Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
372 lines (333 loc) · 21 KB
/
Copy pathindex.html
File metadata and controls
372 lines (333 loc) · 21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Space Proof Code (SPC) — NASA Power of Ten & AI Agent Security Analyzer</title>
<meta name="description" content="High-performance zero-dependency static analysis tool enforcing NASA Power of Ten reliability rules across 20 programming languages plus AI agent skill, MCP server config, prompt template, and LLM model configuration security auditing. Built by PuterVision.">
<meta name="keywords" content="spc, space proof code, static analysis, nasa power of ten, zero dependency, security scanner, ai agent security, mcp server, prompt injection, llm security, sarif, github code scanning, high performance, agent tools, mcp tools, ada, bash, c, cpp, csharp, elixir, fortran, go, haskell, java, javascript, julia, kotlin, lua, php, python, ruby, rust, scala, swift, zig">
<meta name="author" content="PuterVision">
<meta name="theme-color" content="#0b0f19">
<!-- Open Graph / Facebook -->
<meta property="og:type" content="website">
<meta property="og:url" content="https://putervision.com">
<meta property="og:title" content="Space Proof Code (SPC) — NASA Power of Ten & AI Agent Security Analyzer">
<meta property="og:description" content="High-performance zero-dependency static analysis tool enforcing NASA Power of Ten rules across 20 programming languages plus AI agent skill, MCP server config, prompt template, and LLM model configuration security auditing.">
<meta property="og:image" content="https://raw.githubusercontent.com/putervision/spc/refs/tags/1.5.0/assets/example_report.png">
<!-- Twitter -->
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:url" content="https://putervision.com">
<meta name="twitter:title" content="Space Proof Code (SPC)">
<meta name="twitter:description" content="High-performance zero-dependency static analysis tool enforcing NASA Power of Ten rules across 20 languages plus AI agent security auditing.">
<meta name="twitter:image" content="https://raw.githubusercontent.com/putervision/spc/refs/tags/1.5.0/assets/example_report.png">
<!-- Structured Data JSON-LD -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "Space Proof Code",
"alternateName": "SPC",
"softwareVersion": "1.5.0",
"applicationCategory": "DeveloperApplication",
"operatingSystem": "Linux, macOS, Windows",
"license": "https://opensource.org/licenses/MIT",
"downloadUrl": "https://www.npmjs.com/package/@putervision/spc",
"offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD" },
"author": {
"@type": "Organization",
"name": "PuterVision",
"url": "https://putervision.com"
},
"featureList": [
"NASA Power of Ten Rule Enforcement across 20 Languages",
"AI Agent Skill & Prompt Injection Security Auditing",
"MCP Server Configuration & Wildcard Permission Auditing",
"LLM Model Config & Pickle Deserialization Risk Scanning",
"SARIF v2.1.0 Output for GitHub Code Scanning Security Alerts",
"Zero-Dependency Local-First Static Analysis Engine"
]
}
</script>
<!-- Favicon -->
<link rel="icon" type="image/png" href="spc-icon.png">
<link rel="shortcut icon" href="favicon.ico">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Outfit:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="glow-backdrop"></div>
<div class="glow-backdrop-2"></div>
<header>
<div class="logo">
<a href="https://putervision.com" target="_blank" rel="noopener noreferrer" class="brand-link">
<img src="putervision-icon.png" alt="PuterVision Icon" class="nav-brand-img"> PuterVision
</a>
<span class="logo-sep">/</span>
<a href="https://github.com/putervision/spc" class="logo-link">
<img src="spc-icon.png" alt="SPC Icon" class="nav-brand-img">
