hunteros

Repository intelligence platform for white-box security research, architecture analysis, and AI-assisted code review.

work in progress — monorepo scaffolded with 22 packages, 3 apps, and 9 security rule packs. Core rule packs (Express, GraphQL, JWT, Auth, Database, Filesystem) are already in rules/.

---

What it does

HunterOS ingests a repository and turns it into a map an AI (and a human) can reason over:

• Scan & parse — repository indexing, AST parsing, dependency and lockfile analysis.
• Detect & audit — vulnerability detectors, dependency audits, and config audits (Docker, CI/CD, K8s, nginx, Apache, env files, package.json, lockfiles).
• Architecture view — builds a dependency graph of the codebase for architecture analysis.
• Assisted review — surfaces findings to the CLI, API, or dashboard with AI reasoning hooks.

Packages

Package	Purpose
@hunteros/core	Core engine
@hunteros/cli	Command-line interface
@hunteros/dashboard	Web dashboard
@hunteros/scanner	Repository scanning
@hunteros/parser	Indexing & parsing
@hunteros/ast	AST utilities
@hunteros/analyzers	Static analyzers
@hunteros/detectors	Vulnerability detectors
@hunteros/repository	Repo model & state
@hunteros/graph	Dependency graph
@hunteros/config-audit	Docker / CI/CD / K8s / env config checks
@hunteros/dependency-audit	Lockfile & dependency checks
@hunteros/environment	OS / toolchain / runtime detection
@hunteros/ai	AI-assisted analysis & review
@hunteros/reports	Report generation
@hunteros/telemetry	Telemetry

Plus core, cache, framework-detectors, plugins, tools, logger, shared, config.

Rule packs (rules/)

Signed & versioned security rule packs shipped separately from the engine:

• Auth, Custom, Database, Express, Filesystem, GraphQL, JWT, API, …

Getting started

pnpm install
pnpm dev        # turbo dev
pnpm test       # vitest across packages
pnpm lint       # biome check .
pnpm typecheck  # turbo typecheck

Contributing

See CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SECURITY.md. Releases use Changesets.

License

MIT