Huldra

Huldra is an automated vulnerability remediation tool designed to streamline the security auditing process. It leverages existing audit tools to identify vulnerabilities in language dependencies and uses an LLM orchestrator to intelligently suggest and apply fixes.

Features

• Automated Auditing: Uses pip-audit to scan Python dependencies for known vulnerabilities.
• Intelligent Remediation: Integrates with TensorZero (LLM Orchestrator) to analyze vulnerability reports and generate context-aware fix recommendations.
• Auto-Fix: Capable of automatically applying recommended fixes (e.g., upgrading packages) via the CLI.
• Extensible Architecture: Designed with a modular provider system to support multiple languages and audit tools in the future.

Components

Huldra consists of three main components:

1. Provider: Interfaces with language-specific audit tools (e.g., pip-audit for Python) to detect vulnerabilities and apply fixes.
2. Orchestrator: Connects to an LLM service (currently TensorZero) to interpret vulnerability data and propose solutions.
3. Healer: The core logic that coordinates the Provider and Orchestrator to execute the "audit -> analyze -> fix" workflow.

Installation

Huldra requires Python 3.11 or higher.

# Clone the repository
git clone https://github.com/Okwizi/Huldra.git
cd Huldra

# Create a virtual environment and install dependencies using uv
uv venv
source .venv/bin/activate
uv pip install .

Usage

Huldra provides a command-line interface (CLI) for easy interaction.

Run an Audit and Apply Fixes

To run a full audit and interactively apply fixes:

huldra-cli

Run Audit Only

To perform an audit without applying any fixes:

huldra-cli --audit-only

Development

This project uses uv for dependency management and tox for testing and linting.

Setting up the Environment

# Install uv if you haven't already
curl -LsSf https://astral.sh/uv/install.sh | sh

# Install dependencies
uv sync

Running Tests

# Run tests using tox
uvx tox -e test

Linting and Type Checking

# Run linting and type checking
uvx tox -e lint

License

This project is licensed under the Apache-2.0 License. See the LICENSE file for details.