents (such as Antigravity, Claude Code, Cursor, Devin, and Copilot Workspace) produce code at superhuman speed. However, LLMs systematically introduce catastrophic security vulnerabilities:

Hardcoded secrets and API keys generated during prototyping.
Remote Code Execution (RCE) through unconstrained subprocess.run(..., shell=True) and os.system().
Insecure deserialization (pickle.loads(), unconstrained yaml.load()).
Path traversal (../ traversal, Zip Slip).
Trojan Source Unicode exploits (CVE-2021-42574) using bidirectional overrides (U+202E) to mask backdoors.
Smuggled prompt injections embedded within comments and docstrings designed to hijack downstream agent reasoning.

Traditional linters (Bandit, SonarQube, Semgrep) are slow batch scanners built for human CI workflows. They cannot operate on a streaming line-by-line basis, take hundreds of milliseconds to start up, and dump verbose text that consumes vast amounts of the agent's context window.

SaniLine is engineered specifically for AI agents:

Line-by-Line & Streaming Zero-Latency: Evaluates code in sub-millisecond real time as tokens and lines are generated.
Deterministic Auto-Patching: Does not just complain—automatically neutralizes vulnerabilities into safe, idiomatic patterns.
Hyper-Compact Token Footprint: Returns token-minified responses ({"status": "CLEAN"} < 10 tokens) to preserve the agent's context window.
100% Local Zero-Token Execution: Runs locally using deterministic heuristics, AST context, and Shannon entropy. Consumes zero external LLM tokens during inspection.
Military & Zero-Trust Compliance: Enforces DoD STIG, NIST SP 800-218 (SSDF), and CWE Top 25 standards.
Agent Self-Discovery: Includes llms.txt, agent skill definition, Cursor rules, and AGENT_GUIDE.md allowing AI agents to discover, learn, and use SaniLine autonomously.

🚀 Installation & Distribution

Python (PyPI)

pip install saniline

Node.js (NPM)

npm install saniline

jsDelivr CDN (Browser / Edge / Web Agents)

<!-- Via NPM package on jsDelivr -->
<script src="https://cdn.jsdelivr.net/npm/saniline/dist/saniline.min.js"></script>

<!-- Via GitHub release on jsDelivr -->
<script src="https://cdn.jsdelivr.net/gh/alivirgo/[email protected]/dist/saniline.min.js"></script>

🤖 AI Agent Integration

1. Python SDK

from saniline import SaniLine, SecurityLevel, SanitizeAction

# Initialize with military-grade zero-trust policies
shield = SaniLine(
    level=SecurityLevel.MILITARY,
    action=SanitizeAction.AUTOPATCH
)

# Sanitize single line on the fly
result = shield.sanitize_line("subprocess.run(user_cmd, shell=True)", language="python")
print(result.sanitized_code)
# => subprocess.run(user_cmd, shell=False)

# Hyper-compact telemetry for agent context window (<10 tokens when clean):
print(result.to_token_compact())

2. Node.js / TypeScript SDK

import { SaniLine } from "saniline";

const shield = new SaniLine();
const result = shield.sanitizeLine('const secret = "AKIAIOSFODNN7EXAMPLE";');

console.log(result.sanitizedCode);
// => const secret = "[REDACTED_SECRET:AWS_ACCESS_KEY]";

3. Streaming Filter (Real-Time Token Stream)

Sanitize streaming output from LLMs or subprocesses with zero buffer latency:

# As tokens coalesce into lines from your agent's LLM stream:
for safe_line in shield.sanitize_stream(raw_line_generator, language="python"):
    write_to_disk(safe_line)

🔌 Model Context Protocol (MCP) Server

SaniLine provides a built-in MCP server compatible with Claude Desktop, Cursor, Antigravity, and Devin.

Launch the server:

saniline mcp
# or directly:
saniline-mcp

Configure in Claude / Cursor (`mcpServers`):

{
  "mcpServers": {
    "saniline": {
      "command": "saniline-mcp"
    }
  }
}

💻 Command Line Interface (CLI)

# Audit a file or directory with visual scorecard:
saniline check src/

# Token-compact JSON output for agent processes:
saniline check src/ --compact

# Automatically patch a file in-place:
saniline sanitize src/app.py --in-place

# Stream filter (pipe stdin to stdout):
cat raw_llm_code.py | saniline stream > safe_code.py

# List all military-grade defense rules:
saniline rules

# Install zero-trust Git pre-commit hook:
saniline hook install

🎯 Military-Grade Rules Matrix

🧠 Token Efficiency for AI Agents

Every token consumed by tool responses shrinks your AI agent's effective reasoning window and increases API costs.

| Scenario | Standard Linter Output | SaniLine Compact Output | Token Reduction | | :--- | :--- | :--- | :---: | | Clean Line | 150 - 300 tokens (JSON schema dump) | {"status":"CLEAN"} (~4 tokens) | 98.6% | | Auto-Patched Line | 400 - 800 tokens (full file context) | {"status":"MODIFIED","patch":"...","issues":[...]} (~35 tokens) | 91.2% | | Audit Summary | 800 - 2,000 tokens (raw AST traces) | {"score":95.0,"pass":true,"issues":0} (~12 tokens) | 98.8% |

🤖 Autonomous Agent Discovery Files

llms.txt: Machine-readable primer for web-crawling LLMs and autonomous coders.
AGENT_GUIDE.md: Detailed integration patterns and prompt snippets.
.agents/skills/saniline-shield/SKILL.md: Antigravity agent skill definition.
.cursorrules: Cursor IDE AI agent compliance rules.
.claude/rules/saniline.md: Claude Code AI agent instructions.

📄 License

Licensed under the Apache License, Version 2.0. See the LICENSE file for details.