Aristotheles/coding-security-protocol-skill-cli

> **Türkçe tam dokümantasyon: README.tr.md** · English documentation
**A security protocol and agent skill for use during software development with Claude Code, Codex and Antigravity.**
**Claude Code, Codex ve Antigravity ile kodlama sırasında kullanılan bir güvenlik protokolü ve ajan skill’i.**
English · Türkçe · Support / Destek · Social / Sosyal medya
Developed by **Aristotheles / Vibe Hoca**.
**Aristotheles / Vibe Hoca** tarafından geliştirilmektedir.
---
English
Contents
- Overview and architecture
- Installation and doctor
- CLI workflows
- Configuration and policies
- Optional AI providers
- Storage and lifecycle
- Tests, milestones and limitations
- Documentation and contributions
- Agent skill and token cost
- Support
Overview and architecture
Coding Security Protocol is a security protocol for use while developing applications. It includes an agent skill that Claude Code, Codex and Antigravity can each use independently, and a Python CLI that runs security controls. The workflow checks code changes through scanning, tests, verification and policy evaluation.
The CLI turns scanner output into traceable security findings, evaluates explicit policies and requires deterministic verification before findings can close. It remains usable with **no AI providers configured**. Installing the skill alone does not configure a project or guarantee security; the required setup and verification still apply.
It provides environment diagnostics, real Semgrep/Trivy execution, retained raw evidence, SARIF normalization, stable fingerprints, deduplication and persistent SEC-XXXX IDs. YAML policy gates, tests/rescans/runtime evidence and optional AI proposals share auditable finding history.
**Status:** all seven MVP milestones, M0–M6, have completed implementation and acceptance. This is an implemented MVP with the limitations documented below. Deliberately vulnerable **test fixtures with fake credentials** remain in the repository. Findings and blocked gates against them are expected; they are not clean security results.
The core uses Python, PyYAML, jsonschema and standard-library SQLite. Scanners and optional AI CLIs run as external processes. No web framework or hosted AI SDK is required.
The operator reviews and applies patches; AI does not apply them. Closure is a separate explicit core operation.
- **Fail closed:** bad config, malformed output, missing evidence and tool failures never become successful security checks.
- **Evidence before closure:** AI opinion, absence on a later scan and database-only status changes cannot close findings.
- **Canonical JSON first:** JSON is authoritative; SQLite is rebuildable. Every connection enables PRAGMA foreign_keys = ON.
- **Controlled subprocesses:** argv lists, timeouts and separate tool-error reporting; no shell=True scanner execution.
- **Protected contracts:** AI remediation cannot rewrite policies, schemas, agent instructions or config.
- **Human authority:** advisory AI approval cannot replace required human review, secret rotation confirmation or deterministic verification.
- **UTC audit:** operational events use UTC ISO-8601 timestamps.
Installation and doctor
| Component | Requirement / verified environment |
| --- | --- |
| Python | Python 3.11+ within Python 3; tested on Windows/Python 3.14.5 |
| Packages | PyYAML==6.0.3, jsonschema==4.26.0 in requirements.txt |
| Semgrep | Native executable; verified with 1.180.0 |
| Trivy | Native executable; verified with 0.75.0 |
| Git | Required for AI diff dry-run validation |
| AI | Optional; default provider list is empty |
Verified versions describe the recorded acceptance environment, not a guarantee for every platform/version.
Windows / PowerShell
1. Obtain the public repository and open PowerShell in its root: GitHub repository.
2. Install the Python dependencies:
3. Install Semgrep and native Windows Trivy. Config expects semgrep on PATH and Trivy at .tools/trivy/trivy.exe. Binaries are local, Git-ignored and not distributed in this repository. Use the official Semgrep documentation and Trivy installation guide; verify published checksums for release downloads.
4. Add the launcher to this session and run the actual checks:
PATH changes only for this session. Equivalent invocation without adding the launcher:
The Python entry point is available on other platforms; their acceptance has not been verified here. Adjust executable paths. Scanner/test/runtime adapters require native executables; .cmd/.bat adapter programs are rejected.