🔒 code-validator
Static security scanner purpose-built for AI-generated code
Static security scanner purpose-built for AI-generated code
code-validator is a static security scanner purpose-built for code produced by AI assistants — Claude Code, ChatGPT, GitHub Copilot, Cursor. It detects the specific failure modes that LLMs disproportionately emit: hardcoded API keys in examples, allow_origins=["*"] with allow_credentials=True, string-concatenated SQL, and unpatched dependency CVEs.
Why this exists: AI-assisted PRs frequently land with subtle security defects that look correct at a glance. code-validator is the lightweight CI gate that catches these before they reach main — in under 1 second per file, fully offline, with zero data exfiltration.
<1s per file. --git-diff mode scans only changed files for CI.
No SaaS. No code leaves your machine. Only dep: pydantic.
11 detection rules targeting LLM-specific failure modes (SEC001–007, QUAL001, DEP001–003).
Exit code 1 on critical/high. GitHub Actions + GitLab CI examples included.
# 1. Clone
git clone https://github.com/TTMK7777/code-validator.git
cd code-validator
# 2. Install (only pydantic required)
pip install -r requirements.txt
# 3. Scan
python validator.py --git-diff
# Exits with code 1 if critical/high issues found — blocks CIpython validator.py --path . --output report.html --format html# .git/hooks/pre-commit
#!/bin/sh
python validator.py --git-diff || exit 1| Rule | Severity | Category | Detects |
|---|---|---|---|
| SEC001 | Critical | Security | Hardcoded API key |
| SEC002 | Critical | Security | Hardcoded password |
| SEC003 | Critical | Security | Hardcoded database credentials |
| SEC004 | Critical | Security | CORS wildcard + credentials enabled |
| SEC005 | High | Security | CORS wildcard origins (production risk) |
| SEC006 | High | Security | SQL injection via string concatenation |
| SEC007 | Medium | Security | Missing FastAPI security headers |
| QUAL001 | Low | Quality | Line exceeds max length |
| DEP002 | High | Deps | Python package with known CVE |
| DEP003 | Variable | Deps | Node.js package with known CVE |
| Tool | AI-code focus | Offline | Speed | Deps |
|---|---|---|---|---|
| code-validator | ✅ Purpose-built | ✅ Yes | <1s/file | ✅ pydantic only |
| Bandit | ❌ General Python | ✅ Yes | Fast | Multiple |
| Semgrep | ❌ Multi-lang patterns | ⚠️ Hybrid | Medium | Heavy |
| GitGuardian | ❌ Git secrets | ❌ SaaS | Slow (API) | SaaS |
| TruffleHog | ❌ Git secrets | ✅ Yes | Slow | Multiple |
Positioning: code-validator is the only tool in this list specifically tuned for the failure modes of AI-generated code (e.g., the CORS wildcard + credentials pattern LLMs disproportionately emit).
General-purpose linters were designed for human-written code. AI assistants exhibit specific failure modes — hardcoded example credentials, overly permissive CORS for demos, string-concat SQL because the model "remembered" pre-ORM patterns. code-validator's rule set is tuned for these patterns and weights severity accordingly.
No. The scanner runs fully offline. The only optional network call is pip-audit for CVE lookups, and that contacts only the official PyPA advisory database — never your source code.
code-validator unifies them into a single CI step with a coherent severity model and one report format (HTML / JSON / Markdown). With --git-diff mode, only files changed in the current PR are scanned, keeping CI fast.
Yes. It scans the resulting source files regardless of which AI assistant generated them. The detection patterns target the output, not the tool.
Python 3.9 or later.
Yes. Use python validator.py --git-diff in a pre-commit hook — exit code 1 blocks the commit when critical/high issues are found.
Yes — see config/validator_config.json. You can disable rule categories, change line-length thresholds, and add exclude patterns.
Built by Taimu Tsuji (辻大夢) — Founder of Tsuji Lab, Applied AI Architect specializing in multi-agent AI coordination and AI-assisted software development at scale.
allow_origins=["*"] more than once, I needed a gate that ran in <1s and didn't ship code off-box. Existing tools were either too heavy, too noisy, or required SaaS.