Internal Tool

Aegis

Shift security left. Catch it all.

Explore Features

Features

Seven Scanners. One Dashboard. Zero Third-Party Tenants.

Snyk and Mend charge $25–50 per developer per month and ship your findings to a third-party cloud. Aegis runs entirely inside the Renkara perimeter — wrapping Semgrep, Bandit, pip-audit, Safety, detect-secrets, Checkov, and Trivy under one fleet-native FastAPI backend and a WebSocket-driven React dashboard. Every scanner normalizes to a single Finding schema with severity, CWE identifier, source location, fix guidance, and a content-addressable dedup hash so re-scanning the same code never creates duplicate rows. New HIGH and CRITICAL findings auto-open Docket cards on the responsible team’s board. A nightly advisory sync mirrors GitHub Advisory and OSV into Postgres so SCA lookups never call home at scan time. From push to triaged defect: under two minutes.

ReplacesSnyk, Semgrep Cloud, GitHub Advanced Security, Checkov Cloud (Prisma Cloud)

Scanner Stack

Best-in-Class Open Source, Unified Under One API

  • Semgrep — Multi-Language SAST

    Semgrep runs pinned rule snapshots from backend/rules/semgrep/ against every language in the fleet. Rules never pull from the network at scan time — supply-chain hygiene is enforced at the scanner level, not as an afterthought.

  • Bandit — Python-Specific SAST

    Bandit catches Python-specific vulnerabilities — SQL injection via string formatting, insecure subprocess calls, hardcoded passwords, weak cryptography — with AST-level precision that generic SAST misses.

  • pip-audit & Safety — Python SCA

    Two complementary dependency scanners: pip-audit queries the OSV mirror (--vulnerability-service=osv, no PyPI calls) while Safety cross-references its own advisory database. Both scanners normalize CVE severity and fix versions into the unified Finding schema.

  • detect-secrets — Secrets Scanner

    Detects hardcoded API keys, tokens, private keys, and high-entropy strings across every file in the repository. Findings include the file path, line number, and secret type — never the secret value itself.

  • Checkov — IaC Scanner

    Scans Terraform, CloudFormation, Kubernetes manifests, and Dockerfiles for misconfigurations — public S3 buckets, open security groups, missing encryption-at-rest, root container execution — with CWE and severity mapped to the unified schema.

  • Trivy — Container & Filesystem Scanner

    Trivy is the Go binary exception in an otherwise Python stack, pinned via ARG TRIVY_VERSION in the Dockerfile from a versioned release tarball (not the floating apt repo). Scans container images and filesystem paths for OS and library CVEs, exposed secrets, and IaC misconfigurations.

  • Sandboxed Subprocess Execution

    Every scanner runs as a non-root user inside a per-scan tmpfs working directory with no network egress except to the local advisory mirror. Output is parsed from JSON stdout; the scanner process state is never trusted. A compromised rule cannot escape the scan boundary.

Findings Model

One Schema to Rule All Seven Scanners

  • Unified Finding Schema

    Every scanner normalizes to a single Finding: scanner, rule_id, severity (CRITICAL / HIGH / MEDIUM / LOW / INFO), cwe, file_path, line_range, code_context, fix_guidance, and dedup_hash. The triage dashboard, Docket integration, and MCP tools all speak this one type.

  • Content-Addressable Deduplication

    The dedup hash is sha256(scanner | rule_id | file_path | normalized_code_context | severity). Re-scanning the same code never creates duplicate finding rows — the existing row is updated in place and its status is preserved. Sprint-over-sprint false-positive noise is eliminated at the data layer.

  • Finding Lifecycle & Audit Trail

    Every finding transitions through open → in_progress → resolved (or suppressed). Every status change is recorded as a finding_event with actor, timestamp, and optional note. The full audit trail is queryable via the dashboard and MCP tools.

  • Severity & CWE Mapping

    Severity is normalized to a common five-level scale regardless of source scanner. CWE identifiers are mapped where the scanner provides them (Semgrep, Bandit, Checkov) and inferred from rule metadata where they don’t. Findings are filterable and sortable by both dimensions.

  • Suppression with Expiry

    Risk-accept a finding with a written justification, an approver, and a mandatory expiration date. Expired suppressions automatically reopen to open status. Every suppression and re-open is recorded in the audit trail — no finding ever silently disappears.

