全部项目

商业摘要已提供本语言版本。产品详细流程和技术证据以英语维护。

安全与保障

Achilles

在 AI 生成的代码带来风险之前进行检查。

AI 辅助开发增加了待审查代码量。团队需要可以检查、分级处理并与现有扫描工具比较的发现。

应用安全和工程负责人

查看完整流程讨论您的使用场景

软件原型，访问须签署保密协议

A finding to investigate
request input
  → file path construction
  → filesystem access

Review question:
Can input escape the intended directory?
Input
Representative maintained source
Analysis
Selected rules and bounded taint paths
Evidence
Source location, rule and review context
Decision
Confirm, dismiss with reason, or investigate
Decision logic and control flow

Explore the reasoning

Agree the code, rule set and current scanners against which the evaluation will be judged.

Engage now
A bounded evaluation plan covering rule fit, review workflow and comparison with your current tools.
Inspect
Source prototype, access under NDA
Five Rust crates covering parsers, core analysis, optional AI support, LSP, and CLI surfaces.
Still to validate
Static rules can produce false positives and false negatives; a clean scan is not a security guarantee.
Measure false positives, false negatives, language coverage, and operating impact against representative maintained repositories.

源码审查日期

The decision behind the system

What should a reviewer inspect before accepting AI code?

A Rust static-analysis toolkit for AI-generated and AI-application code: deterministic rules, bounded taint analysis, editor diagnostics and reviewable CI findings. Complements existing SAST and accountable security review.

Achilles inspects selected code and application-security patterns. Aegis organises system-level governance evidence. Neither substitutes for accountable security review.

Rules you can inspect

Tree-sitter parsing and source-controlled rules identify selected risky patterns. Bounded taint analysis supports selected high-risk rules.

Where developers work

CLI, language-server diagnostics and SARIF output put findings into editor, CI and code-review workflows.

Team-specific triage

Custom rule setup, severity overrides and optional model-assisted triage help adapt review to a team's code and risk model.

Read the complete system walkthrough

  1. Select

    Agree the code, rule set and current scanners against which the evaluation will be judged.

  2. Inspect

    Examine deterministic rules and selected bounded taint paths. A potential finding is a question for review, not proof of exploitability.

  3. Triage

    Follow the finding into CLI, editor or SARIF review. Keep optional model-assisted triage distinct from deterministic analysis.

  4. Compare

    Review missed cases and false positives, remediate and rescan. A clean scan is not a security guarantee.

See all evidence and limits

Inspect the source, test conditions and operating limits in the technical record.

查看技术记录与证据

业务 ↔ 技术桥梁 · Security capability experiment

Convert fast AI-assisted coding into reviewable release evidence.

Explores deterministic security analysis for AI-generated and AI-application code.

这是对项目组合与源代码的解读，并非客户、部署、认证或成果声明。

  1. 01

    业务压力

    AI-assisted development can increase code volume and repeat insecure patterns faster than conventional review capacity grows.

  2. 02

    产品决策

    Keep deterministic parsing and source-controlled rules primary, with model-assisted triage optional and explicitly separate.

  3. 03

    技术记录

    Rust crates, tree-sitter parsers, YAML rules, SARIF output, CLI, LSP, CI integration, and selected fixtures.

  4. 04

    证据回流

    Findings and unresolved uncertainty return to remediation priority, release criteria, security review, and engineering policy.

仓库／运行时边界

本页解读的是独立项目仓库中的源代码。源代码存在，并不表示该项目作为服务运行在 hyperion-consulting.io 内。

访客及客户数据的 AI 处理限于通过受治理的欧盟端点使用 Mistral。所有者授权的 Helio、搜索及 Product Council 流程已启用。独立的公开来源编辑流程使用 Anthropic，并以受治理的 Mistral 作为备用；该流程不接收网站咨询、客户文档或访客对话。远程 AI 不可用时，确定性工具仍可使用。

源码证据

源码实际能够证明什么

A Rust static-analysis toolkit for AI-generated and AI-application code. The reviewed source includes tree-sitter parsing, deterministic rules, bounded taint analysis for selected rules, SARIF output, CLI and editor diagnostics, and optional model-assisted triage.

详细技术快照以英文维护。

成熟度
Source prototype, access under NDA
证据审查
源码快照截至

产品与架构决策

  • Keep deterministic parsing and rules as the primary scan path; make model-assisted analysis optional.
  • Represent findings in interoperable output such as SARIF for CI and code-review workflows.
  • Position the tool as a complement to general-purpose security scanners, not a replacement for them.

可核验的证据

  • Five Rust crates covering parsers, core analysis, optional AI support, LSP, and CLI surfaces.
  • Source-controlled rules, selected bounded taint paths, custom-rule setup and severity overrides.
  • Integration fixtures, SARIF help links, a GitHub Action, editor extension and in-memory language-server diagnostics.

