Metadata-Version: 2.4
Name: stigcode
Version: 0.0.1
Summary: SARIF-to-compliance bridge. Transforms SAST scan results into DISA STIG checklists, ATO evidence artifacts, and compliance-native output.
Author: rdwj
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/rdwj/stigcode
Project-URL: Repository, https://github.com/rdwj/stigcode
Project-URL: Issues, https://github.com/rdwj/stigcode/issues
Keywords: stig,disa,compliance,sarif,sast,ato,nist,security,ckl
Classifier: Development Status :: 1 - Planning
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# Stigcode

**SARIF-to-compliance bridge.** Transforms SAST scan results from any scanner into DISA STIG checklists, ATO evidence artifacts, and compliance-native output.

Stigcode is the compliance companion to [Sanicode](https://github.com/rdwj/sanicode). While Sanicode scans code for vulnerabilities, Stigcode transforms those findings into the formats that ISSOs, assessors, and authorizing officials actually need.

## Status

This project is in early development. See the [issue tracker](https://github.com/rdwj/stigcode/issues) for planned work.

## Architecture

```
Source Code → [Any SAST Scanner] → SARIF v2.1.0 → [Stigcode] → CKL / ATO Reports / OSCAL
```

Stigcode consumes SARIF from any scanner (Sanicode, Semgrep, CodeQL, SonarQube, Bandit, SpotBugs) and produces:

- **DISA STIG Viewer `.ckl` files** — import directly into assessment workflows
- **ATO evidence reports** — PDF/Markdown summaries for ATO packages
- **NIST 800-53 coverage matrices** — control family coverage with gap identification
- **OSCAL output** (future) — for automated ATO pipelines

## License

Apache-2.0