Vulnerability Database

Local Mirror, Sub-Second Lookups, No Calls Home

  • GitHub Advisory + OSV Nightly Sync

    A nightly cron job syncs the full GitHub Advisory Database and OSV (Open Source Vulnerabilities) corpus into the local Postgres instance. SCA scanners look up CVE → severity → fix version entirely locally. No per-scan calls to external APIs — air-gapped scans work the same day as networked ones.

  • Sub-Second Advisory Lookups

    The local advisory tables are indexed on package name, ecosystem, and CVE ID. A full Python dependency tree lookup across hundreds of packages completes in under 50 ms. There is no spinner waiting for a third-party SCA API to respond.

  • SBOM Export (CycloneDX 1.5)

    Export a CycloneDX 1.5 software bill of materials for any registered repo via GET /api/v1/repos/{id}/sbom?format=cyclonedx. SBOMs are generated from the most recent SCA scan results and the live advisory table, so every component entry includes its current CVE status.

Fleet Integrations

Docket, GitHub, Vigil — Wired at the Finding Level

  • Auto-Filed Docket Defects

    When a scan surfaces a new HIGH or CRITICAL finding, Aegis opens a Docket card on the responsible team’s board automatically — no human triage step required. The card includes scanner, rule, severity, CWE, file location, and a link back to the finding in the Aegis dashboard. A finding resolved in Aegis closes the Docket card.

  • GitHub App Integration

    Repo access runs through a GitHub App (not personal tokens). App ID and private key live in SSM; installation IDs are stored per workspace. Scans trigger automatically on push and pull request. PR scan results post as inline review comments with remediation hints directly in the diff view.

  • Per-Repo Scan Policies

    Each registered repo carries a scan policy: which of the seven scanners run, the minimum severity floor for findings (suppress INFO-only noise on low-risk repos), an allowlist of known-false-positive rule IDs, and SLA windows (HIGH must be resolved in N days). Policy evaluation runs at normalization time, before findings are persisted.

  • MCP Tool Surface

    Every Aegis operation is exposed as an MCP tool at /mcp (Streamable HTTP) with a stdio bridge for direct Claude Code registration. Register repos, trigger scans, list findings, update finding status, suppress with justification, export SBOMs, and query the vulnerability database — all from a Claude Code agent or any MCP-compatible client.

Triage Dashboard

Real-Time Severity Heatmaps, Repo Leaderboards, Trend Lines

  • WebSocket-Driven Status Board

    The React dashboard opens a WebSocket to the backend. Scan progress streams in real time — per-scanner status, finding counts as they land, completion events. No polling, no manual refresh. A scan started from the dashboard or a GitHub push event is visible on-screen within seconds.

  • Severity Heatmaps

    Fleet-wide and per-repo severity heatmaps show the distribution of CRITICAL / HIGH / MEDIUM / LOW / INFO findings over time. Spot which repos are trending worse and which remediation sprints are actually moving the needle.

  • Repo Leaderboards

    Repos ranked by total open HIGH+CRITICAL count, by findings-per-KLOC, and by mean-time-to-resolve. The leaderboard surfaces the highest-risk repos in the fleet without requiring anyone to manually aggregate scanner output.

  • Finding Detail & Inline Triage

    Each finding opens a detail view with full code context, CWE description, fix guidance from the scanner, CVE advisories from the local mirror, and the full status history. Triage actions — assign, transition status, suppress with justification — execute without leaving the finding page.

  • Light & Dark Mode

    Full CSS custom-property theming with light, dark, and system modes. Severity badges, heatmap cells, and status indicators maintain WCAG 2.1 AA contrast ratios in both themes. The dashboard is usable on a laptop at 2 AM without eye strain.

Infrastructure

Self-Hosted, Fleet-Native, No Third-Party Tenant

  • Worker Pool & NATS JetStream

    Scan requests enqueue NATS jobs under the aegis.scan.* subject prefix. A dedicated worker pool pulls jobs, fans out to per-scanner subprocesses, normalizes results, persists findings with dedup-aware upserts, and publishes a completion event back over NATS for the WebSocket layer. The FastAPI request loop is never blocked.

  • Shared Fleet Infrastructure

    Aegis runs on the shared fleet stack: PostgreSQL (shared RDS, dedicated aegis database), Valkey cache with the aegis: key prefix, and NATS from tools/supporting-services/. No per-tool infrastructure to provision or maintain. New repos are registered via a single API call.

Accessibility

Built for Everyone

  • WCAG 2.1 AA Compliance

    4.5:1 contrast for body text, 3:1 for large text and UI components, in both light and dark themes.

  • Keyboard Navigation

    Every interaction reachable via keyboard. Logical tab order, visible focus indicators, Escape-to-dismiss for modals.