<span class="logo-text">spc</span>
</a>
</div>
<nav aria-label="Main Navigation">
<ul class="nav-links">
<li><a href="#features">Features</a></li>
<li><a href="#agent-scanner">AI Agent Scanner</a></li>
<li><a href="#languages">20 Languages</a></li>
<li><a href="#rule-explorer">Rule Explorer</a></li>
<li><a href="#quickstart">Quickstart</a></li>
<li><a href="#security">Security & Legal</a></li>
</ul>
</nav>
<a href="https://github.com/putervision/spc" class="btn-github" target="_blank" rel="noopener noreferrer" aria-label="Star on GitHub">
<svg height="16" width="16" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true" role="img" style="color: #fbbf24">
<path d="M8 .25a.75.75 0 01.673.418l1.882 3.815 4.21.612a.75.75 0 01.416 1.279l-3.046 2.97.719 4.192a.75.75 0 01-1.088.791L8 12.347l-3.766 1.98a.75.75 0 01-1.088-.79l.72-4.194L.818 6.374a.75.75 0 01.416-1.28l4.21-.611L7.327.668A.75.75 0 018 .25z"></path>
</svg>
Star on GitHub
</a>
</header>
<main class="container">
<!-- Hero Section -->
<section class="hero">
<span class="badge">RELEASE v1.5.0 • ZERO DEPENDENCIES • 20 LANGUAGES</span>
<span class="badge badge-purple">🤖 AI AGENT & MCP SECURITY SCANNING</span>
<h1>
<img src="spc-icon.png" alt="SPC Icon" class="hero-title-icon">
<span>Space Proof Code (SPC)</span>
</h1>
<p>High-performance zero-dependency static analysis tool enforcing NASA Power of Ten reliability rules across 20 programming languages, plus AI agent skill, MCP server config, prompt template, and LLM model configuration security auditing.</p>
<div class="cta-group">
<a href="#quickstart" class="btn-primary">Get Started</a>
<a href="#rule-explorer" class="btn-secondary">Explore 63+ Rules</a>
<a href="#agent-scanner" class="btn-secondary">AI Agent Audit</a>
</div>
</section>
<!-- Key Features Grid -->
<section id="features" class="features-grid">
<div class="feature-card">
<div class="feature-icon">🚀</div>
<h3>NASA Power of Ten</h3>
<p>Enforces safety-critical software reliability rules: bounded loops, static memory allocation, recursion elimination, assertion density, and structured control flow.</p>
</div>
<div class="feature-card">
<div class="feature-icon">🤖</div>
<h3>AI Agent & Skill Auditing</h3>
<p>Scans SKILL.md, AGENTS.md, prompt templates, and agent rules for prompt injection hazards, unsafe shell script execution, hardcoded secrets, and missing guardrails.</p>
</div>
<div class="feature-card">
<div class="feature-icon">⚙️</div>
<h3>MCP & Model Config Audit</h3>
<p>Audits mcp.json, config.json, and model_config.json files for wildcard permission grants, unencrypted env secrets, PyTorch weights deserialization, and exposed endpoints.</p>
</div>
<div class="feature-card">
<div class="feature-icon">🌐</div>
<h3>20 Programming Languages</h3>
<p>Unified static analysis for Ada, Bash, C/C++, C#, Elixir, Fortran, Go, Haskell, Java, JS/TS, Julia, Kotlin, Lua, PHP, Python, Ruby, Rust, Scala, Swift, and Zig.</p>
</div>
<div class="feature-card">
<div class="feature-icon">🔒</div>
<h3>Zero External Dependencies</h3>
<p>Built 100% locally from scratch with native regex AST parsers. Zero supply-chain dependency vulnerabilities or breaking upstream package changes.</p>
</div>
<div class="feature-card">
<div class="feature-icon">📊</div>
<h3>SARIF & CI/CD Pipeline Gates</h3>
<p>Generates SARIF v2.1.0 (GitHub Code Scanning), machine JSON, and Markdown summaries with threshold quality gate blocking for CI runners.</p>
</div>
</section>
<!-- AI Agent Security Showcase -->
<section id="agent-scanner" class="card">
<div class="section-title">
<span class="badge badge-purple">AI & LLM Security</span>
<h2>AI Agent, Skill & MCP Server Auditor</h2>
</div>
<p style="text-align: center; color: var(--pv-text-secondary); max-width: 800px; margin: 0 auto 2rem auto;">
