The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications that leverage Large Language Models (LLMs).
This cutting-edge solution is designed to identify security risks, performance inefficiencies, and vulnerabilities in codebases without requiring execution.
It is particularly useful for developers working on LLM-powered projects, ensuring safer and more efficient implementations of AI technologies.
Key Features
- Static Code Analysis: The scanner detects issues without executing the code, making it ideal for pre-deployment security checks.
- Specialized LLM Scanners: It identifies problems unique to LLM applications, such as hallucination triggers, bias potential, prompt injection vulnerabilities, and inefficient usage patterns.
- Multi-format Support: It supports Python files and Jupyter notebooks (.ipynb), catering to diverse development workflows.
- Flexible Reporting: Results can be displayed in human-readable console outputs or exported as structured JSON for integration into other tools.
To install Kereva Scanner:
- Clone the repository:
git clone https://github.com/rbitr/kereva-scanner.git - Navigate to the directory and install dependencies:
pip install -r requirements.txt
You can run scans on individual files, Jupyter notebooks, or entire directories using simple commands:
- Scan a file:
python main.py path/to/file.py - Scan a directory:
python main.py path/to/directory - Generate JSON reports:
python main.py --json --json-dir reports
Advanced options include listing available scanners (--list_scans), running specific scanners (--scans prompt.subjective_terms), and enabling comprehensive logging (--comprehensive --log-dir logs).
Kereva Scanner offers specialized modules:
- Prompt Scanners: Detect issues like improper XML tag usage and inefficient caching patterns.
- Chain Scanners: Identify vulnerabilities in user input handling and LangChain-specific risks.
- Output Scanners: Highlight unsafe code execution risks and validate output constraints.
The tool is invaluable for:
- Security audits to prevent vulnerabilities.
- Quality assurance to optimize LLM usage patterns.
- Developer education on best practices for prompt engineering.
- CI/CD integration for automated security checks in deployment pipelines.
With its robust features and flexible reporting formats, Kereva LLM Code Scanner empowers developers to build secure, efficient, and reliable Python applications powered by LLMs.
