psyray/oasis

OASIS – Open Automated Security Intelligence Scanner

What it is – OASIS is a Python‑based command‑line tool that uses locally‑run large language models (LLMs) to audit source code for security problems. It works with any Ollama model or any OpenAI‑compatible server (vLLM, LM Studio, LocalAI, etc.) and produces machine‑readable JSON reports plus optional HTML, PDF or Markdown renderings.

How it works – The tool follows a LangGraph‑orchestrated pipeline:

1. Discovery – walks the supplied files/directories and chunks code (by file or, experimentally, by function).
2. Quick scan – runs a lightweight model (configurable via --scan-model) to flag potential issues.
3. Deep analysis – feeds the flagged snippets to one or more larger models (--models) for a detailed vulnerability description, severity, exploitability verdict, and optional proof‑of‑concept hints.
4. Finding validation – a deterministic, code‑driven validator runs during the scan, attaching a confidence‑weighted verdict to each finding.
5. Reporting – each finding is written as a canonical JSON object; the tool also generates HTML dashboards, PDF/Markdown summaries, and SARIF files for CI integration.

Key features

• Multi‑model support – you can combine a fast “scan” model with a powerful “deep‑analysis” model, or run several deep models in parallel and merge their outputs (--report-model).
• Local‑only operation – all LLM calls happen against a locally hosted Ollama instance or a self‑hosted OpenAI‑compatible server, keeping code and data private.
• Interactive web UI – oasis --web launches a password‑protected dashboard where you can explore findings, ask the assistant to re‑investigate a specific issue, or view RAG‑enhanced explanations.
• Caching – embeddings and analysis results are cached on disk and can be cleared or aged out (--clear-cache-embeddings, --cache-days).
• CI/CD friendly – exit codes can be forced on a severity threshold (--fail‑on), and a GitHub‑Actions example is provided.
• Suppression & diff – you can maintain a JSON registry of suppressed fingerprints, and compare a new run against a baseline (--diff‑against).
• Extensible prompts – custom instruction text can be appended to the LLM prompts (--custom‑instructions).

Typical workflow

# Install (editable) via pipx
pipx install -e .

# Run a two‑phase scan on a project using a small and a large model
oasis -i my_project/ -sm gemma3:4b -m llama3:latest

# Serve the results locally for interactive review
oasis -i my_project/ -sm gemma3:4b -m llama3:latest --web

The reports appear under security_reports/<project‑slug>/ and can be opened directly in a browser or consumed by other tools.

Who it’s for – developers, security engineers, or DevSecOps teams who want to add AI‑assisted static analysis to their code‑review pipeline without sending proprietary code to external services.

---

TL;DR – OASIS is an open‑source, locally‑run AI security scanner that orchestrates multiple LLMs to find, validate, and report code vulnerabilities, with a web dashboard and CI integration.