SPC v1.5.0 extends static code analysis to audit your AI agent infrastructure, skills, model context protocol servers, and model deployment configs:
</p>
<div class="features-grid" style="margin-bottom: 0;">
<div class="feature-card">
<h3>🎯 Skill & Prompt Injection Detection</h3>
<p>Flags unescaped user variable interpolation in system prompts, jailbreak patterns, and dangerous shell execution commands like <code>curl | bash</code> inside <code>SKILL.md</code> files.</p>
</div>
<div class="feature-card">
<h3>🛡️ MCP Server Permission Audits</h3>
<p>Flags wildcard grants like <code>"command(.*)"</code> or <code>"write_file(.*)"</code> in <code>mcp.json</code> configs, unencrypted env API keys, and unauthenticated public endpoints.</p>
</div>
<div class="feature-card">
<h3>🧠 LLM Model Deserialization Checks</h3>
<p>Audits <code>model_config.json</code> and Ollama Modelfiles for unsafe PyTorch <code>weights_only=False</code> flags, HTTP weight downloads, and exposed LLM API keys.</p>
</div>
</div>
</section>
<!-- 20 Supported Languages -->
<section id="languages" class="card">
<div class="section-title">
<span class="badge">Multi-Language Ecosystem</span>
<h2>20 Supported Programming Languages</h2>
</div>
<div class="lang-chips">
<span class="lang-chip">🚀 Ada (.ada, .adb)</span>
<span class="lang-chip">🐚 Bash / Shell (.sh, .bash)</span>
<span class="lang-chip">⚡ C / C++ (.c, .cpp, .h)</span>
<span class="lang-chip">🔷 C# (.cs)</span>
<span class="lang-chip">💧 Elixir (.ex, .exs)</span>
<span class="lang-chip">📐 Fortran (.f90, .f95)</span>
<span class="lang-chip">🐹 Go (.go)</span>
<span class="lang-chip">λ Haskell (.hs)</span>
<span class="lang-chip">☕ Java (.java)</span>
<span class="lang-chip">🟨 JavaScript / TypeScript (.js, .ts)</span>
<span class="lang-chip">🟣 Julia (.jl)</span>
<span class="lang-chip">🎯 Kotlin (.kt)</span>
<span class="lang-chip">🌙 Lua (.lua)</span>
<span class="lang-chip">🐘 PHP (.php)</span>
<span class="lang-chip">🐍 Python (.py)</span>
<span class="lang-chip">💎 Ruby (.rb)</span>
<span class="lang-chip">🦀 Rust (.rs)</span>
<span class="lang-chip">🔴 Scala (.scala)</span>
<span class="lang-chip">🍊 Swift (.swift)</span>
<span class="lang-chip">⚡ Zig (.zig)</span>
</div>
</section>
<!-- Interactive Rule Explorer -->
<section id="rule-explorer" class="card">
<div class="section-title">
<span class="badge">Interactive Registry</span>
<h2>Rule & Vulnerability Explorer</h2>
</div>
<div class="search-box">
<input type="text" id="ruleSearchInput" class="search-input" placeholder="Search rules (e.g. prompt_injection, recursion, sql_injection, mcp)..." oninput="filterRules()">
<select id="categoryFilter" class="filter-select" onchange="filterRules()">
<option value="all">All Categories</option>
<option value="nasa">NASA Power of 10</option>
<option value="security">Security Rules</option>
<option value="agent">AI Agent & MCP</option>
<option value="quality">Code Quality</option>
</select>
</div>
<div style="overflow-x: auto;">
<table class="rule-table" id="rulesTable">
<thead>
<tr>
<th>Rule Name</th>
<th>Category</th>
<th>Severity</th>
<th>Documentation Reference</th>
</tr>
</thead>
<tbody id="rulesTableBody">
<!-- Populated via inline JS -->
</tbody>
</table>
</div>
</section>
<!-- CLI Quickstart Section -->
<section id="quickstart" class="card">
<div class="section-title">
<span class="badge">CLI Quickstart</span>
<h2>Command Line Usage</h2>
</div>
<div class="code-box">
<span class="cm"># Install Space Proof Code globally via npm</span>
<span class="fn">npm</span> install -g <span class="str">@putervision/spc</span>
<span class="cm"># Scan current directory for space-proofing & security issues</span>
<span class="fn">spc</span> .
