Nox
Star —

Capabilities

One scanner, full coverage, standard outputs.

NOX avoids tool sprawl by unifying detection, policy enforcement, and extension under one operating model. Every capability is deterministic, offline-capable, and CI-safe by default.

Detection Engine

  • 1,505 catalog rules — 884 secrets, 485 IaC, 82 AI/MCP/agent, 12 data sensitivity, plus supply-chain and provenance families
  • Of those, a dataflow engine computes TAINT-001..011, TAINT-AI-001/002, AGENTFLOW-001/002 and CRYPTO-001/002 rather than pattern-matching them
  • Secrets, AI security, IaC, dependencies, taint and data sensitivity in one scan
  • nox verify-secrets asks the issuer whether a detected credential still works, using the leaked credential itself — so a finding becomes LIVE or revoked rather than merely "looks like a token". Endpoints are compiled in and the secret never appears in output; this is validity checking, not revocation
  • Deterministic execution with offline-first defaults
  • Rule configuration and severity overrides through .nox.yaml

Taint & dataflow analysis

  • 21 languages: Python, JavaScript/TypeScript, Go, PHP, Java, C#, Rust, Ruby, C/C++, Scala, Kotlin, Perl, Swift, PowerShell, Shell, Lua, Dart, Objective-C, Elixir, Clojure, Groovy
  • SQL injection, command injection, XSS, path traversal, unsafe deserialization, SSRF and open redirect, each honoring per-class sanitizers
  • Interprocedural within a file — taint follows a helper call, and the call path is named in the finding
  • AGENTFLOW-001/002: untrusted input reaching an LLM prompt, and LLM output reaching a dangerous sink
  • Pure Go — go/ast for Go, deterministic line/statement recognizers elsewhere. No tree-sitter, no CGo, one static binary
  • Measured precision 1.00 on a labeled corpus, held by a CI gate with per-rule floors and an anti-cheat self-test

It reports what it could not check

  • An OSV outage, a dead plugin, an unparseable lockfile or a corrupt baseline used to exit 0 — indistinguishable from a clean pass
  • Every incomplete check is recorded in findings.json under meta.degradations, with what failed and what may be missing
  • Printed to stderr even under --quiet: quiet suppresses noise, not a warning that results are partial
  • --fail-on-degraded makes CI treat "could not check" as failure — exposed as fail-on-degraded on the GitHub Action since 1.14.0
  • Silence is preserved where nothing is wrong — a missing baseline before the first write is not a degradation

AI Security (first-class)

  • Prompt injection at the call site (AI-PI-*, OWASP LLM01)
  • Embedding leakage when secrets / PII reach vector stores (LLM06)
  • Agent over-privilege when file_read + http_request share a context (LLM07)
  • Agent-config execution surface (AGENT-001..006) — injection, permission-bypass, wildcard tool grants, exfiltration, unauthenticated A2A agent cards (ASI07), and DXT extension command injection (ASI02)
  • OWASP Top 10 for Agentic Applications (ASI01–ASI10) mapping on findings
  • Cross-file AI taint — request.json → service hop → chat.completions.create
  • Role-aware prompt injection — untrusted input in the system role fires (TAINT-AI-001 / AGENTFLOW-001); the same input in the user role behind a static system prompt does not. Reaching an LLM is necessary but not sufficient
  • Static→dynamic confirmation (nox confirm) — an opt-in, active loop that fires an adversarial corpus at a running target and marks each AI finding CONFIRMED or UNCONFIRMED, separating a true positive from a false positive static analysis alone cannot. Reflection-immune: a bare echo of the payload can never false-confirm. Refuses without --authorize; never part of nox scan
  • MCP server hardening misconfigs (MCP-001..008)
  • Polyglot AIBOM v2.0 — every model invocation, auth env, and endpoint

MCP drift detection (rug-pull)

  • nox mcp baseline captures an MCP server’s tool manifest to a reviewable, diffable .nox/mcp-baseline.json — commit it, review it in PRs
  • nox mcp drift re-captures and reports change against the baseline: an added or removed tool, a changed description, a widened schema
  • Drift becomes findings (MCP-DRIFT-001..006) — a new code-exec tool is critical, a poisoned description high — flowing through the normal findings.json / SARIF path, exiting non-zero for CI
  • The safe form of on-device adaptation: the baseline is data you diff and review, not a mutating rule. Deterministic — an unchanged server produces no drift
  • Speaks MCP over stdio; verified against nox’s own MCP server. Untrusted servers must be sandboxed — nox prints the reminder, it does not sandbox for you

Supply-chain integrity (deterministic, offline)

  • Slopsquatting / hallucinated-package detection (SLOP-001) — imports of a package in no manifest, no standard library, no local module (Python + JS/TS)
  • Predictive slopsquatting (SLOP-002) — a signed, versioned feed of high-risk names an LLM is likely to hallucinate that are currently unregistered, so an attacker could claim them. Bundled or fetched from a remote HTTPS URL, verified against a SHA-256 digest and an Ed25519 signature pinned to an operator key — a tampered, wrong-identity, or unsigned feed is rejected, not trusted. Off by default and fails closed; a scheduled pipeline regenerates and signs it. Learning stays central and signed, enforcement stays local and deterministic
  • CVE-variant detection (nox variants, VARIANT-*) — first-party code reproducing Log4Shell, Zip Slip, PyYAML full-loader, tar traversal, SSTI, or shell interpolation
  • Dependency provenance (PROV-001/002, ASI04 / SLSA) — non-registry (VCS/URL/tarball) sources and mutable-ref pins instead of immutable commit SHAs
  • SCA across 7 ecosystems and 13 lockfile formats via OSV.dev — including yarn, pnpm and poetry — enriching CycloneDX / SPDX SBOM
  • Real CVSS v3 base scores computed from OSV vector strings, so a critical dependency CVE can trip a critical gate
  • Go versions read from go.mod (what Minimal Version Selection chose), not go.sum, which hashes every version the resolver ever considered
  • Advisories matched per package rather than per module; provably unreachable findings are demoted to info with the affected paths recorded, never dropped

