Metadata-Version: 2.4
Name: NeuG-codescope
Version: 0.1.0
Summary: Code property graph (CPG) construction and LLM-assisted vulnerability auditing for C/Java/Python/Rust, backed by neug
Author-email: chengsha <chengsha.lcc@alibaba-inc.com>
License-Expression: Apache-2.0
Keywords: code-property-graph,cpg,static-analysis,dataflow-analysis,vulnerability-detection,neug,tree-sitter,libclang
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: neug
Requires-Dist: networkx
Requires-Dist: requests
Provides-Extra: c
Requires-Dist: libclang; extra == "c"
Provides-Extra: java
Requires-Dist: tree-sitter; extra == "java"
Requires-Dist: tree-sitter-java; extra == "java"
Provides-Extra: rust
Requires-Dist: tree-sitter; extra == "rust"
Requires-Dist: tree-sitter-rust; extra == "rust"
Provides-Extra: llm
Requires-Dist: openai; extra == "llm"
Provides-Extra: all
Requires-Dist: libclang; extra == "all"
Requires-Dist: tree-sitter; extra == "all"
Requires-Dist: tree-sitter-java; extra == "all"
Requires-Dist: tree-sitter-rust; extra == "all"
Requires-Dist: openai; extra == "all"
Dynamic: license-file

# NeuG-codescope

Code property graph (CPG) construction and LLM-based vulnerability audit tool for C / Java / Python / Rust,
backed by the [neug](https://pypi.org/project/neug/) graph store. The importable package name is `codegraph`.

## Installation

Requires Python >= 3.10.

```bash
# Full install (all language frontends + LLM loop dependencies)
pip install "neug-codescope[all]"

# Minimal install (neug + networkx + requests)
pip install neug-codescope

# Optional extras: c (libclang), java (tree-sitter + tree-sitter-java),
#                  rust (tree-sitter-rust), llm (openai)
pip install "neug-codescope[c,rust]"
```

If libclang cannot be located automatically, set the `LIBCLANG_PATH` environment variable (only needed by the C frontend).
The Python frontend uses the standard library `ast` and needs no extra dependencies.

## Usage

Every entry point is available both as a console script and via `python -m`:

| console script | module | purpose |
|---|---|---|
| `codescope-audit` | `codegraph.llmxcpg_neug.file_audit` | Two-stage audit (tier1 summary graph + on-demand tier2 detailed CPG) |
| `codescope-repo-audit` | `codegraph.llmxcpg_neug.repo_audit` | Whole-repo CPG + multi-round LLM/Cypher audit |
| `codescope-pipeline` | `codegraph.llmxcpg_neug.pipeline` | LLMxCPG three-stage pipeline |
| `codescope-detect` | `codegraph.llmxcpg_neug.detect` | LLM vulnerability detection on slices |
| `codescope-depgraph-bridge` | `codegraph.integration.depgraph_bridge` | dashscope-depgraph x file_audit integration |

Example (file_audit tool mode):

```bash
# Build the tier1 function-level summary graph
codescope-audit audit -i <project-dir> --out <output-dir> --build-only --skip-cpg

# Then drive step by step from the audited project's root directory
cd <project-dir>
codescope-audit overview --db-path <output-dir>/audit.neug
codescope-audit build "func:<relpath>:<name>" --db-path <output-dir>/audit.neug
codescope-audit query "MATCH (s:Symbol) RETURN s.node_id LIMIT 10" --db-path <output-dir>/audit.neug
```

For the full workflow (tier1/tier2 design, dataflow bug taxonomy, report formats), see `SKILL.md` in the source repository.

## Development

```bash
pip install -e ".[all]"          # Editable install
python -m tests.smoke_test       # Smoke test (run from the project root)
```