<span class="cm"># Audit AI Agent skills, prompt templates, MCP configs & model files</span>
<span class="fn">spc</span> . <span class="kw">--ai-only</span> <span class="kw">--format</span> json <span class="kw">-o</span> agent-report.json
<span class="cm"># Output SARIF report for GitHub Code Scanning integration</span>
<span class="fn">spc</span> . <span class="kw">--format</span> sarif <span class="kw">-o</span> spc-results.sarif
<span class="cm"># Enforce CI quality gate (fail if severity 4+ detected)</span>
<span class="fn">spc</span> . <span class="kw">--max-issue-severity</span> 4 <span class="kw">--fail-on-issue</span>
</div>
</section>
<!-- Security & Legal -->
<section id="security" class="card">
<div class="section-title">
<span class="badge">Privacy & Legal Disclaimers</span>
<h2>PuterVision Guarantees</h2>
</div>
<div style="max-width: 800px; margin: 0 auto; color: var(--pv-text-secondary); font-size: 0.95rem; line-height: 1.6;">
<p style="margin-bottom: 1rem;">
<strong style="color: var(--pv-text-primary);">Data Privacy & Local Execution Guarantee:</strong> Space Proof Code (<code>@putervision/spc</code>) is engineered by PuterVision with a strict <strong>local-first privacy architecture</strong>. All static analysis, regex parsing, and vulnerability scanning run 100% locally on your machine. No source code, directory structures, or scan results are ever transmitted, telemetry-tracked, or collected.
</p>
<p style="margin-bottom: 1rem;">
<strong style="color: var(--pv-text-primary);">Static Analysis & Safety Disclaimer:</strong> While <code>spc</code> enforces static code rules inspired by NASA's Power of Ten reliability guidelines and AI agent security standards, static analysis cannot guarantee the total absence of runtime defects or mission failures. Developers are advised to complement <code>spc</code> with dynamic testing, fuzzing, and formal verification.
</p>
<p>
<strong style="color: var(--pv-text-primary);">Trademarks & Non-Affiliation Notice:</strong> All product names, trademarks, service marks, logos, and brands (such as NASA, ISO/IEC, MISRA, Node.js, and GitHub) referenced in this project are the property of their respective owners. References are for educational and compatibility identification purposes only.
</p>
</div>
</section>
<footer>
<p>© 2025-2026 <a href="https://putervision.com" target="_blank" rel="noopener noreferrer" style="color: var(--pv-cyan); text-decoration: none;">PuterVision</a>. Released under the MIT License.</p>
<p style="margin-top: 0.5rem; font-size: 0.82rem;">Space Proof Code • 20 Languages • AI Agent Auditing • Zero External Dependencies • Local Execution</p>
</footer>
</main>
<script>
const rulesData = [
{ name: 'recursion', category: 'nasa', severity: 4, url: 'docs/nasa-rules.md#recursion' },
{ name: 'unbounded_loops', category: 'nasa', severity: 5, url: 'docs/nasa-rules.md#unbounded-loops' },
{ name: 'dynamic_memory', category: 'nasa', severity: 3, url: 'docs/nasa-rules.md#dynamic-memory' },
{ name: 'async_risk', category: 'nasa', severity: 4, url: 'docs/nasa-rules.md#async-risk' },
{ name: 'global_vars', category: 'nasa', severity: 3, url: 'docs/nasa-rules.md#global-vars' },
{ name: 'set_timeout', category: 'nasa', severity: 4, url: 'docs/nasa-rules.md#set-timeout' },
{ name: 'complex_flow', category: 'nasa', severity: 2, url: 'docs/nasa-rules.md#complex-flow' },
{ name: 'try_catch', category: 'quality', severity: 2, url: 'docs/nasa-rules.md#try-catch' },
{ name: 'multiple_returns', category: 'quality', severity: 2, url: 'docs/nasa-rules.md#multiple-returns' },
{ name: 'nested_conditionals', category: 'quality', severity: 2, url: 'docs/nasa-rules.md#nested-conditionals' },
{ name: 'exceeds_max_func_lines', category: 'quality', severity: 3, url: 'docs/nasa-rules.md#exceeds-max-function-lines' },
{ name: 'unchecked_func_return', category: 'quality', severity: 2, url: 'docs/nasa-rules.md#unchecked-function-return' },