Cosign-signed Marketplace

  • Sigstore keyless OIDC signatures on every official plugin release
  • Default trust policy refuses unsigned drops (fails closed) — enforced on install, update and .nox.yaml auto-install alike
  • Trust chain: cosign(checksums.txt) ⇒ tarball SHA ⇒ registry digest
  • Plugin binaries re-verified against their install-time digest before they run, so tampering can stop a plugin but never escalate one
  • The registry lives in its own repository (Nox-HQ/registry); nox only consumes the published index over HTTP
  • Optional Ed25519 signer keyring for enterprise-restricted environments

The plugin sandbox

  • The plugin↔host gRPC channel binds loopback only and is authenticated with a fresh per-launch token
  • Fingerprints are derived host-side and namespaced by plugin, so a plugin cannot claim (and suppress) a core or another plugin's finding
  • Per-tool safety declarations: a read-only tool runs under a passive policy while its active siblings stay gated
  • Track safety profiles from the registry entry — never self-declared, or a plugin would choose its own sandbox
  • Post-scan tools are subject to the same policy as scan tools: nothing rewrites your source until plugin_policy.max_risk_class: active is set
  • Archive extraction bounded by total bytes and entry count against decompression bombs

Manifest-driven plugins (.nox.yaml)

  • Declare plugins.required like dependencies in package.json
  • nox install fetches the pinned set, signature-verified
  • nox scan auto-installs missing required plugins on first run
  • plugins.trust_policy: default | enterprise | permissive
  • Per-project registry overrides for private plugin distribution

Standard Outputs

  • SARIF 2.1.0 for GitHub Code Scanning, carrying security-severity so alerts can be classified, filtered and matched by alert rules
  • CycloneDX and SPDX SBOM generation, deterministic when one CVE affects several packages
  • Reproducible builds — the HTML report honors SOURCE_DATE_EPOCH
  • Standalone HTML dashboard with dark theme and filtering
  • AI inventory JSON with connection graph and tool matrix
  • OpenVEX waiver support — fingerprint-pinned and rule-ID-matching

Policy and Governance

  • Fail/warn thresholds and per-severity budgets for CI policy gates
  • One-command adoption (nox baseline init) — record existing debt, gate the change
  • GRC compliance across 13 frameworks — 15 baselines including FedRAMP Low/Moderate/High — with gap analysis and evidence collection, via nox/grc
  • Inline suppressions with audit trail and expiry — a waiver that suppresses nothing is now reported, and an unparseable expiry is refused rather than becoming permanent

Plugin Ecosystem

  • 18 current plugins across 8 tracks with a gRPC-based SDK
  • All published in the official registry and Cosign-verified
  • Track-based architecture with explicit risk classification
  • nox/reachability installs from the registry like any other plugin (nox plugin install nox/reachability, or plugins.required in .nox.yaml) — nox ships no bundled plugins
  • Plugin scaffolding via nox plugin init; nox plugin install --local for development

Agent-native via MCP

  • 22 read-only tools for AI agent integration
  • 8 MCP resources for artifact serving (findings, SARIF, both SBOMs, AI inventory, rules, dashboard)
  • Structured output alongside text, so an agent parses fields rather than prose
  • Workspace allowlisting and a 1 MB output cap enforced on every tool, dashboards included
  • Sandboxed execution with rate limiting
  • Drop-in for Claude Desktop, Cursor, Continue, any MCP host

Developer Experience

  • Inline editor diagnostics via nox lsp (Language Server) — VS Code and JetBrains extensions, deterministic and offline
  • Deterministic fix patches for mechanical misconfigs (nox fix --content) — previewed as a diff, applied only with --write, never LLM-guessed
  • nox fix --actions pins GitHub Actions to immutable commit SHAs, comparing Releases against tags so a pin can never move backward
  • nox fix --outdated upgrades dependencies that are merely out of date, not only vulnerable ones — Go, npm, PyPI, Cargo, RubyGems, Composer and NuGet. Direct dependencies only, never a prerelease, never a downgrade, and a registry that cannot answer is reported rather than assumed current
  • nox doctor reports environment, plugin state and config sanity in one command
  • nox agent-graph renders the agent capability lattice as mermaid or dot
  • Reachability-aware finding prioritization (--sort priority) sinks likely false positives
  • Watch mode for continuous scanning during development
  • Pre-commit hooks and shell completions
  • Incremental scan cache with content-addressed SHA-256
  • Differential scanning with --changed-since and single-file scans for fast CI + hooks
  • nox bench --precision scores a labeled corpus; nox calibrate suggests severity overrides from the result

Supply Chain Security

  • Cosign keyless signing on the nox CLI itself + every plugin
  • SLSA Level 3 provenance attestation
  • Multi-platform builds (linux/darwin/windows × amd64/arm64)
  • Dependency confusion detection and artifact integrity verification