声明边界

  • Static rules can produce false positives and false negatives; a clean scan is not a security guarantee.
  • Optional model-assisted triage requires separate configuration and review.
  • No certification, comprehensive vulnerability coverage, or customer security outcome is asserted.

代码仓库证据不等同于客户、部署、认证或成果证据。

架构

从 CI 钩子到安全发现项

三层架构：CLI 与 CI 集成、一个针对 AI 生成代码和 AI 应用中选定模式的 210 规则 AST 扫描器，以及可能有助于对发现项排序的可选模型辅助分诊。三者都不能替代安全评审。

仅为源代码图：一层可能代表已实现代码、适配器边界或文档设计，并不证明已配置生产服务。

  1. 01

    第 1 层 — 开发者界面

    Rust 命令行、LSP、CI 和 SARIF 接口支持本地扫描和评审流程中的扫描。不对通用运行时或大规模性能作任何声明。

  2. 02

    第 2 层 — 210 规则引擎

    The source represents parsers for JavaScript, TypeScript, Python, Go, Java, Rust, Ruby, PHP, C# and Swift. Source-controlled rules cover selected AI-generated and AI-application risks, with bounded taint analysis for selected high-risk rules. Coverage and accuracy require evaluation against representative code.

  3. 03

    第 3 层 — 可选的模型辅助分诊

    使用本地或托管的 Mistral 模型进行可选分诊，可能有助于筛除疑似误报，并根据上下文对发现项重新排序。仅在启用时运行，不能替代安全评审。

覆盖 5 个类别的 210 条规则

需要明确规则的 AI 应用模式

确定性规则识别 AI 应用中选定的模式；可选的模型辅助分诊可能有助于对发现项排序，但两者都不能替代安全评审。

仅为仓库表面：可用性、完整性、性能与运营适用性需要另行验证。

氛围编码模式

01

提示模板中硬编码的 API 密钥、“只是演示”代码路径里通过字符串拼接的 SQL、不安全的反序列化、对 LLM 输出执行 eval、以 INFO 级别记录密钥。当“能跑一次”压倒“安全运行”时随之而来的一簇模式。

智能体安全

02

没有参数验证的工具定义、与管理员权限重叠的智能体能力、LLM 可调用工具上缺失的速率限制、泄露系统身份的提示前缀。让一次越狱演变为一起事件的那一簇问题。

LLM 应用风险

03

未净化的 LLM 输出被渲染为 HTML、用户可控上下文中的提示注入途径、经由检索文档的间接注入、将模型输出送入 shell 或 eval、缺失的输出模式验证。把 OWASP-LLM-Top-10 落到实处。

框架漏洞

04

无鉴权暴露的 Next.js Server Action、FastAPI 依赖注入绕过、LangChain 思维链泄露、通过 raw() 造成的 Django ORM SQL 注入、不安全的模板渲染。逐框架定制的规则,而非通用的污点追踪。

云安全

05

带有敏感前缀的公开 S3、具有 `*` 操作权限的 IAM 角色、AWS Bedrock 跨账户权限、在缺失服务账户上下文中暴露的 GCP Vertex AI。让一个泄露的端点 URL 演变为完整数据外泄的那一簇问题。

技术栈

技术构建

所列技术仅标识仓库依赖项或适配器表面，并不证明存在活动集成或部署。

核心引擎
Rust 工作区:achilles-parsers、achilles-core、achilles-ai、achilles-lsp、achilles-cli——tree-sitter、serde、regex、YAML 规则引擎、污点流分析
语言解析器
tree-sitter-javascript、tree-sitter-typescript、tree-sitter-python、tree-sitter-go、tree-sitter-java、tree-sitter-rust、tree-sitter-ruby、tree-sitter-php、tree-sitter-c-sharp、tree-sitter-swift
AI 集成
Mistral AI SDK、Ollama 客户端、可配置的模型选择、误报过滤、严重程度重排序
CLI、LSP 与输出
clap、colored、serde_json、SARIF v2.1.0 输出、语言服务器协议
CI/CD
GitHub Actions(CI + 交叉编译发布)、GitLab CI、Bitbucket Pipelines、预提交钩子
平台
Linux (amd64/arm64)、macOS (amd64/arm64)、Windows (amd64)
Technical documents & controlled source access

源代码

探索代码

Achilles 源代码可应要求提供,用于评估与合作目的。

需要签署保密协议

若要访问源代码,请签署我们的保密协议。

与 Hyperion 合作

评估一个有代表性的代码样本

一份范围明确的评估计划，涵盖规则适用性、审查流程以及与现有工具的比较。

请简要说明您的情况、限制条件和待作决策。开始工作前，我们会商定范围、责任和报价。

评估一个有代表性的代码样本探索咨询服务