  • Screen Reader Support

    VoiceOver, NVDA, and JAWS tested. Semantic HTML, ARIA labels, live regions for dynamic updates.

  • Reduced Motion

    Respects prefers-reduced-motion. Usable at 200% zoom. Touch targets meet 44x44 minimum.

How It Works

From Push to Triaged Defect

  1. Step 1: Trigger

    A GitHub push or pull-request event fires the GitHub App webhook. Aegis enqueues a scan job on NATS. Manual scans are triggered via the dashboard UI or the aegis_trigger_scan MCP tool.

  2. Step 2: Scan

    A worker pulls the job, fans out to all seven scanners (Semgrep, Bandit, pip-audit, Safety, detect-secrets, Checkov, Trivy) in isolated sandboxes. Each scanner runs as a non-root subprocess in a tmpfs directory with no network egress. Output streams back as JSON.

  3. Step 3: Normalize & Persist

    Per-scanner normalizers map raw JSON to the unified Finding schema — severity, CWE, location, fix guidance, dedup hash. Findings are upserted: new findings are created; re-discovered findings update in place with status preserved. A completion event fires over NATS to the WebSocket layer.

  4. Step 4: Triage & Integrate

    New HIGH and CRITICAL findings auto-open Docket cards on the responsible team’s board. PR scans post inline review comments. The triage dashboard updates in real time — severity heatmaps, repo leaderboards, and finding queues reflect the new scan within seconds of completion.

Technical Specifications

Under the Hood

  • Backend

    • FastAPI (Python 3.12+)
    • FastMCP for the MCP tool surface (/mcp Streamable HTTP + stdio bridge)
    • SQLAlchemy 2.0 async + asyncpg
    • PostgreSQL (shared RDS, dedicated aegis database)
    • Valkey cache — prefix aegis: (shared, port 6380)
    • NATS JetStream — subject prefix aegis.scan.*
    • APScheduler for nightly advisory sync (GitHub Advisory + OSV)
    • Alembic migrations
    • structlog structured logging
    • 80% coverage gate per module; scanner integration tests run nightly against fixture repos

  • Frontend

    • React 19 + TypeScript 5.6 (strict) + Vite 8
    • Single bidirectional WebSocket — real-time scan progress and finding updates
    • @avian/design-system tokens, components, and Tailwind preset
    • @avian/auth-react 0.1.4 (OIDC via auth.renkara.com)
    • Recharts for severity heatmaps, trend lines, and repo leaderboards
    • Framer Motion 11 for transitions
    • Light and dark mode (WCAG 2.1 AA in both)

  • Scanners

    • Semgrep — multi-language SAST, pinned rule snapshots, LGPL 2.1
    • Bandit — Python SAST, AST-level, Apache 2.0
    • pip-audit — Python SCA via OSV mirror, Apache 2.0
    • Safety — Python SCA, advisory cross-reference, MIT
    • detect-secrets — secrets and high-entropy string detection, Apache 2.0
    • Checkov — IaC (Terraform / CloudFormation / K8s / Dockerfile), Apache 2.0
    • Trivy — container + filesystem CVE scan, Go binary, Apache 2.0
    • All scanners run non-root in per-scan tmpfs with no outbound network

  • Integrations

    • GitHub App (App ID + private key in SSM, installation IDs per workspace)
    • Automatic scan on push and pull request
    • Inline PR review comments with remediation hints
    • Docket — auto-filed defect cards for HIGH + CRITICAL findings
    • MCP (FastMCP) — full operation surface for Claude Code agent use
    • CycloneDX 1.5 SBOM export per repo
    • Local GitHub Advisory + OSV mirror (nightly sync, no per-scan egress)

  • Infrastructure

    • Backend pipeline: aegis (CodePipeline → CodeBuild → ECR → SSM deploy)
    • Frontend pipeline: aegis-frontend (S3 bucket: aegis-frontend-production)
    • API domain: aegis-api.renkara.com
    • Frontend domain: aegis.renkara.com
    • ECR repo: aegis
    • SSM secret prefix: /renkara/aegis/
    • Auth: mTLS via renkara-tools-alb (prod) — JWT / API key fallback

Development

100% Built by Claude

Every tool in the Renkara fleet was built by Claude (Anthropic) working alongside a single human supervisor. Every line of code, every test, every deployment: AI-authored with human direction. The leverage factor across the fleet runs in the 20x–50x range, with individual sessions regularly exceeding 100x.

See the daily leverage records for per-task numbers across the full build history.