CodeCrucible
https://github.com/block/codecrucible- Category
- Cybersecurity
- Rank
- No. 1394Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- block
- GitHub
- 115 stars
- Date
About
Go CLI tool that analyses Git repositories for security vulnerabilities using LLM-based analysis.
What it does
CodeCrucible turns a repository into a staged security assessment. It selects relevant files, estimates prompt size, splits large inputs, detects security-related features, asks configured models for structured findings, then audits those findings. Results arrive as SARIF for code-scanning workflows, with intermediate artifacts available for investigation.
Why it's ranked here
The design addresses several practical failure modes of model-driven scanning: oversized repositories, malformed responses, transient provider errors, duplicate findings, and uncertain first-pass results. Provider choice per phase and a dedicated audit pass make it unusually configurable. Its conclusions still depend on model output and estimated token budgets, so results require engineering judgment.
What's good
It produces schema-valid SARIF even when model calls partially fail, preserving failure notifications instead of discarding the run. Structured-output enforcement and JSON repair reduce formatting breakage. Cost ceilings, dry runs, selective paths, filtering, concurrency controls, and phase-specific models give operators useful control over scope, spend, and latency.
Tradeoffs
Real scan cost can exceed the dry-run estimate because that estimate excludes completion tokens from analysis, repair, and audit. Token counts use a content-aware character heuristic rather than exact model tokenization. Tests and documentation are excluded unless requested. Several phase-specific options are intentionally hidden from standard help, increasing reliance on documentation.
How to use it well
Use it for repository security triage when your team already reviews SARIF and can validate model-generated findings. Start with a dry run, narrow monorepo paths, set a cost ceiling, then retain the audit phase and inspect its artifacts. It does not provide a complete final-cost forecast, because dry runs estimate input tokens only.
Technical notes+
The Go 1.23 module in go.mod uses Cobra and Viper for the CLI and configuration. internal/cli/scan.go defines staged provider overrides, cost and scope controls, audit gates, and SARIF output. internal/llm/client.go implements HTTP retries, backoff, structured-output modes, streaming timing, and adaptive request compatibility. internal/llm/repair.go repairs common malformed model responses, while internal/llm/schema.go defines strict analysis, feature-detection, and audit schemas. internal/chunk/token.go uses heuristic token counting. internal/sarif/merge.go deduplicates merged rules and findings while preserving failure notifications. internal/cli/cli_test.go exercises command help, flags, dry runs, malformed configuration, and version output.
Observed
- Primary language
- Go
- Interface
- Command-line application
- Packaging
- Single binary built from source, with a distroless Docker image option
- Output format
- SARIF v2.1.0 for GitHub Code Scanning and compatible workflows
- Provider surface
- Anthropic, OpenAI, Google, Ollama, OpenAI-compatible endpoints, and Databricks
- Configuration
- CLI flags, environment variables, and YAML configuration with per-phase overrides
- Testing
- Repository text includes Go CLI tests and Make targets for race-enabled tests, coverage, linting, formatting, and vetting
Read from README.md, go.mod, Makefile, internal/cli/init.go, internal/cli/root.go, internal/cli/scan.go, internal/llm/client.go, internal/llm/prompt.go, internal/llm/repair.go, internal/llm/schema.go, internal/chunk/token.go, internal/sarif/merge.go, internal/sarif/types.go, internal/supctx/pack.go, internal/cli/cli_test.go.
What it can do
Analyze Git repository for security vulnerabilities
Git repository → Security vulnerability report
Scan source code for security issues using LLM analysis
Source code files → LLM-generated security assessment
Execute security analysis from command line
CLI commands and repository path → Terminal-based vulnerability findings
Process Git commit history for security patterns
Git commit data → Historical security analysis report
Generate security recommendations using AI
Identified vulnerabilities → AI-powered remediation suggestions
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.