{ name: 'unchecked_func_return_crit', category: 'security', severity: 4, url: 'docs/nasa-rules.md#unchecked-function-return-critical' },
{ name: 'eval_usage', category: 'security', severity: 5, url: 'docs/security-rules.md#eval-usage' },
{ name: 'unsafe_input', category: 'security', severity: 4, url: 'docs/security-rules.md#unsafe-input' },
{ name: 'network_call', category: 'security', severity: 3, url: 'docs/security-rules.md#network-call' },
{ name: 'weak_crypto', category: 'security', severity: 4, url: 'docs/security-rules.md#weak-crypto' },
{ name: 'unsafe_file_op', category: 'security', severity: 3, url: 'docs/security-rules.md#unsafe-file-op' },
{ name: 'unsanitized_exec', category: 'security', severity: 5, url: 'docs/security-rules.md#unsanitized-exec' },
{ name: 'exposed_secrets', category: 'security', severity: 5, url: 'docs/security-rules.md#exposed-secrets' },
{ name: 'unrestricted_cors', category: 'security', severity: 4, url: 'docs/security-rules.md#unrestricted-cors' },
{ name: 'sql_injection', category: 'security', severity: 5, url: 'docs/security-rules.md#sql-injection' },
{ name: 'ssrf_risk', category: 'security', severity: 4, url: 'docs/security-rules.md#ssrf-risk' },
{ name: 'pickle_deserialize', category: 'security', severity: 5, url: 'docs/security-rules.md#pickle-deserialize' },
{ name: 'prompt_injection_hazard', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#prompt-injection-hazard' },
{ name: 'unsafe_skill_command', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#unsafe-skill-command' },
{ name: 'unbounded_agent_loop', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#unbounded-agent-loop' },
{ name: 'hardcoded_agent_secret', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#hardcoded-agent-secret' },
{ name: 'overly_broad_tool_grant', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#overly-broad-tool-grant' },
{ name: 'overly_permissive_mcp_grant', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#overly-permissive-mcp-grant' },
{ name: 'unencrypted_mcp_env_secret', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#unencrypted-mcp-env-secret' },
{ name: 'unsafe_mcp_tool_schema', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#unsafe-mcp-tool-schema' },
{ name: 'exposed_mcp_endpoint', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#exposed-mcp-endpoint' },
{ name: 'unsafe_model_deserialization', category: 'agent', severity: 5, url: 'docs/ai-agent-rules.md#unsafe-model-deserialization' },
{ name: 'insecure_model_endpoint', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#insecure-model-endpoint' },
{ name: 'unauthenticated_model_download', category: 'agent', severity: 4, url: 'docs/ai-agent-rules.md#unauthenticated-model-download' },
];
function renderRules(rules) {
const tbody = document.getElementById('rulesTableBody');
tbody.innerHTML = '';
rules.forEach(rule => {
const tr = document.createElement('tr');
tr.innerHTML = `
<td><code>${rule.name}</code></td>
<td><span class="badge" style="margin:0; padding: 0.2rem 0.6rem;">${rule.category}</span></td>
<td><span class="severity-pill sev-${rule.severity}">${rule.severity}/5</span></td>
<td><a href="https://github.com/putervision/spc/tree/main/${rule.url}" target="_blank" style="color: var(--pv-cyan); text-decoration: none;">View Docs →</a></td>
`;
tbody.appendChild(tr);
});
}
function filterRules() {
const query = document.getElementById('ruleSearchInput').value.toLowerCase();
const cat = document.getElementById('categoryFilter').value;
const filtered = rulesData.filter(rule => {
const matchesQuery = rule.name.toLowerCase().includes(query) || rule.category.toLowerCase().includes(query);
const matchesCat = cat === 'all' || rule.category === cat;
return matchesQuery && matchesCat;
});
renderRules(filtered);
}
// Initial render
renderRules(rulesData);
</script>
</body>
</html>